Open In App

File Menu Functions in Wireshark

Improve
Improve
Like Article
Like
Save
Share
Report

Wireshark is a software tool used to monitor the network traffic through a network interface. It is the most widely used network monitoring tool today. Wireshark is loved equally by system administrators, network engineers, network enthusiasts, network security professionals, and black hat hackers. It is a network protocol analyzer that captures packets from a network connection. The packet is the name given to a distinct unit of data in a typical Ethernet network.

File ,itemsMenu:

The “File” menu is located on Wireshark’s main menu at the top of the main window (Windows, Linux) or at the top of the main screen (macOS). It contains options for opening or merging capture files, saving, printing, or exporting capture files in whole or in part, and for quitting the Wireshark application.

Wireshark File Menu

 

File Menu Options:

Options

Shortcut Keys/Accelerator

Description

Open

Ctrl+O

This option brings up the dialogue “Open Capture File” dialogue box that allows you to search for a capture file containing previously captured packets for display in Wireshark. 

Open Recent

N/A

This option display a submenu including the names of recently opened capture files. Clicking on one of the item will open the corresponding capture file directly in Wireshark current window.

Merge

N/A

This option displays the merge file dialogue box that allows you to merge a previously capture file into the currently opened capture file. Files can also be merged by :

  • dragging and dropping dialogue multiple files on the main window
  • using the mergecap tool from the command line to merge capture files.

Import from Hex Dump

N/A

This option brings up the import file dialog box that allows you to import a text file containing a hex dump into a temporary libpcap capture file. It can generate dummy Ethernet, IP and UDP, TCP, or SCTP headers.

Close

Ctrl+W

This option closes the current capture file. If the capture file is not saved, you have to save it first.

Save 

Ctrl+S

This option saves the current capture file. This will bring up the Save Capture File As dialogue box if you have not set the capture file name otherwise the option will be greyed out.

If the packet capture is in progress then we must stop the capture in order to save the capture file.

Save As

Shift+Ctrl+S

The “Save Capture File As” dialogue items box allows us to save the current capture to a file.

File Set → List Files

N/A

This option allows us to display a list of files in a file set. The captured data is spread over several capture files, called a file set. It brings up the Wireshark List File Set dialogue box.

File Set → Next Files

N/A

If the file that is currently opened is part of a file set, then this option moves to the next file in the set. If the file is not a part of a file set or it is the last file in that set then this item is greyed out.

File Set → Previous Files

N/A

If the file that is currently opened is part of a file set, then this option moves to the previous file in the set. If the file is not a part of a file set or it is the first file in that set then this item is greyed out.

Export Specified Packets

N/A

This option allows us to export all or some specified packets in the capture file to file. It brings up the “Wireshark Export dialogue box”

Export Packet Dissections

Ctrl+H

This option allows us to export the currently selected bytes in the packet bytes pane to a text file in a variety of formats including plain text, CSV, XML, and JSON. 

Export Objects

N/A

This option allows us to export captured DICOM, HTTP, IMF, SMB, or TFTP objects into local files. It brings up a corresponding object list.

Print

Ctrl+P

This option allows us to print all or some specified packets in the capture file. It brings up the Wireshark Print dialogue box.

Quit

Ctrl+Q

This option allows us to quit Wireshark. Wireshark will ask to save your capture file if you haven’t previously saved it (this can be disabled by a preference setting). If the current capture file is not saved we have to save it first in order to quit but this can be via the Wireshark preference setting.


Last Updated : 17 Aug, 2022
Like Article
Save Article
Previous
Next
Share your thoughts in the comments
Similar Reads