ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Wireshark-users: Re: [Wireshark-users] Wireshark Causing SMB Query

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sun, 3 Mar 2013 10:54:23 -0800
On Mar 3, 2013, at 1:51 AM, Jim Aragon <Jim@xxxxxxxxxxxxxxxxx> wrote:

> I'm also wondering why Wireshark would look for this directory every time a capture is started or restarted, rather than when Wireshark is launched, shut down, or a preference is changed. Those seem like the logical times to read or write preferences, not when a capture is started.

The preferences file isn't the only file stored there.  There are also files called "recent" and "recent_common", which are used to remember various user decisions that aren't stored as preferences, such as window sizes, column sizes, and the last capture filter used.