User Guide
71
Chapter 5. File Input / Output and
Printing
5.1. Introduction
This chapter will describe input and output of capture data.
• Open/Import capture files in various capture file formats
• Save/Export capture files in various capture file formats
• Merge capture files together
• Print packets
5.2. Open capture files
Wireshark can read in previously saved capture files. To read them, simply select the menu or toolbar
item: "File/ Open". Wireshark will then pop up the File Open dialog box, which is discussed in more
detail in Section 5.2.1, “The "Open Capture File" dialog box”.
It's convenient to use drag-and-drop!
... to open a file, by simply dragging the desired file from your file manager and dropping it
onto Wireshark's main window. However, drag-and-drop is not available/won't work in all
desktop environments.
If you haven't previously saved the current capture file, you will be asked to do so, to prevent data loss
(this behaviour can be disabled in the preferences).
In addition to its native file format (libpcap format, also used by tcpdump/WinDump and other libpcap/
WinPcap-based programs), Wireshark can read capture files from a large number of other packet capture
programs as well. See Section 5.2.2, “Input File Formats” for the list of capture formats Wireshark
understands.
5.2.1. The "Open Capture File" dialog box
The "Open Capture File" dialog box allows you to search for a capture file containing previously captured
packets for display in Wireshark. Table 5.1, “The system specific "Open Capture File" dialog box” shows
some examples of the Wireshark Open File Dialog box.
The dialog appearance depends on your system!
The appearance of this dialog depends on the system and/or GTK+ toolkit version used.
However, the functionality remains basically the same on any particular system.
Common dialog behaviour on all systems:
• Select files and directories.
• Click the Open/Ok button to accept your selected file and open it.
• Click the Cancel button to go back to Wireshark and not load a capture file.