This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Why when I save an export I have filtered 140,000 packets out of 386,000 packets, when I have the save the displayed packets does it save the whole 386,000 instead of the 140,000? I think this might be a bug with version 1.10.0 Wireshark

asked 23 Jul '13, 16:18

philvilla's gravatar image

philvilla
11445
accept rate: 0%

edited 23 Jul '13, 18:09

cmaynard's gravatar image

cmaynard ♦♦
9.3k1038142


You need to use the "Export Specified Packets" function in the file menu, not the "Save as" menu option. In the "Export Specified Packets" dialog you also need to make sure that in the "Packet Range" pane you selected "All Packets" and the "Displayed" column.

permanent link

answered 23 Jul '13, 16:41

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

As Jasper noted, in Wireshark 1.8 and later, "Save"/"Save As" and "Export Specified Packets" are two separate functions.

"Save"/"Save As", by design and intent, saves, i.e. writes out all the packets, including changes made to comments on the packets.

"Export Specified Packets" lets you write out some or all of the packets in the capture to a different file.

Were you trying to "save" - i.e., using "Save" or "Save As" - or were you trying to "export" - i.e., using "Export Specified Packets"? "Save"/"Save As" will, in Wireshark 1.8 and later, always write out all the packets; "Export Specified Packets" will let you select which packets to write out.

permanent link

answered 23 Jul '13, 17:03

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

I was trying to export which I said in the first post the application does not export only the selected packet it does all of them.

(24 Jul '13, 07:15) philvilla
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×349
×76
×42
×6

question asked: 23 Jul '13, 16:18

question was seen: 5,200 times

last updated: 24 Jul '13, 07:16

p​o​w​e​r​e​d by O​S​Q​A