You can save captured packets by using the→ or → menu items. You can choose which packets to save and which file format to be used.
Not all information will be saved in a capture file. For example, most file formats don’t record the number of dropped packets. See Section B.1, “Capture Files” for details.
The “Save Capture File As” dialog box allows you to save the current capture to a file. The exact appearance of this dialog depends on your system. However, the functionality is the same across systems. Examples are shown below.
This is the common Windows file save dialog with some additional Wireshark extensions.
This is the common Qt file save dialog with additional Wireshark extensions.
You can perform the following actions:
If you don’t provide a file extension to the filename (e.g.,
.pcap) Wireshark will append the standard file extension for that file format.
|Wireshark can convert file formats|
You can convert capture files from one format to another by opening a capture and saving it as a different format.
If you wish to save some of the packets in your capture file you can do so via Section 5.7.1, “The “Export Specified Packets” Dialog Box”.
Wireshark can save the packet data in its native file format (pcapng) and in the file formats of other protocol analyzers so other tools can read the capture data.
|Saving in a different format might lose data|
Saving your file in a different format might lose information such as comments, name resolution, and time stamp resolution. See Section 7.6, “Time Stamps” for more information on time stamps.
The following file formats can be saved by Wireshark (with the known file extensions):
New file formats are added from time to time.
Whether or not the above tools will be more helpful than Wireshark is a different question ;-)
|Third party protocol analyzers may require specific file extensions|
Wireshark examines a file’s contents to determine its type. Some other protocol
analyzers only look at a file’s extension. For example, you might need to use