Why when I save an export I have filtered 140,000 packets out of 386,000 packets, when I have the save the displayed packets does it save the whole 386,000 instead of the 140,000? I think this might be a bug with version 1.10.0 Wireshark asked 23 Jul '13, 16:18  philvilla edited 23 Jul '13, 18:09  cmaynard ♦♦ |
2 Answers:
You need to use the "Export Specified Packets" function in the file menu, not the "Save as" menu option. In the "Export Specified Packets" dialog you also need to make sure that in the "Packet Range" pane you selected "All Packets" and the "Displayed" column. answered 23 Jul '13, 16:41  Jasper ♦♦ |
As Jasper noted, in Wireshark 1.8 and later, "Save"/"Save As" and "Export Specified Packets" are two separate functions. "Save"/"Save As", by design and intent, saves, i.e. writes out all the packets, including changes made to comments on the packets. "Export Specified Packets" lets you write out some or all of the packets in the capture to a different file. Were you trying to "save" - i.e., using "Save" or "Save As" - or were you trying to "export" - i.e., using "Export Specified Packets"? "Save"/"Save As" will, in Wireshark 1.8 and later, always write out all the packets; "Export Specified Packets" will let you select which packets to write out. answered 23 Jul '13, 17:03  Guy Harris ♦♦ |
I was trying to export which I said in the first post the application does not export only the selected packet it does all of them.