Ask Your Question

Microsoft Network Monitor cap file can be opened by Wireshark but save as function is disabled

asked 2018-05-30 08:01:11 +0000

ssss gravatar image

I need to capture wireless traffic in monitor mode, so use Microsoft Network Monitor 3.4. To me, it seems to be the only solution on Windows 10.

The cap file generated by Network Monitor can be opened by Wireshark and displayed correctly. However, I found that both the "save as" and "Export Specified Packets ..." functions (from the "File" menu) are disabled.

How can I make such functions work?

edit retag flag offensive close merge delete


it seems to be the only solution on Windows 10.

FYI: There are other solutions. See the Wireshark CaptureSetup/WLAN wiki page. In particular Npcap, a modern WinPcap replacement, provides a very good solution.

cmaynard gravatar imagecmaynard ( 2018-05-30 13:33:22 +0000 )edit

I have added an answer to this question which may be of interest to you.

cmaynard gravatar imagecmaynard ( 2019-02-05 15:53:23 +0000 )edit

3 Answers

Sort by ยป oldest newest most voted

answered 2018-10-06 18:53:36 +0000

Guy Harris gravatar image

There are two issues:

  1. Saving in the Wireshark "standard" formats of pcap and pcapng might not be possible, as not all record types and not all link-layer header types in NetMon files are supported by pcap and pcapng.
  2. We currently don't even support writing out all record types in NetMon format.
edit flag offensive delete link more

answered 2018-10-05 01:01:13 +0000

markGE gravatar image

It is possible. The feature exists in version 2.2.6. It has been removed at some point in the development thread, but the Save As will work with CAP file in version 2.2.6. The latest versions of Wireshark will have the feature greyed out.

edit flag offensive delete link more

answered 2018-05-30 08:13:32 +0000

Anders gravatar image

Theres a lenghtly explanation here and a shorter here

edit flag offensive delete link more


Ok, so it's still not possible now?

ssss gravatar imagessss ( 2018-05-30 08:18:45 +0000 )edit

Yes, it's still not possible.

Anders gravatar imageAnders ( 2018-05-30 08:42:14 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2018-05-30 08:01:11 +0000

Seen: 2,335 times

Last updated: Oct 06 '18