Ethereal can read in previously saved capture files.
To read them, simply select the menu or toolbar item: "File/
Open".
Ethereal will then pop up the File
Open dialog box, which is discussed in more detail in
Section 5.2.1, “The "Open Capture File" dialog box”.
![]() | Note! |
---|---|
You can also use drag-and-drop to open a file, by simply dropping the desired file from your file manager onto Ethereal's main window. However, drag-and-drop is not available/won't work in all desktop environments. |
If you didn't save the current capture file before, you will be asked to do so, to prevent data loss (this behaviour can be disabled in the preferences).
In addition to its native file format (libpcap format, also used by tcpdump/WinDump and other libpcap/WinPcap-based programs), Ethereal can read capture files from a large number of other packet capture programs as well. See Section 5.2.2, “Input File Formats” for the list of capture formats Ethereal understands.
The "Open Capture File" dialog box allows you to search for a capture file containing previously captured packets for display in Ethereal. Figure 5.1, “The "Open Capture File" Dialog box” shows an example of the Ethereal Open File Dialog box.
![]() | Note |
---|---|
Ethereal uses the open dialog box from the version of the GTK+ toolkit that it's using. This dialog was completely redesigned in GTK version 2.4. Depending on the installed GTK version, your dialog box might look different. However, as the functionality remains almost the same, much of this description will work with your version of Ethereal. |
With this dialog box, you can perform the following actions:
The "+ Add" button allows you to add a directory, selected in the right-hand pane, to the favorites (bookmarks?) list. Those changes are persistent.
The "- Remove" button allows you to remove a selected directory from that list again (the items like: "Home", "Desktop", and "Filesystem" cannot be removed).
Select files and directories with the list boxes.
View file preview information (like the filesize, the number of packets, ...), while browsing the filesystem.
Specify a display filter with the Filter button and filter field. This filter will be used when opening the new file. Clicking on the Filter button causes Ethereal to pop up the Filters dialog box (which is discussed further in Section 6.2, “Filtering packets while viewing”).
Specify which name resolution is to be performed for all packets by clicking on one of the "Enable name resolution" check buttons. Details about name resolution can be found in Section 7.4, “Name Resolution”.
Click the Open button to accept your selected file and open it. If Ethereal doesn't recognize the capture format, it will grey out this button.
Click the Cancel button to go back to Ethereal and not load a capture file.
You can also change the display filter and name resolution settings later while viewing the packets. However, for very large capture files it can take a significant amount of extra time changing these settings later, so it might be a good idea to set at least the filter in advance here.
The following file formats from other capture tools can be opened by Ethereal:
libpcap, tcpdump and various other tools using tcpdump's capture format
Sun snoop and atmsnoop
Shomiti/Finisar Surveyor captures
Novell LANalyzer captures
Microsoft Network Monitor captures
AIX's iptrace captures
Cinco Networks NetXray captures
Network Associates Windows-based Sniffer and Sniffer Pro captures
Network General/Network Associates DOS-based Sniffer (compressed or uncompressed) captures
AG Group/WildPackets EtherPeek/TokenPeek/AiroPeek/EtherHelp/PacketGrabber captures
RADCOM's WAN/LAN Analyzer captures
Network Instruments Observer version 9 captures
Lucent/Ascend router debug output
HP-UX's nettl
Toshiba's ISDN routers dump output
ISDN4BSD i4btrace utility
traces from the EyeSDN USB S0
IPLog format from the Cisco Secure Intrusion Detection System
pppd logs (pppdump format)
the output from VMS's TCPIPtrace/TCPtrace/UCX$TRACE utilities
the text output from the DBS Etherwatch VMS utility
Visual Networks' Visual UpTime traffic capture
the output from CoSine L2 debug
the output from Accellent's 5Views LAN agents
Endace Measurement Systems' ERF format captures
Linux Bluez Bluetooth stack hcidump -w traces
![]() | Note! |
---|---|
It may not be possible to read some formats dependent on the packet types captured. Ethernet captures are usually supported for most file formats, but other packet types (e.g. token ring packets) may not be possible to read from all file formats. |