Microsoft Network Monitor cap file can be opened by Wireshark but save as function is disabled

asked 2018-05-30 08:01:11 +0000

ssss
1 ●1 ●1 ●1

I need to capture wireless traffic in monitor mode, so use Microsoft Network Monitor 3.4. To me, it seems to be the only solution on Windows 10.

The cap file generated by Network Monitor can be opened by Wireshark and displayed correctly. However, I found that both the "save as" and "Export Specified Packets ..." functions (from the "File" menu) are disabled.

How can I make such functions work?

edit retag flag offensive close merge delete

Comments

it seems to be the only solution on Windows 10.

FYI: There are other solutions. See the Wireshark CaptureSetup/WLAN wiki page. In particular Npcap, a modern WinPcap replacement, provides a very good solution.

cmaynard ( 2018-05-30 13:33:22 +0000 )edit

I have added an answer to this question which may be of interest to you.

cmaynard ( 2019-02-05 15:53:23 +0000 )edit

add a comment

3 Answers

Sort by » oldest newest most voted

answered 2018-10-06 18:53:36 +0000

Guy Harris
19890 ●3 ●660 ●207

There are two issues:

Saving in the Wireshark "standard" formats of pcap and pcapng might not be possible, as not all record types and not all link-layer header types in NetMon files are supported by pcap and pcapng.
We currently don't even support writing out all record types in NetMon format.

edit flag offensive delete link

add a comment

answered 2018-10-05 01:01:13 +0000

markGE
1

It is possible. The feature exists in version 2.2.6. It has been removed at some point in the development thread, but the Save As will work with CAP file in version 2.2.6. The latest versions of Wireshark will have the feature greyed out.