If I Import any file either text or pcap, I cannot see any packets on the window but while closing Wireshark asks for saving the file. What is the Use of this Import option? Why cannot we see the packets? This question is marked "community wiki". asked 28 Nov '11, 23:19  Terrestrial ... |
One Answer:
Import can be used for specifically formatted text files, see section 5.5 of the Users Guide. When starting an import an empty capture file is created, which is subsequently filled with imported packets. If the import fails to read any valid packet data all that remains is an opened, but empty capture file. This has to be closed/saved when closing Wireshark. answered 29 Nov '11, 03:40  Jaap ♦ |
There's no option to "import" a pcap file. The "Import" function expects the file to be a text file; if it's not - and pcap files aren't text - you won't see any packets, as Jaap indicated. If you have a pcap file, you just open it; you don't import it.