/usr/share/doc/wireshark-doc/wsug_html_chunked/ChIOSaveSection.html is in wireshark-doc 2.0.2+ga16e22e-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 | <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>5.3. Saving captured packets</title><link rel="stylesheet" type="text/css" href="ws.css"><meta name="generator" content="DocBook XSL Stylesheets V1.79.1"><link rel="home" href="index.html" title="Wireshark User Guide"><link rel="up" href="ChapterIO.html" title="Chapter 5. File Input, Output, and Printing"><link rel="prev" href="ChIOOpenSection.html" title="5.2. Open capture files"><link rel="next" href="ChIOMergeSection.html" title="5.4. Merging capture files"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">5.3. Saving captured packets</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ChIOOpenSection.html">Prev</a> </td><th width="60%" align="center">Chapter 5. File Input, Output, and Printing</th><td width="20%" align="right"> <a accesskey="n" href="ChIOMergeSection.html">Next</a></td></tr></table><hr></div><div class="section"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ChIOSaveSection"></a>5.3. Saving captured packets</h2></div></div></div><p>You can save captured packets simply by using the <span class="guimenu">File</span> → <span class="guimenuitem">Save As…</span> menu
item. You can choose which packets to save and which file format to be used.</p><p>Not all information will be saved in a capture file. For example, most file
formats don’t record the number of dropped packets. See
<a class="xref" href="AppFiles.html#ChAppFilesCaptureFilesSection" title="B.1. Capture Files">Section B.1, “Capture Files”</a> for details.</p><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="ChIOSaveAs"></a>5.3.1. The “Save Capture File As” dialog box</h3></div></div></div><p>The “Save Capture File As” dialog box allows you to save the current capture
to a file. The following sections show some examples of this dialog box. The
appearance of this dialog depends on the system. However, the functionality
should be the same across systems.</p><div class="figure"><a name="ChIOSaveAsFileWin32"></a><p class="title"><b>Figure 5.3. “Save” on Microsoft Windows</b></p><div class="figure-contents"><div class="mediaobject"><img src="wsug_graphics/ws-save-as-win32.png" alt="wsug_graphics/ws-save-as-win32.png"></div></div></div><br class="figure-break"><p>This is the common Windows file save dialog with some additional Wireshark extensions.</p><p>Specific behavior for this dialog:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
If available, the “Help” button will lead you to this section of this "User’s Guide".
</li><li class="listitem">
If you don’t provide a file extension to the filename (e.g. <code class="literal">.pcap</code>) Wireshark
will append the standard file extension for that file format.
</li></ul></div><div class="figure"><a name="ChIOSaveAsFile2"></a><p class="title"><b>Figure 5.4. “Save” on Linux and UNIX</b></p><div class="figure-contents"><div class="mediaobject"><img src="wsug_graphics/ws-save-as-gtk24.png" alt="wsug_graphics/ws-save-as-gtk24.png"></div></div></div><br class="figure-break"><p>This is the common Gimp/GNOME file save dialog with additional Wireshark extensions.</p><p>Specific for this dialog:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
Clicking on the + at "Browse for other folders" will allow you to browse files and folders in your file system.
</li></ul></div><p>With this dialog box, you can perform the following actions:</p><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem">
Type in the name of the file you wish to save the captured packets in, as a
standard file name in your file system.
</li><li class="listitem">
Select the directory to save the file into.
</li><li class="listitem">
Select the range of the packets to be saved. See <a class="xref" href="ChIOPacketRangeSection.html" title="5.9. The “Packet Range” frame">Section 5.9, “The “Packet Range” frame”</a>.
</li><li class="listitem">
Specify the format of the saved capture file by clicking on the File type drop
down box. You can choose from the types described in
<a class="xref" href="ChIOSaveSection.html#ChIOOutputFormatsSection" title="5.3.2. Output File Formats">Section 5.3.2, “Output File Formats”</a>.
