5.3. Saving captured packets

Wireshark 2.1

5.3. Saving captured packets

5.3.1. The “Save Capture File As” dialog box

  • If available, the “Help” button will lead you to this section of this "User’s Guide".
  • If you don’t provide a file extension to the filename (e.g. ) Wireshark will append the standard file extension for that file format.

  • Clicking on the + at "Browse for other folders" will allow you to browse files and folders in your file system.
  1. Type in the name of the file you wish to save the captured packets in, as a standard file name in your file system.
  2. Select the directory to save the file into.
  3. Select the range of the packets to be saved. See Section 5.9, “The “Packet Range” frame”.
  4. Specify the format of the saved capture file by clicking on the File type drop down box. You can choose from the types described in Section 5.3.2, “Output File Formats”.
[Tip] Wireshark can convert file formats
  1. Click the Save or OK button to accept your selected file and save to it. If Wireshark has a problem saving the captured packets to the file you specified it will display an error dialog box. After clicking OK on that error dialog box you can try again.
  2. Click on the Cancel button to go back to Wireshark without saving any packets.

5.3.2. Output File Formats

[Warning] Different file formats have different time stamp accuracies
  • pcapng (*.pcapng). A flexible, etensible successor to the libpcap format. Wireshark 1.8 and later save files as pcapng by default. Versions prior to 1.8 used libpcap.
  • libpcap, tcpdump and various other tools using tcpdump’s capture format (*.pcap,*.cap,*.dmp)
  • Accellent 5Views (*.5vw)
  • HP-UX’s nettl (*.TRC0,*.TRC1)
  • Microsoft Network Monitor - NetMon (*.cap)
  • Network Associates Sniffer - DOS (*.cap,*.enc,*.trc,*fdc,*.syc)
  • Network Associates Sniffer - Windows (*.cap)
  • Network Instruments Observer version 9 (*.bfr)
  • Novell LANalyzer (*.tr1)
  • Oracle (previously Sun) snoop (*.snoop,*.cap)
  • Visual Networks Visual UpTime traffic (*.*)
[Note] Third party protocol analyzers may require specific file extensions