This chapter will describe input and output of capture data. Open/Import capture files in various capture file formats Save/Export capture files in various capture file formats Merge capture files together Print packets

Ethereal can read in previously saved capture files. To read them, simply select the Open menu item from the File menu. Ethereal will then pop up the File Open dialog box, which is discussed in more detail in . You can also use drag-and-drop to open a file, by simply dropping the desired file from your file manager onto Ethereal's main window. However, drag-and-drop is not available/won't work in all desktop environments. If you didn't save the current capture file before, you will be asked to do so, to prevent data loss (this behaviour can be disabled in the preferences). In addition to its native file format (libpcap format, also used by tcpdump/WinDump and other libpcap/WinPcap-based programs), Ethereal can read capture files from a large number of other packet capture programs as well. See for the list of capture formats Ethereal understands.

The "Open Capture File" dialog box allows you to search for a capture file containing previously captured packets for display in Ethereal. shows an example of the Ethereal Open File Dialog box. Ethereal uses the open dialog box from the version of the GTK+ toolkit that it's using. This dialog was completely redesigned in GTK version 2.4. Depending on the installed GTK version, your dialog box might look different. However, as the functionality remains almost the same, much of this description will work with your version of Ethereal.

With this dialog box, you can perform the following actions: The "+ Add" button allows you to add a directory, selected in the right-hand pane, to the favorites (bookmarks?) list. Those changes are persistent. The "- Remove" button allows you to remove a selected directory from that list again (the items like: "Home", "Desktop", and "Filesystem" cannot be removed). Select files and directories with the list boxes. View file preview information (like the filesize, the number of packets, ...), while browsing the filesystem. Specify a display filter with the Filter button and filter field. This filter will be used when opening the new file. Clicking on the Filter button causes Ethereal to pop up the Filters dialog box (which is discussed further in ). Specify which name resolution is to be performed for all packets by clicking on one of the "Enable name resolution" check buttons. Details about name resolution can be found in . Click the Open button to accept your selected file and open it. If Ethereal doesn't recognize the capture format, it will grey out this button. Click the Cancel button to go back to Ethereal and not load a capture file. You can change the display filter and name resolution settings later while viewing the packets. However, for very large capture files it can take a significant amount of time changing these settings, so it might be a good idea to set them in advance here.

The following file formats from other capture tools can be opened by Ethereal: libpcap, tcpdump and various other tools using tcpdump's capture format Sun snoop and atmsnoop Shomiti/Finisar Surveyor captures Novell LANalyzer captures Microsoft Network Monitor captures AIX's iptrace captures Cinco Networks NetXray captures Network Associates Windows-based Sniffer and Sniffer Pro captures Network General/Network Associates DOS-based Sniffer (compressed or uncompressed) captures AG Group/WildPackets EtherPeek/TokenPeek/AiroPeek/EtherHelp/PacketGrabber captures RADCOM's WAN/LAN Analyzer captures Network Instruments Observer version 9 captures Lucent/Ascend router debug output HP-UX's nettl Toshiba's ISDN routers dump output ISDN4BSD i4btrace utility traces from the EyeSDN USB S0 IPLog format from the Cisco Secure Intrusion Detection System pppd logs (pppdump format) the output from VMS's TCPIPtrace/TCPtrace/UCX$TRACE utilities the text output from the DBS Etherwatch VMS utility Visual Networks' Visual UpTime traffic capture the output from CoSine L2 debug the output from Accellent's 5Views LAN agents Endace Measurement Systems' ERF format captures Linux Bluez Bluetooth stack hcidump -w traces It may not be possible to read some formats dependent on the packet types captured. Ethernet captures are usually supported for most file formats, but other packet types (e.g. token ring packets) may not be possible to read from all file formats.

You can save captured packets simply by using the Save As... menu item from the File menu under Ethereal. You can choose which packets to save and which file format to be used.

The "Save Capture File As" dialog box allows you to save the current capture to a file. shows an example of this dialog box. Ethereal uses the open dialog box from the version of the GTK+ toolkit that it's using. This dialog was completely redesigned in the GTK version 2.4. Depending on the installed GTK version, your dialog box might look different. However, as the functionality remains almost the same, much of this description will work with your version of Ethereal.

With this dialog box, you can perform the following actions: Type in the name of the file you wish to save the captured packets in, as a standard file name in your file system. Select the directory to save the file into. Select the range of the packets to be saved, see Specify the format of the saved capture file by clicking on the File type drop down box. You can choose from the types, described in . Some capture formats may not be available, depending on the packet types captured. You can convert capture files from one format to another by reading in a capture file and writing it out using a different format. Use "Browse for other folders" to browse files and folders in your file system. Click on the Save button to accept your selected file and save to it. If Ethereal has a problem saving the captured packets to the file you specified, it will display an error dialog box. After clicking OK on this error dialog box, you can try again. Click on the Cancel button to go back to Ethereal and not save the captured packets.

