This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

If I Import any file either text or pcap, I cannot see any packets on the window but while closing Wireshark asks for saving the file. What is the Use of this Import option? Why cannot we see the packets?

This question is marked "community wiki".

asked 28 Nov '11, 23:19

Terrestrial%20shark's gravatar image

Terrestrial ...
96212829
accept rate: 42%

There's no option to "import" a pcap file. The "Import" function expects the file to be a text file; if it's not - and pcap files aren't text - you won't see any packets, as Jaap indicated. If you have a pcap file, you just open it; you don't import it.

(29 Nov '11, 14:44) Guy Harris ♦♦

Import can be used for specifically formatted text files, see section 5.5 of the Users Guide. When starting an import an empty capture file is created, which is subsequently filled with imported packets. If the import fails to read any valid packet data all that remains is an opened, but empty capture file. This has to be closed/saved when closing Wireshark.

permanent link

answered 29 Nov '11, 03:40

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×15

question asked: 28 Nov '11, 23:19

question was seen: 4,055 times

last updated: 29 Nov '11, 14:44

p​o​w​e​r​e​d by O​S​Q​A