User Guide

File Input / Output and Printing
72
Wireshark extensions to the standard behaviour of these dialogs:
• View file preview information (like the filesize, the number of packets, ...), if you've selected a capture
file.
• Specify a display filter with the "Filter:" button and filter field. This filter will be used when opening
the new file. The text field background becomes green for a valid filter string and red for an invalid
one. Clicking on the Filter button causes Wireshark to pop up the Filters dialog box (which is discussed
further in Section 6.3, “Filtering packets while viewing”).
XXX - we need a better description of these read filters
• Specify which type of name resolution is to be performed for all packets by clicking on one of the "...
name resolution" check buttons. Details about name resolution can be found in Section 7.7, “Name
Resolution”.
Save a lot of time loading huge capture files!
You can change the display filter and name resolution settings later while viewing the
packets. However, loading huge capture files can take a significant amount of extra time if
these settings are changed later, so in such situations it can be a good idea to set at least the
filter in advance here.
Table 5.1. The system specific "Open Capture File" dialog box
Figure 5.1. "Open" on native Windows
Microsoft Windows
This is the common Windows file open dialog - plus
some Wireshark extensions.
Specific for this dialog:
• If available, the "Help" button will lead you to this
section of this "User's Guide".
•
Note
The "Filter:" button currently
doesn't work on Windows!
Figure 5.2. "Open" - new GTK version
Unix/Linux: GTK version >= 2.4
This is the common Gimp/GNOME file open dialog
- plus some Wireshark extensions.
Specific for this dialog:
• The "+ Add" button allows you to add a directory,
selected in the right-hand pane, to the favorites
list on the left. Those changes are persistent.
• The "- Remove" button allows you to remove
a selected directory from that list again (the