File Input / Output and PrintingIntroduction
This chapter will describe input and output of capture data.
Open/Import capture files in various capture file formats
Save/Export capture files in various capture file formats
Merge capture files together
Print packets
Open capture files
Ethereal can read in previously saved capture files.
To read them, simply select the menu or toolbar item: "File/
Open".
Ethereal will then pop up the File
Open dialog box, which is discussed in more detail in
.
Note!
You can also use drag-and-drop to open a file, by
simply dropping the desired file from your file manager onto Ethereal's
main window. However, drag-and-drop is not available/won't work in all
desktop environments.
If you didn't save the current capture file before, you will be asked
to do so, to prevent data loss (this behaviour can be disabled in the
preferences).
In addition to its native file format (libpcap format, also used by
tcpdump/WinDump and other libpcap/WinPcap-based programs), Ethereal can
read capture files from a large number of other packet capture programs
as well. See for the list of
capture formats Ethereal understands.
The "Open Capture File" dialog box
The "Open Capture File" dialog box allows you to search for a
capture file containing previously captured packets for display in
Ethereal. shows an example
of the Ethereal Open File Dialog box.
Note
Ethereal uses the open dialog box from the version of the GTK+
toolkit that it's using. This dialog was completely redesigned in
GTK version 2.4. Depending on the installed GTK version,
your dialog box might look different. However, as the
functionality remains almost the same, much of this description
will work with your version of Ethereal.
With this dialog box, you can perform the following actions:
The "+ Add" button allows you to add a directory, selected in the
right-hand pane, to the favorites (bookmarks?) list. Those changes
are persistent.
The "- Remove" button allows you to remove a selected directory from
that list again (the items like: "Home", "Desktop", and "Filesystem"
cannot be removed).
Select files and directories with the list boxes.
View file preview information (like the filesize, the number of
packets, ...), while browsing the filesystem.
Specify a display filter with the Filter button and filter
field. This filter will be used when opening the new file.
Clicking on the Filter button causes Ethereal to pop up
the Filters dialog box (which is discussed further in
).
Specify which name resolution is to be performed for all packets by
clicking on one of the "Enable name resolution" check buttons.
Details about name resolution can be found in
.
Click the Open button to accept your selected file and open it.
If Ethereal doesn't recognize the capture format, it will grey out
this button.
Click the Cancel button to go back to Ethereal and not load a capture
file.
You can also change the display filter and name resolution settings later while
viewing the packets. However, for very large capture files it can take a
significant amount of extra time changing these settings later, so it
might be a good idea to set at least the filter in advance here.
Input File Formats
The following file formats from other capture tools can be opened by
Ethereal:
libpcap, tcpdump and various other tools using tcpdump's capture formatSun snoop and atmsnoopShomiti/Finisar Surveyor capturesNovell LANalyzer capturesMicrosoft Network Monitor capturesAIX's iptrace capturesCinco Networks NetXray capturesNetwork Associates Windows-based Sniffer and Sniffer Pro capturesNetwork General/Network Associates DOS-based Sniffer (compressed or uncompressed) capturesAG Group/WildPackets EtherPeek/TokenPeek/AiroPeek/EtherHelp/PacketGrabber capturesRADCOM's WAN/LAN Analyzer capturesNetwork Instruments Observer version 9 capturesLucent/Ascend router debug outputHP-UX's nettlToshiba's ISDN routers dump outputISDN4BSD i4btrace utilitytraces from the EyeSDN USB S0IPLog format from the Cisco Secure Intrusion Detection Systempppd logs (pppdump format)the output from VMS's TCPIPtrace/TCPtrace/UCX$TRACE utilitiesthe text output from the DBS Etherwatch VMS utilityVisual Networks' Visual UpTime traffic capturethe output from CoSine L2 debugthe output from Accellent's 5Views LAN agentsEndace Measurement Systems' ERF format capturesLinux Bluez Bluetooth stack hcidump -w tracesNote!
It may not be possible to read some formats dependent on the packet types
captured. Ethernet captures are usually supported for most file formats,
but other packet types (e.g. token ring packets) may not be possible to
read from all file formats.
Saving captured packets
You can save captured packets simply by using the Save As... menu
item from the File menu under Ethereal. You can choose which
packets to save and which file format to be used.
