To understand which information will remain available after the captured packets are saved to a capture file, it's helpful to know a bit about the capture file contents. Wireshark uses the libpcap file format as the default format to save captured packets, this format exists for a long time and it's pretty simple. However, it has some drawbacks: it's not extensible and lacks some information that would be really helpful (e.g. being able to add a comment to a packet "the problems start here" would be really nice). In addition to the libpcap format, Wireshark supports several different capture file formats. However, the problems described above also applies for these formats too. A new capture file format "PCAP Next Generation Dump File Format" is currently under development, which will fix these drawbacks. However, it still might take a while until the new file format is ready and Wireshark can use it.

At the start of each libpcap capture file some basic information is stored like a magic number to identify the libpcap file format. The most interesting information of this file start is the link layer type (Ethernet, Token Ring, ...). The following data is saved for each packet: the timestamp with millisecond resolution the packet length as it was "on the wire" the packet length as it's saved in the file the packet's raw bytes A detailed description of the libpcap file format can be found at:

Probably even more interesting for the everyday Wireshark usage is to know the things that are not saved in the capture file: current selections (selected packet, ...) name resolution information, see for details The name resolution information is rebuild each time Wireshark is restarted so this information even might change when the capture file is reopened on the same machine later! the number of packets dropped while capturing packet marks set with "Edit/Mark Packet" time references set with "Edit/Time Reference" the current display filter ...

Wireshark uses a number of files and folders while it is running. Some of these reside in the personal configuration folder and are used to maintain information between runs of Wireshark, while some of them are maintained in system areas. A list of the folders Wireshark actually uses can be found under the Folders tab in the dialog box coming up, when you select About Wireshark from the Help menu. The content format of the configuration files is the same on all platforms. However, to match the different policies for Unix and windows platforms, different folders for these files are used. File/Folder Description Unix/Linux folders Windows folders preferences Settings from the Preferences dialog box. /etc/wireshark.conf, $HOME/.wireshark/preferences %WIRESHARK%\wireshark.conf, %APPDATA%\Wireshark\preferences recent Recent GUI settings (e.g. recent files lists). $HOME/.wireshark/recent %APPDATA%\Wireshark\recent cfilters Capture filters. $HOME/.wireshark/cfilters %WIRESHARK%\cfilters, %APPDATA%\Wireshark\cfilters dfilters Display filters. $HOME/.wireshark/dfilters %WIRESHARK%\dfilters, %APPDATA%\Wireshark\dfilters colorfilters Coloring rules. $HOME/.wireshark/colorfilters %WIRESHARK%\colorfilters, %APPDATA%\Wireshark\colorfilters disabled_protos Disabled protocols. $HOME/.wireshark/disabled_protos %WIRESHARK%\disabled_protos, %APPDATA%\Wireshark\disabled_protos ethers Ethernet name resolution. /etc/ethers, $HOME/.wireshark/ethers %WIRESHARK%\ethers, %APPDATA%\Wireshark\ethers manuf Ethernet name resolution. /etc/manuf, $HOME/.wireshark/manuf %WIRESHARK%\manuf, %APPDATA%\Wireshark\manuf hosts IPv4 and IPv6 name resolution. /etc/hosts, $HOME/.wireshark/hosts %WIRESHARK%\hosts, %APPDATA%\Wireshark\hosts ipxnets IPX name resolution. /etc/ipxnets, $HOME/.wireshark/ipxnets %WIRESHARK%\ipxnets, %APPDATA%\Wireshark\ipxnets plugins Plugin directories. /usr/share/wireshark/plugins, /usr/local/share/wireshark/plugins, $HOME/.wireshark/plugins %WIRESHARK%\plugins\<version>, %APPDATA%\Wireshark\plugins temp Temporary files. Environment: TMPDIR Environment: TMPDIR or TEMP %APPDATA% points to the personal configuration folder, e.g.: C:\Documents and Settings\<username>\Application Data (details can be found at: ), %WIRESHARK% points to the Wireshark program folder, e.g.: C:\Program Files\Wireshark The /etc folder is the global Wireshark configuration folder. The folder actually used on your system may vary, maybe something like: /usr/local/etc. $HOME is usually something like: /home/<username> preferences/wireshark.conf This file contains your Wireshark preferences, including defaults for capturing and displaying packets. It is a simple text file containing statements of the form: variable: value The settings from this file are read in at program start and written to disk when you press the Save button in the "Preferences" dialog box. recent This file contains various GUI related settings like the main window position and size, the recent files list and such. It is a simple text file containing statements of the form: variable: value It is read at program start and written at program exit. cfilters This file contains all the capture filters that you have defined and saved. It consists of one or more lines, where each line has the following format: "<filter name>" <filter string> The settings from this file are read in at program start and written to disk when you press the Save button in the "Capture Filters" dialog box. dfilters This file contains all the display filters that you have defined and saved. It consists of one or more lines, where each line has the following format: "<filter name>" <filter string> The settings from this file are read in at program start and written to disk when you press the Save button in the "Display Filters" dialog box. colorfilters This file contains all the color filters that you have defined and saved. It consists of one or more lines, where each line has the following format: @<filter name>@<filter string> @[<bg RGB(16-bit)>][<fg RGB(16-bit)>] The settings from this file are read in at program start and written to disk when you press the Save button in the "Coloring Rules" dialog box. disabled_protos Each line in this file specifies a disabled protocol name. The following are some examples: tcp udp The settings from this file are read in at program start and written to disk when you press the Save button in the "Enabled Protocols" dialog box. ethers When Wireshark is trying to translate Ethernet hardware addresses to names, it consults the files listed in . If an address is not found in /etc/ethers, Wireshark looks in $HOME/.wireshark/ethers Each line in these files consists of one hardware address and name separated by whitespace. The digits of hardware addresses are separated by colons (:), dashes (-) or periods(.). The following are some examples: ff-ff-ff-ff-ff-ff Broadcast c0-00-ff-ff-ff-ff TR_broadcast 00.2b.08.93.4b.a1 Freds_machine The settings from this file are read in at program start and never written by Wireshark. manuf Wireshark uses the files listed in to translate the first three bytes of an Ethernet address into a manufacturers name. This file has the same format as the ethers file, except addresses are three bytes long. An example is: 00:00:01 Xerox # XEROX CORPORATION The settings from this file are read in at program start and never written by Wireshark. hosts Wireshark uses the files listed in to translate IPv4 and IPv6 addresses into names. This file has the same format as the usual /etc/hosts file in Unix systems. An example is: # Comments must be prepended by the # sign! 192.168.0.1 homeserver The settings from this file are read in at program start and never written by Wireshark. ipxnets Wireshark uses the files listed in to translate IPX network numbers into names. An example is: C0.A8.2C.00 HR c0-a8-1c-00 CEO 00:00:BE:EF IT_Server1 110f FileServer3 The settings from this file are read in at program start and never written by Wireshark. plugins folder Wireshark searches for plugins in the directories listed in . They are searched in the order listed. temp folder If you start a new capture and don't specify a filename for it, Wireshark uses this directory to place that file in, see .

