I need to keep my analysis information with pcap file. i.e. i have analyzed a .pcap log and added - Display filters, add marker, add coloum information etc. How to save the information with project, such that i can see those information when reopen the log file (.pcap)? asked 09 Jun '17, 02:28  sghorai |
One Answer:
You can save general and packet comments with the file if you save it in PCAPng format. The other things (filters, columns, etc) are profile settings, so you'd have to distribute them along with the pcapng file. You can find the settings files by opening the "About Wireshark" dialog and check the "folders" tab for the "Personal Configuration" path. answered 09 Jun '17, 02:34  Jasper ♦♦ |
Thx Jasper, i see packet comments are saved with .PCAPng file. And is there anything else can be saved with this file format?
Yes, the interface statistics from the capture can be saved (you can see those in the Capture File Properties available in the Statistics menu), and name resolution entries from available FQDNs the time of the capture.