Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Wireshark Causing SMB Query

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sun, 3 Mar 2013 10:54:23 -0800
On Mar 3, 2013, at 1:51 AM, Jim Aragon <Jim@xxxxxxxxxxxxxxxxx> wrote:

> I'm also wondering why Wireshark would look for this directory every time a capture is started or restarted, rather than when Wireshark is launched, shut down, or a preference is changed. Those seem like the logical times to read or write preferences, not when a capture is started.

The preferences file isn't the only file stored there.  There are also files called "recent" and "recent_common", which are used to remember various user decisions that aren't stored as preferences, such as window sizes, column sizes, and the last capture filter used.