The "Save Capture File As" dialog box
The "Save Capture File As" dialog box allows you to save
the current capture to a file.
shows an example of this
dialog box.
Note
Ethereal uses the open dialog box from the version of the GTK+
toolkit that it's using. This dialog was completely redesigned in
the GTK version 2.4. Depending on the installed GTK version,
your dialog box might look different. However, as the
functionality remains almost the same, much of this description
will work with your version of Ethereal.
With this dialog box, you can perform the following actions:
Type in the name of the file you wish to save the captured
packets in, as a standard file name in your file system.
Select the directory to save the file into.
Select the range of the packets to be saved, see
Specify the format of the saved capture file by clicking on
the File type drop down box. You can choose from the
types, described in .
Note!
Some capture formats may not be available, depending on the
packet types captured.
Tip!
You can convert capture files from one format to another
by reading in a capture file and writing it out using a
different format.
Use "Browse for other folders" to browse files and folders in your
file system.
Click on the Save button to accept your selected file and save to
it. If Ethereal has a problem saving the captured packets to
the file you specified, it will display an error dialog box.
After clicking OK on this error dialog box, you can try again.
Click on the Cancel button to go back to Ethereal and not save the
captured packets.
Output File Formats
The following file formats can be saved by Ethereal,
so other capture tools can read the capture data from:
libpcap (tcpdump)Novell LANalyzerNetwork Associates SnifferSun snoopMicrosoft Network MonitorVisual Networks Visual UpTime trafficAccellent 5ViewsNetworks Instruments Observer version 9HP-UX's nettl
Other protocol analyzers may require that the file has a certain suffix
in order to read the files you generate with Ethereal, e.g.:
".DMP" for Tcpdump/libpcap
".CAP" for Network Associates Sniffer Windows
Merging capture files
Sometimes you need to merge several capture files into one. For example
this can be useful, if you have captured simultaneously from multiple
interfaces at once (e.g. using multiple instances of Ethereal).
Merging capture files can be done in three ways:
Use the menu item "Merge" from the "File" menu,
to open the merge dialog, see .
This menu item will be disabled, until you have loaded a capture file.
Use drag-and-drop to drop multiple files on the
main window. Ethereal will try to merge the packets in chronological
order from the dropped files into a newly created temporary file. If
you drop only a single file, it will simply replace a (maybe) existing
one.
Use the mergecap tool, which is a command
line tool to merge capture files. This tool provides the most options
to merge capture files, see .
The "Merge with Capture File" dialog box
This dialog box let you select a file to be merged into the currently
loaded file.
Note!If your current data wasn't saved before, you will be asked to save
it first, before this dialog box is shown.Prepend packets to existing file
Prepend the packets from the selected file before the currently loaded
packets.
Merge packets chronologically
Merge both the packets from the selected and currently loaded file in
chronological order.
Append packets to existing file
Append the packets from the selected file after the currently loaded
packets.
All other controls will work the same way as in the "Open Capture File"
dialog box, see .
File Sets
When using the "Multiple Files" option while doing a capture,
the capture data is spreaded over several capture files, called a file
set. Ethereal tries to find the files matching the same filename pattern
than the currently loaded file. This will only work, if all the files
of the file set are located in the same directory.
As it can become tedious to work with a file set by hand, Ethereal
provides some features in the "File" menu to handle these file sets in
a more convenient way:
The List Files dialog box will list the files
Ethereal has recognized as being part of the current file set.
Next File opens the next file in the file set.
Previous File opens the previous file in
the file set.
XXX - add icons from the menu
The "List Files" dialog boxXXX - add screenshot
Each line contains information about a file of the file set:
Filename the name of the file
Created the creation time of the file
Last Modified the last time the file was modified
Size the size of the file
The last line will contain info about the currently used directory where
all of the files in the file set can be found.
The content of this dialog box is updated each time a capture file is
opened/closed.
If you click on the radio button to the left of the line, the
corresponding capture file will be opened. The Close button will, well,
close the dialog box.
Exporting data
Ethereal provides several ways and formats to export packet data. This
section describes general ways to export data from Ethereal.
Note!
There are more specialized functions to export specific data,
which will be described at the appropriate places.
XXX - add detailed descriptions of the output formats and some sample
output, too.
The "Export as Plain Text File" dialog box
Export packet data into a plain ASCII text file, much like the format
used to print packets.
