Some capture formats may not be available, depending on the
packet types captured.
File formats can be converted!
You can convert capture files from one format to another
by reading in a capture file and writing it out using a
Click on the Save/Ok button to accept your selected file and save to
it. If Wireshark has a problem saving the captured packets to
the file you specified, it will display an error dialog box.
After clicking OK on that error dialog box, you can try again.
Click on the Cancel button to go back to Wireshark and not save the
5.3.2. Output File Formats
Wireshark can save the packet data in its "native" file format (libpcap)
and in the file formats of some other protocol analyzers, so other tools
can read the capture data.
File formats have different time stamp accuracies!
Saving from the currently used file format to a different format may reduce the
time stamp accuracy; see the Section 7.4, “Time Stamps” for details.
The following file formats can be saved by Wireshark (with the known file extensions):
libpcap, tcpdump and various other tools using tcpdump's capture format (*.pcap,*.cap,*.dmp)
Accellent 5Views (*.5vw)
HP-UX's nettl (*.TRC0,*.TRC1)
Microsoft Network Monitor - NetMon (*.cap)
Network Associates Sniffer - DOS (*.cap,*.enc,*.trc,*fdc,*.syc)
Network Associates Sniffer - Windows (*.cap)
Network Instruments Observer version 9 (*.bfr)
Novell LANalyzer (*.tr1)
Sun snoop (*.snoop,*.cap)
Visual Networks Visual UpTime traffic (*.*)
... new file formats are added from time to time
If the above tools will be more helpful than Wireshark is a different question ;-)
Third party protocol analyzers may require specific file extensions!
Other protocol analyzers than Wireshark may require that the file has a
certain file extension in order to read the files you generate with Wireshark, e.g.: