Files and Folders
Capture Files
To understand which information will remain available after
the captured packets are saved to a capture file,
it's helpful to know a bit about the capture file contents.
Wireshark uses the libpcap file format as the default format to save
captured packets; this format has existed for a long time and it's pretty simple.
However, it has some drawbacks: it's not extensible and lacks some
information that would be really helpful (e.g. being able to add a comment
to a packet such as "the problems start here" would be really nice).
In addition to the libpcap format, Wireshark supports several different
capture file formats. However, the problems described above also applies
for these formats.
A new capture file format "PCAP Next Generation Dump File Format"
is currently under development, which will fix these drawbacks.
However, it still might take a while until the new file format is ready
and Wireshark can use it.
Libpcap File Contents
At the start of each libpcap capture file some basic information is stored
like a magic number to identify the libpcap file format.
The most interesting information of this file start is the link layer type
(Ethernet, Token Ring, ...).
The following data is saved for each packet:
the timestamp with millisecond resolution
the packet length as it was "on the wire"
the packet length as it's saved in the file
the packet's raw bytes
A detailed description of the libpcap file format can be found at:
Not Saved in the Capture File
Probably even more interesting for everyday Wireshark usage is to know
the things that are not saved in the capture file:
current selections (selected packet, ...)
name resolution information, see for details
Warning!
The name resolution information is rebuilt each time Wireshark is
restarted so this information might even change when the capture file
is reopened on the same machine later!
the number of packets dropped while capturing
packet marks set with "Edit/Mark Packet"
time references set with "Edit/Time Reference"
the current display filter
...
Configuration Files and Folders
Wireshark uses a number of files and folders while it is running. Some
of these reside in the personal configuration folder and are used to
maintain information between runs of Wireshark, while some of them are
maintained in system areas.
Tip
A list of the folders Wireshark actually uses can be found under the
Folders tab in the dialog box shown when you select
About Wireshark from the Help menu.
The content format of the configuration files is the same on all platforms.
However, to match the different policies for Unix and Windows platforms,
different folders are used for these files.
Configuration files and folders overview
File/Folder
Description
Unix/Linux folders
Windows folders
preferences
Settings from the Preferences dialog box.
/etc/wireshark.conf, $HOME/.wireshark/preferences
%WIRESHARK%\wireshark.conf, %APPDATA%\Wireshark\preferences
recent
Recent GUI settings (e.g. recent files lists).
$HOME/.wireshark/recent
%APPDATA%\Wireshark\recent
cfilters
Capture filters.
$HOME/.wireshark/cfilters
%WIRESHARK%\cfilters, %APPDATA%\Wireshark\cfilters
dfilters
Display filters.
$HOME/.wireshark/dfilters
%WIRESHARK%\dfilters, %APPDATA%\Wireshark\dfilters
colorfilters
Coloring rules.
$HOME/.wireshark/colorfilters
%WIRESHARK%\colorfilters, %APPDATA%\Wireshark\colorfilters
disabled_protos
Disabled protocols.
$HOME/.wireshark/disabled_protos
%WIRESHARK%\disabled_protos, %APPDATA%\Wireshark\disabled_protos
ethers
Ethernet name resolution.
/etc/ethers, $HOME/.wireshark/ethers
%WIRESHARK%\ethers, %APPDATA%\Wireshark\ethers
manuf
Ethernet name resolution.
/etc/manuf, $HOME/.wireshark/manuf
%WIRESHARK%\manuf, %APPDATA%\Wireshark\manuf
hosts
IPv4 and IPv6 name resolution.
/etc/hosts, $HOME/.wireshark/hosts
%WIRESHARK%\hosts, %APPDATA%\Wireshark\hosts
subnets
IPv4 subnet name resolution.
/etc/subnets, $HOME/.wireshark/subnets
%WIRESHARK%\subnets, %APPDATA%\Wireshark\subnets
ipxnets
IPX name resolution.
/etc/ipxnets, $HOME/.wireshark/ipxnets
%WIRESHARK%\ipxnets, %APPDATA%\Wireshark\ipxnets
plugins
Plugin directories.
/usr/share/wireshark/plugins,
/usr/local/share/wireshark/plugins,
$HOME/.wireshark/plugins
%WIRESHARK%\plugins\<version>,
%APPDATA%\Wireshark\plugins
temp
Temporary files.
Environment: TMPDIR
Environment: TMPDIR or TEMP
Windows folders
%APPDATA% points to the personal configuration folder, e.g.:
C:\Documents and Settings\<username>\Application Data
(details can be found at: ),
%WIRESHARK% points to the Wireshark program folder, e.g.:
C:\Program Files\Wireshark
Unix/Linux folders
The /etc folder is the global Wireshark configuration
folder. The folder actually used on your system
may vary, maybe something like: /usr/local/etc.
$HOME is usually something like: /home/<username>
preferences/wireshark.conf
This file contains your Wireshark preferences,
including defaults for capturing and displaying packets.
It is a simple text file containing statements of the form:
variable: value
The settings from this file are
read in at program start and written to disk when you press the
Save button in the "Preferences" dialog box.
recent
This file contains various GUI related settings like the main window
position and size, the recent files list and such.
