This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

dumpcap outfile save location

0
C:\Program Files\Wireshark>dumpcap -i \Device\NPF_{9E7AF7D7-A7CE-4350-882B-7223F2B9A333} -b duration:10 -b files:10 -a duration:200 -w outfile.pcap
Capturing on \Device\NPF_{9E7AF7D7-A7CE-4350-882B-7223F2B9A333}
File: outfile_00001_20130222164538.pcap
Packets: 25 File: outfile_00002_20130222164548.pcap
Packets: 44 File: outfile_00003_20130222164558.pcap
Packets: 72 File: outfile_00004_20130222164608.pcap
Packets: 104 File: outfile_00005_20130222164618.pcap
Packets: 118 File: outfile_00006_20130222164628.pcap
Packets: 141 File: outfile_00007_20130222164638.pcap
Packets: 204 File: outfile_00008_20130222164648.pcap
Packets: 251 File: outfile_00009_20130222164658.pcap
Packets: 278 File: outfile_00010_20130222164708.pcap
Packets: 381 File: outfile_00011_20130222164718.pcap
Packets: 513 File: outfile_00012_20130222164728.pcap
Packets: 607 File: outfile_00013_20130222164738.pcap
Packets: 672 File: outfile_00014_20130222164748.pcap
Packets: 707 File: outfile_00015_20130222164758.pcap
Packets: 740 File: outfile_00016_20130222164808.pcap
Packets: 768 File: outfile_00017_20130222164818.pcap
Packets: 855 File: outfile_00018_20130222164828.pcap
Packets: 884 File: outfile_00019_20130222164838.pcap
Packets: 899 File: outfile_00020_20130222164848.pcap
Packets captured: 914
Packets received/dropped on interface \Device\NPF_{9E7AF7D7-A7CE-4350-882B-7223F2B9A333}: 914/0 (100.0%)

Where are the outfile_000&&_20130222&&&&&&.pcap saved

I just don't seem to find them.

asked 22 Feb '13, 03:24

AshwinSethi's gravatar image

AshwinSethi
0225
accept rate: 0%

edited 22 Feb '13, 03:36

grahamb's gravatar image

grahamb ♦
19.8k330206


One Answer:

1

I would guess nowhere. From the prompt, you're running the capture from within the Wireshark "Program Files" directory and a normal user account doesn't have write permission in that directory so the files aren't written.

Either run the command from within a directory to which you do have write permission, or change the output file parameter to include a path that you can write to, e.g. c:\temp\outfile.pcap

answered 22 Feb '13, 03:34

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

Logical enough. Got the pcap files. Thanks a lot

(22 Feb '13, 03:41) AshwinSethi