This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Exporting packets with Wireshark version 1.10.0

0

Why when I save an export I have filtered 140,000 packets out of 386,000 packets, when I have the save the displayed packets does it save the whole 386,000 instead of the 140,000? I think this might be a bug with version 1.10.0 Wireshark

asked 23 Jul '13, 16:18

philvilla's gravatar image

philvilla
11445
accept rate: 0%

edited 23 Jul '13, 18:09

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142


2 Answers:

1

You need to use the "Export Specified Packets" function in the file menu, not the "Save as" menu option. In the "Export Specified Packets" dialog you also need to make sure that in the "Packet Range" pane you selected "All Packets" and the "Displayed" column.

answered 23 Jul '13, 16:41

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

0

As Jasper noted, in Wireshark 1.8 and later, "Save"/"Save As" and "Export Specified Packets" are two separate functions.

"Save"/"Save As", by design and intent, saves, i.e. writes out all the packets, including changes made to comments on the packets.

"Export Specified Packets" lets you write out some or all of the packets in the capture to a different file.

Were you trying to "save" - i.e., using "Save" or "Save As" - or were you trying to "export" - i.e., using "Export Specified Packets"? "Save"/"Save As" will, in Wireshark 1.8 and later, always write out all the packets; "Export Specified Packets" will let you select which packets to write out.

answered 23 Jul '13, 17:03

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

I was trying to export which I said in the first post the application does not export only the selected packet it does all of them.

(24 Jul '13, 07:15) philvilla