Here you will find some details about the folders used in Wireshark on different Windows versions. As already mentioned, you can find the currently used folders in the About Wireshark dialog.

Windows uses some special directories to store user configuration files in, named the user profile. This can be confusing, as the default directory location changed from version to version and might also be different for English and internationalized versions of windows. If you upgraded to a new windows version, your profile might be kept in the former location, so the defaults mentioned here might not apply. The following guides you to the right place where to look for Wireshark's profile data. Vista C:\Users\<username>\AppData\Roaming\Wireshark XP/2000 C:\Documents and Settings\<username>\Application Data, "Documents and Settings" and "Application Data" might be internationalized. NT 4 (no longer supported by Wireshark) C:\WINNT\Profiles\<username>\Application Data\Wireshark ME/98 - with enabled user profiles (no longer supported by Wireshark) In Windows ME and 98 you can enable separate user profiles. In that case, something like: C:\windows\Profiles\<username>\Application Data\Wireshark is used. ME/98/95 (no longer supported by Wireshark) The default in Windows ME/98/95 is: all users work with the same profile, which is located at: C:\windows\Application Data\Wireshark

The following will only be applicable if you are using roaming profiles. This might be the case, if you work in a Windows domain environment (used in company networks). The configurations of all programs you use won't be saved on the local hard drive of the computer you are currently working on, but on the domain server. As Wireshark is using the correct places to store its profile data, your settings will travel with you, if you logon to a different computer the next time. There is an exception to this: The "Local Settings" folder in your profile data (typically something like: C:\Documents and Settings\<username>\Local Settings) will not be transferred to the domain server. This is the default for temporary capture files.

Wireshark uses the folder which is set by the TMPDIR or TEMP environment variable. This variable will be set by the windows installer. Vista XXX - could someone give information about this? XP/2000 C:\Documents and Settings\<username>\Local Settings\Temp NT 4 C:\TEMP