User Guide

File Input / Output and Printing

• traces from the EyeSDN USB S0

• IPLog format from the Cisco Secure Intrusion Detection System

• pppd logs (pppdump format)

• the output from VMS's TCPIPtrace/TCPtrace/UCX$TRACE utilities

• the text output from the DBS Etherwatch VMS utility

• Visual Networks' Visual UpTime traffic capture

• the output from CoSine L2 debug

• the output from Accellent's 5Views LAN agents

• Endace Measurement Systems' ERF format captures

• Linux Bluez Bluetooth stack hcidump -w traces

• Catapult DCT2000 .out files

• Gammu generated text output from Nokia DCT3 phones in Netmonitor mode

• IBM Series (OS/400) Comm traces (ASCII & UNICODE)

• Juniper Netscreen snoop captures

• Symbian OS btsnoop captures

• Tamosoft CommView captures

• Textronix K12xx 32bit .rf5 format captures

• Textronix K12 text file format captures

• Wireshark .pcapng captures (Experimental)

• ... new file formats are added from time to time

Opening a file may fail due to invalid packet types!

It may not be possible to read some formats dependent on the packet types captured. Ethernet

captures are usually supported for most file formats but it may not be possible to read other

packet types (e.g. token ring packets) from all file formats.

5.3. Saving captured packets

You can save captured packets simply by using the Save As... menu item from the File menu under

Wireshark. You can choose which packets to save and which file format to be used.

Saving may reduce the available information!

Saving the captured packets will slightly reduce the amount of information, e.g. the number

of dropped packets will be lost; see Section A.1, “Capture Files” for details.