</li></ol></div><p>Some capture formats may not be available depending on the packet types captured.</p><div class="tip" style="margin-left: 0.5in; margin-right: 0.5in;"><table border="0" summary="Tip: Wireshark can convert file formats"><tr><td rowspan="2" align="center" valign="top" width="25"><img alt="[Tip]" src="wsug_graphics/tip.svg"></td><th align="left">Wireshark can convert file formats</th></tr><tr><td align="left" valign="top"><p>You can convert capture files from one format to another by reading in a capture
file and writing it out using a different format.</p></td></tr></table></div><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem">
Click the <span class="guibutton">Save</span> or <span class="guibutton">OK</span> button to accept your selected file and
save to it. If Wireshark has a problem saving the captured packets to the file
you specified it will display an error dialog box. After clicking <span class="guibutton">OK</span>
on that error dialog box you can try again.
</li><li class="listitem">
Click on the <span class="guibutton">Cancel</span> button to go back to Wireshark without saving any
packets.
</li></ol></div></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="ChIOOutputFormatsSection"></a>5.3.2. Output File Formats</h3></div></div></div><p>Wireshark can save the packet data in its native file format (pcapng) and in the
file formats of other protocol analyzers so other tools can read the capture
data.</p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><table border="0" summary="Warning: Different file formats have different time stamp accuracies"><tr><td rowspan="2" align="center" valign="top" width="25"><img alt="[Warning]" src="wsug_graphics/warning.svg"></td><th align="left">Different file formats have different time stamp accuracies</th></tr><tr><td align="left" valign="top"><p>Saving from the currently used file format to a different format may reduce the
time stamp accuracy; see the <a class="xref" href="ChAdvTimestamps.html" title="7.4. Time Stamps">Section 7.4, “Time Stamps”</a> for details.</p></td></tr></table></div><p>The following file formats can be saved by Wireshark (with the known file extensions):</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
pcapng (*.pcapng). A flexible, etensible successor to the libpcap format.
Wireshark 1.8 and later save files as pcapng by default. Versions prior to 1.8
used libpcap.
</li><li class="listitem">
libpcap, tcpdump and various other tools using tcpdump’s capture format (*.pcap,*.cap,*.dmp)
</li><li class="listitem">
Accellent 5Views (*.5vw)
</li><li class="listitem">
HP-UX’s nettl (*.TRC0,*.TRC1)
</li><li class="listitem">
Microsoft Network Monitor - NetMon (*.cap)
</li><li class="listitem">
Network Associates Sniffer - DOS (*.cap,*.enc,*.trc,*fdc,*.syc)
</li><li class="listitem">
Network Associates Sniffer - Windows (*.cap)
</li><li class="listitem">
Network Instruments Observer version 9 (*.bfr)
</li><li class="listitem">
Novell LANalyzer (*.tr1)
</li><li class="listitem">
Oracle (previously Sun) snoop (*.snoop,*.cap)
</li><li class="listitem">
Visual Networks Visual UpTime traffic (*.*)
</li></ul></div><p>New file formats are added from time to time.</p><p>Whether or not the above tools will be more helpful than Wireshark is a different question ;-)</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><table border="0" summary="Note: Third party protocol analyzers may require specific file extensions"><tr><td rowspan="2" align="center" valign="top" width="25"><img alt="[Note]" src="wsug_graphics/note.svg"></td><th align="left">Third party protocol analyzers may require specific file extensions</th></tr><tr><td align="left" valign="top"><p>Wireshark examines a file’s contents to determine its type. Some other protocol
analyzers only look at a filename extensions. For example, you might need to use
the <code class="literal">.cap</code> extension in order to open a file using <span class="emphasis"><em>Sniffer</em></span>.</p></td></tr></table></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="ChIOOpenSection.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="ChapterIO.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="ChIOMergeSection.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">5.2. Open capture files </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> 5.4. Merging capture files</td></tr></table></div></body></html>
|