Export to file: frame chooses the file to export
the packet data to.
The Packet Range frame is described in .
The Packet Details frame is described in .
The "Export as PostScript File" dialog box
Export packet data into PostScript, much like the format used
to print packets.
Tip!
You can easily convert PostScript files to PDF files using ghostscript.
For example: export to a file named foo.ps and then call:
ps2pdf foo.psExport to file: frame chooses the file to export
the packet data to.
The Packet Range frame is described in .
The Packet Details frame is described in .
The "Export as CSV (Comma Seperated Values) File" dialog boxXXX - add screenshot
Export packet summary into CSV, used e.g. by spreadsheet programs to
im-/export data.
Export to file: frame chooses the file to export
the packet data to.
The Packet Range frame is described in .
The "Export as PSML File" dialog box
Export packet data into PSML. This is an XML based format including
only the packet summary.
Export to file: frame chooses the file to export
the packet data to.
The Packet Range frame is described in .
There's no such thing as a packet details frame for PSML export, as the
packet format is defined by the PSML specification.
The "Export as PDML File" dialog box
Export packet data into PDML. This is an XML based format including
the packet details. The PDML file specification is available at:
PDML specification.
The PDML specification is not officially released and Ethereal's
implementation of it is still in an early beta state, so please expect
changes in future Ethereal versions.
Export to file: frame chooses the file to export
the packet data to.
The Packet Range frame is described in .
There's no such thing as a packet details frame for PDML export, as the
packet format is defined by the PDML specification.
The "Export selected packet bytes" dialog box
Export the bytes selected in the "Packet Bytes" pane into a raw
binary file.
Name: the filename to export the packet data to.
The Save in folder: field lets you select the
folder to save to (from some predefined folders).
Browse for other folders provides a flexible
way to choose a folder.
Printing packets
To print packets, select the "Print..." menu item from the File menu.
When you do this, Ethereal pops up the Print dialog box as shown in
.
The "Print" dialog box
The following fields are available in the Print dialog box:
Printer
This field contains a pair of mutually exclusive radio buttons:
Plain Text specifies that
the packet print should be in plain text.
PostScript specifies that
the packet print process should use PostScript to
generate a better print output on PostScript aware printers.
Output to file: specifies that printing
be done to a file, which name is entered in the field or selected
using the browse button.
This field is where you enter the file to
print to if you have selected Print to a file, or you can click the
button to browse the filesystem. It is greyed out if Print to a file
is not selected.
Print command specifies that a
command be used for printing.
Note!
These Print command fields are not available on
windows platforms.
This field specifies the command to use for printing. It
is typically lpr. You would change it
to specify a particular queue if you need to print to a
queue other than the default. An example might be:
lpr -Pmypostscript
This field is greyed out if Output to file: is
checked above.
Packet Range
Select the packets to be printed, see Packet Format
Select the output format of the packets to be printed. You can
choose, how each packet is printed, see
The Packet Range frame
The packet range frame is a part of various output related dialog boxes.
It provides options to select which packets should be processed by the
output function.
If the Captured button is set (default), all packets
from the selected rule will be processed. If the Displayed
button is set, only the currently displayed packets are taken
into account to the selected rule.
All packets will process all packets.
Selected packet only process only the selected
packet.
Marked packets only process only the marked
packets.
From first to last marked packet process the
packets from the first to the last marked one.
Specify a packet range process a user specified
range of packets, e.g. specifying 5,10-15,20- will
process the packet number five, the packets from packet number ten
to fifteen (inclusive) and every packet from number twenty to the
end of the capture.
The Packet Format frame
The packet format frame is a part of various output related dialog boxes.
It provides options to select which parts of a packet should be used for
the output function.
Packet summary line enable the output of the
summary line, just as in the "Packet List" pane.
Packet details enable the output of the packet
details tree.
All collapsed the info from the "Packet Details"
pane in "all collapsed" state.
As displayed the info from the "Packet Details"
pane in the current state.
All expanded the info from the "Packet Details"
pane in "all expanded" state.
Packet bytes enable the output of the packet
bytes, just as in the "Packet Bytes" pane.
Each packet on a new page put each packet on a
separate page (e.g. when saving/printing to a text file, this will
put a form feed character between the packets).