It is a simple text file containing statements of the form:
variable: value
It is read at program start and written at program exit.
cfilters
This file contains all the capture filters that you have defined
and saved. It consists of one or more lines, where each
line has the following format:
"<filter name>" <filter string>
The settings from this file are read in at program start and written
to disk when you press the Save button in the "Capture Filters" dialog
box.
dfilters
This file contains all the display filters that you have defined
and saved. It consists of one or more lines, where each
line has the following format:
"<filter name>" <filter string>
The settings from this file are read in at program start and written
to disk when you press the Save button in the "Display Filters" dialog
box.
colorfilters
This file contains all the color filters that you have
defined and saved. It consists of one or more lines,
where each line has the following format:
@<filter name>@<filter string>
@[<bg RGB(16-bit)>][<fg RGB(16-bit)>]
The settings from this file are read in at program start and written
to disk when you press the Save button in the "Coloring Rules" dialog
box.
disabled_protos
Each line in this file specifies a disabled protocol name. The
following are some examples:
tcp
udp
The settings from this file are read in at program start and written
to disk when you press the Save button in the "Enabled Protocols"
dialog box.
ethers
When Wireshark is trying to translate Ethernet hardware
addresses to names, it consults the files listed in
.
If an address is not found in /etc/ethers,
Wireshark looks in $HOME/.wireshark/ethers
Each line in these files consists of one hardware address and
name separated by whitespace. The digits of hardware
addresses are separated by colons (:), dashes (-) or
periods(.). The following are some examples:
ff-ff-ff-ff-ff-ff Broadcast
c0-00-ff-ff-ff-ff TR_broadcast
00.2b.08.93.4b.a1 Freds_machine
The settings from this file are read in at program start and never
written by Wireshark.
manuf
Wireshark uses the files listed in
to translate the first three bytes of an Ethernet address into a
manufacturers name. This file has the same format as the ethers
file, except addresses are three bytes long.
An example is:
00:00:01 Xerox # XEROX CORPORATION
The settings from this file are read in at program start and never
written by Wireshark.
hosts
Wireshark uses the files listed in
to translate IPv4 and IPv6 addresses into names.
This file has the same format as the usual /etc/hosts file on Unix systems.
An example is:
# Comments must be prepended by the # sign!
192.168.0.1 homeserver
The settings from this file are read in at program start and never
written by Wireshark.
subnets
Wireshark uses the files listed in
to translate an IPv4 address into a subnet name. If no exact match from the
hosts file or from DNS is found, Wireshark will attempt a partial match for the subnet
of the address.
Each line of this file consists of an IPv4 address, a subnet mask length separated
only by a '/' and a name separated by whitespace. While the address must be a full IPv4
address, any values beyond the mask length are subsequently ignored.
An example is:
# Comments must be prepended by the # sign!
192.168.0.0/24 ws_test_network
A partially matched name will be printed as "subnet-name.remaining-address". For example,
"192.168.0.1" under the subnet above would be printed as "ws_test_network.1"; if the mask length
above had been 16 rather than 24, the printed address would be "ws_test_network.0.1".
The settings from this file are read in at program start and never
written by Wireshark.
ipxnets
Wireshark uses the files listed in
to translate IPX network numbers into names.
An example is:
C0.A8.2C.00 HR
c0-a8-1c-00 CEO
00:00:BE:EF IT_Server1
110f FileServer3
The settings from this file are read in at program start and never
written by Wireshark.
plugins folder
Wireshark searches for plugins in the directories listed in
.
They are searched in the order listed.
temp folder
If you start a new capture and don't specify a filename for it,
Wireshark uses this directory to store that file; see
.
Windows folders
Here you will find some details about the folders used in Wireshark
on different Windows versions.
As already mentioned, you can find the currently used folders in the
About Wireshark dialog.
Windows profiles
Windows uses some special directories to store user configuration files
which define the "user profile". This can be confusing, as the default directory location
changed from Windows version to version and might also be different for English
and internationalized versions of Windows.
Note!
If you've upgraded to a new Windows version, your profile might
be kept in the former location, so the defaults mentioned here might not
apply.
The following guides
you to the right place where to look for Wireshark's profile data.
Vista
C:\Users\<username>\AppData\Roaming\Wireshark
XP/2000
C:\Documents and Settings\<username>\Application Data,
"Documents and Settings" and "Application Data" might be internationalized.
NT 4 (no longer supported by Wireshark)
C:\WINNT\Profiles\<username>\Application Data\Wireshark
ME/98 - with enabled user profiles (no longer supported by Wireshark)
In Windows ME and 98 you can enable separate user profiles. In that case,
something like:
C:\windows\Profiles\<username>\Application Data\Wireshark
is used.
ME/98/95 (no longer supported by Wireshark)
The default in Windows ME/98/95 is: all users work with the same profile,
which is located at:
C:\windows\Application Data\Wireshark
Windows Vista/XP/2000/NT roaming profiles
The following will only be applicable if you are using roaming profiles.
This might be the case, if you work in a Windows domain environment
(used in company networks). The configurations of all
programs you use won't be saved on the local hard drive of the computer
you are currently working on, but on the domain server.
As Wireshark is using the correct places to store its profile data,
your settings will travel with you, if you logon to a different computer
the next time.
There is an exception to this: The "Local Settings" folder in your profile
data (typically something like:
C:\Documents and Settings\<username>\Local Settings)
will not be transferred to the domain server. This is the default for
temporary capture files.
Windows temporary folder
Wireshark uses the folder which is set by the TMPDIR or TEMP environment
variable. This variable will be set by the Windows installer.
Vista
XXX - could someone give information about this?
XP/2000
C:\Documents and Settings\<username>\Local Settings\Temp
NT 4
C:\TEMP