User Guide

5.5. File Sets
When using the "Multiple Files" option while doing a capture (see: Section 4.6, “Capture files and
file modes”), the capture data is spread over several capture files, called a file set.
As it can become tedious to work with a file set by hand, Wireshark provides some features to
handle these file sets in a convenient way.
How does Wireshark detect the files of a file set?
A filename in a file set uses the format Prefix_Number_DateTimeSuffix which might look
like this: "test_00001_20060420183910.pcap". All files of a file set share the same prefix
(e.g. "test") and suffix (e.g. ".pcap") and a varying middle part.
To find the files of a file set, Wireshark scans the directory where the currently loaded file
resides and scans for files matching the same filename pattern (prefix and suffix) than the cur-
rently loaded file.
This simple mechanism usually works well, but has it's drawbacks. If several file sets were
captured with the same prefix and suffix, Wireshark will detect them as a single file set. If
files were renamed or spread over several directories the mechanism will fail to find all files
of a set.
The following features in the "File Set" submenu of the "File" menu are available to work with file
sets in a convenient way:
• The List Files dialog box will list the files Wireshark has recognized as being part of the current
file set.
• Next File closes the current and opens the next file in the file set.
• Previous File closes the current and opens the previous file in the file set.
5.5.1. The "List Files" dialog box
Figure 5.10. The "List Files" dialog box
File Input / Output and Printing
88