5.3. Saving captured packets

You can save captured packets simply by using the Save As... menu item from the File menu under Ethereal. You can choose which packets to save and which file format to be used.

5.3.1. The "Save Capture File As" dialog box

The "Save Capture File As" dialog box allows you to save the current capture to a file. Figure 5.2, “The "Save Capture File As" dialog box” shows an example of this dialog box.

[Note]Note

Ethereal uses the open dialog box from the version of the GTK+ toolkit that it's using. This dialog was completely redesigned in the GTK version 2.4. Depending on the installed GTK version, your dialog box might look different. However, as the functionality remains almost the same, much of this description will work with your version of Ethereal.

Figure 5.2. The "Save Capture File As" dialog box

The "Save Capture File As" dialog box

With this dialog box, you can perform the following actions:

  1. Type in the name of the file you wish to save the captured packets in, as a standard file name in your file system.

  2. Select the directory to save the file into.

  3. Select the range of the packets to be saved, see Section 5.8, “The Packet Range frame”

  4. Specify the format of the saved capture file by clicking on the File type drop down box. You can choose from the types, described in Section 5.3.2, “Output File Formats”.

    [Note]Note!

    Some capture formats may not be available, depending on the packet types captured.

    [Tip]Tip!

    You can convert capture files from one format to another by reading in a capture file and writing it out using a different format.

  5. Use "Browse for other folders" to browse files and folders in your file system.

  6. Click on the Save button to accept your selected file and save to it. If Ethereal has a problem saving the captured packets to the file you specified, it will display an error dialog box. After clicking OK on this error dialog box, you can try again.

  7. Click on the Cancel button to go back to Ethereal and not save the captured packets.

5.3.2. Output File Formats

The following file formats can be saved by Ethereal, so other capture tools can read the capture data from:

  • libpcap (tcpdump)

  • Novell LANalyzer

  • Network Associates Sniffer

  • Sun snoop

  • Microsoft Network Monitor

  • Visual Networks Visual UpTime traffic

  • Accellent 5Views

  • Networks Instruments Observer version 9

  • HP-UX's nettl

[Note]

Other protocol analyzers may require that the file has a certain suffix in order to read the files you generate with Ethereal, e.g.:

".DMP" for Tcpdump/libpcap

".CAP" for Network Associates Sniffer Windows