You can save captured packets simply by using the→ menu item. You can choose which packets to save and which file format to be used.
Not all information will be saved in a capture file. For example, most file formats don’t record the number of dropped packets. See Section B.1, “Capture Files” for details.
The “Save Capture File As” dialog box allows you to save the current capture to a file. The following sections show some examples of this dialog box. The appearance of this dialog depends on the system. However, the functionality should be the same across systems.
This is the common Windows file save dialog with some additional Wireshark extensions.
Specific behavior for this dialog:
.pcap) Wireshark will append the standard file extension for that file format.
This is the common Gimp/GNOME file save dialog with additional Wireshark extensions.
Specific for this dialog:
With this dialog box, you can perform the following actions:
Some capture formats may not be available depending on the packet types captured.
|Wireshark can convert file formats|
You can convert capture files from one format to another by reading in a capture file and writing it out using a different format.
Wireshark can save the packet data in its native file format (pcapng) and in the file formats of other protocol analyzers so other tools can read the capture data.
|Different file formats have different time stamp accuracies|
Saving from the currently used file format to a different format may reduce the time stamp accuracy; see the Section 7.5, “Time Stamps” for details.
The following file formats can be saved by Wireshark (with the known file extensions):
New file formats are added from time to time.
Whether or not the above tools will be more helpful than Wireshark is a different question ;-)
|Third party protocol analyzers may require specific file extensions|
Wireshark examines a file’s contents to determine its type. Some other protocol
analyzers only look at a filename extensions. For example, you might need to use