This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How does save as work in wireshark ??

0

I would like to know how wireshark can save the capture in different formats

asked 24 Oct '11, 22:53

flashkicker's gravatar image

flashkicker
109131919
accept rate: 41%

1

How to set a different format as the default one? I mean where can i Hardcode this?

(28 Oct '11, 03:19) Sriramula Ra...

One Answer:

1

Do you want to know how it works internally, or how you use it at all?

Using it is simple, just use File -> Save File As, and set the "Save as Type" to whatever file format you need. In the packet range you can chose just to save the packets currently displayed (if there is a filter), or some specific packet ranges. Since this is so simple, I guess you already figured that one out (but just in case...)

The other thing - how Wireshark can save in different formats isn't that complicated either - there are a couple of modules that "know" how (in what format, meaning structures etc.) the other network analyzers write their files, and mimics it. It's basically the same like the loading routines, which do the same with loading various file formats; they have "knowledge" of the file structure and interpret the data being read.

answered 25 Oct '11, 01:01

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Thanks for your quick reply ...Yes i wanted to know how it worked internally ..I also wanted to know what are the files it has relation with ...When i do save as i would like k12 textfile format to come first i would like to hardcode it ..Is it possible !!

(27 Oct '11, 04:17) flashkicker
1

The issue with hard-coding your own solution is that you'll have to keep rebuilding your own version of WS each time a new one comes out.

While I don't think hard-coding k12 textfile format would be acceptable to all the other users of WS, a preference to select the default save format might be.

Raise an entry for this on the WS bugtracker and mark it as an enhancement.

(27 Oct '11, 04:35) grahamb ♦