This is our old Q&A Site. Please post any new questions and answers at

I would like to manually save the host file info generated via version 2.0.5 so that I can reinstall when a new version of Wireshark becomes available. I used the Help and found the entry that indicated where the host file was supposed to be, however it was not there. When I put an earlier version it was not used.


asked 05 Sep '16, 04:35

bobmiers's gravatar image

accept rate: 0%

Wireshark never writes to the hosts file, only reads from it. In my tests, using a build from master, the hosts file is successfully read from both the user and global locations.

What OS are you using and what are the exact paths for the hosts file are you using?

permanent link

answered 05 Sep '16, 05:24

grahamb's gravatar image

grahamb ♦
accept rate: 22%

Thanks for the quick response. I am using Win8.1 as the OS. What I have done in the past was put a hosts file in the USER/AppDat/roaming/wireshark folder. When I installed ver 2.0.5 it didn't seem to read from the file, even after a reboot.

I then noticed under the View>Name Resolution tab there was a selection that permitted me to name an IP address. I renamed a bunch of my local fixed addresses using that function. Even after rebooting and starting a new scan, the Name Resolutions that I had entered seemed to be retained. After, without any success, searching for a modified file that might contain the hosts type of info I posted the question.

After reading your message, I edited the USER/AppDat/roaming/wireshark/hosts file to change one of the entries to a ASDFGHJKUIO name and saved the file, and restarted WireShark. This time it did read the file and I saw the ASDFGHJKUIO name appearing.

So it looks like I wasted your time.

Thanks a bunch. BobMiers

(05 Sep '16, 10:15) bobmiers

Your answer has been converted to a comment as that's how this site works. Please read the FAQ for more information.

(05 Sep '16, 10:57) Jaap ♦

As you may know there are multiple options to setup name resolution. The ones you probably know are DNS information and the hosts file. But now manually entered name resolution is also saved, in the pcap-ng file, which has special extensions for that. So the changed file you were looking for is actually the capture file.

(05 Sep '16, 10:59) Jaap ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 05 Sep '16, 04:35

question was seen: 1,440 times

last updated: 05 Sep '16, 10:59

p​o​w​e​r​e​d by O​S​Q​A