The following file formats can be saved by Ethereal, so other capture tools can read the capture data from: libpcap (tcpdump) Novell LANalyzer Network Associates Sniffer Sun snoop Microsoft Network Monitor Visual Networks Visual UpTime traffic Accellent 5Views Networks Instruments Observer version 9 Other protocol analyzers may require that the file has a certain suffix in order to read the files you generate with Ethereal, e.g.: ".DMP" for Tcpdump/libpcap ".CAP" for Network Assosciates Sniffer Windows

Sometimes you need to merge several capture files into one. For example this can be useful, if you have captured simultaneously from multiple interfaces at once (e.g. using multiple instances of Ethereal). Merging capture files can be done in three ways: Use the menu item "Merge" from the "File" menu, to open the merge dialog, see . This menu item will be disabled, until you have loaded a capture file. Use drag-and-drop to drop multiple files on the main window. Ethereal will try to merge the packets in chronological order from the dropped files into a newly created temporary file. If you drop only a single file, it will simply replace a (maybe) existing one. Use the mergecap tool, which is a command line tool to merge capture files. This tool provides the most options to merge capture files, see .

This dialog box let you select a file to be merged into the currently loaded file. If your current data wasn't saved before, you will be asked to save it first, before this dialog box is shown.

Prepend packets to existing file Prepend the packets from the selected file before the currently loaded packets. Merge packets chronologically Merge both the packets from the selected and currently loaded file in chronological order. Append packets to existing file Append the packets from the selected file after the currently loaded packets. All other controls will work the same way as in the "Open Capture File" dialog box, see .

Ethereal provides several ways and formats to export packet data. This section describes general ways to export data from Ethereal. There are more specialized functions to export specific data, which will be described at the appropriate places. XXX - add detailed descriptions of the output formats and some sample output, too.

Export packet data into a plain ASCII text file, much like the format used to print packets.

Export to file: frame chooses the file to export the packet data to. The Packet Range frame is described in . The Packet Details frame is described in .

Export packet data into PostScript, much like the format used to print packets. You can easily convert PostScript files to PDF files using ghostscript. For example: export to a file named foo.ps and then call: ps2pdf foo.ps

Export to file: frame chooses the file to export the packet data to. The Packet Range frame is described in . The Packet Details frame is described in .

Export packet data into PSML. This is an XML based format including only the packet summary.

Export to file: frame chooses the file to export the packet data to. The Packet Range frame is described in . There's no such thing as a packet details frame for PSML export, as the packet format is defined by the PSML specification.

Export packet data into PDML. This is an XML based format including the packet details. The PDML file specification is available at: PDML specification. The PDML specification is not officially released and Ethereal's implementation of it is still in an early beta state, so please expect changes in future Ethereal versions.

Export to file: frame chooses the file to export the packet data to. The Packet Range frame is described in . There's no such thing as a packet details frame for PDML export, as the packet format is defined by the PDML specification.

Export the bytes selected in the "Packet Bytes" pane into a raw binary file.

Name: the filename to export the packet data to. The Save in folder: field lets you select the folder to save to (from some predefined folders). Browse for other folders provides a flexible way to choose a folder.

To print packets, select the "Print..." menu item from the File menu. When you do this, Ethereal pops up the Print dialog box as shown in .

The following fields are available in the Print dialog box: Printer This field contains a pair of mutually exclusive radio buttons: Plain Text specifies that the packet print should be in plain text. PostScipt specifies that the packet print process should use PostScript to generate a better print output on PostScript aware printers. Output to file: specifies that printing be done to a file, which name is entered in the field or selected using the browse button. This field is where you enter the file to print to if you have selected Print to a file, or you can click the button to browse the filesystem. It is greyed out if Print to a file is not selected. Print command specifies that a command be used for printing. These Print command fields are not available on windows platforms. This field specifies the command to use for printing. It is typically lpr. You would change it to specify a particular queue if you need to print to a queue other than the default. An example might be: lpr -Pmypostscript This field is greyed out if Output to file: is checked above. Packet Range Select the packets to be printed, see Packet Format Select the output format of the packets to be printed. You can choose, how each packet is printed, see

The packet range frame is a part of various output related dialog boxes. It provides options to select which packets should be processed for the output function.

If the Captured button is set (default), all packets from the selected rule will be processed. If the Displayed button is set, only the currently displayed packets are taken into account to the selected rule. All packets will process all packets. Selected packet only process only the selected packet. Marked packets only process only the marked packets. From first to last marked packet process the packets from the first to the last marked one. Specify a packet range process a user specified range of packets, e.g. specifying 5,10-15,20- will process the packet number five, the packets from packet number ten to fifteen (inclusive) and every packet from number twenty to the end of the capture.

The packet format frame is a part of various output related dialog boxes. It provides options to select which parts of a packet should be used for the output function.

Packet summary line enable the output of the summary line, just as in the "Packet List" pane. Packet details enable the output of the packet details tree. All collapsed the info from the "Packet Details" pane in "all collapsed" state. As displayed the info from the "Packet Details" pane in the current state. All expanded the info from the "Packet Details" pane in "all expanded" state. Packet bytes enable the output of the packet bytes, just as in the "Packet Bytes" pane. Each packet on a new page put each packet on a separate page (e.g. when saving/printing to a text file, this will put a form feed character between the packets).