Export Packets

The Export Packets options within the File Menu provide powerful ways to extract specific data from your captured network traffic for further analysis, reporting, or integration with other tools. Unlike “Save As…”, which saves the entire capture or a filtered subset in a standard capture file format, “Export Packet Dissections…” and “Export Specified Packets…” allow you to extract the dissected information in various human-readable or machine-parseable formats.

1. Export Packet Dissections…

This option allows you to export the detailed breakdown of the selected packets as displayed in the Packet Details Pane. This is particularly useful when you need to share the interpretation of specific packets or analyze the protocol layers in a structured text-based format.

• Plain Text:
  • Exports the hierarchical view of the Packet Details Pane as plain text.
  • You can configure the level of detail to include (e.g., all details, summary only).
  • Useful for quick sharing or when a simple text representation is sufficient.
• CSV (Comma Separated Values):
  • Exports the selected packet information in a tabular format where each field is separated by a comma.
  • You can choose which fields to include in the CSV output, allowing you to customize the data for import into spreadsheets (like Microsoft Excel, Google Sheets) or databases.
  • This is ideal for performing statistical analysis or creating custom reports based on packet attributes.
• PDML (Packet Details Markup Language):
  • Exports the complete dissection of the packets in an XML (Extensible Markup Language) format.
  • PDML provides a structured and hierarchical representation of all protocol fields, making it suitable for programmatic analysis of packet data using scripting languages or XML parsing tools.
• PSML (Packet Summary Markup Language):
  • Exports a summary of the packets, similar to the columns displayed in the Packet List Pane, in an XML format.
  • This can be useful for programmatically accessing the high-level information about each packet in the capture.
• JSON (JavaScript Object Notation):
  • Exports the packet data in JSON format, a lightweight and widely used data-interchange format.
  • JSON output is easily parsed by many programming languages and web technologies, making it suitable for integrating Wireshark data with web applications or other data processing pipelines.

How to Use “Export Packet Dissections…”

• Select one or more packets in the Packet List Pane that you want to export.
• Go to File > Export Packet Dissections….
• Choose the desired export format from the dropdown menu.
• Configure any format-specific options that appear (e.g., fields to include in CSV, level of detail in Plain Text).
• Specify the filename and location to save the exported data.
• Click Save.

2. Export Specified Packets…

This option gives you precise control over which packets from the current capture are exported. You can define a specific range of packets or explicitly list the packet numbers you want to extract. The exported data can then be saved in any of the formats available under “Export Packet Dissections…”.

How to Use “Export Specified Packets…”

• Go to File > Export Specified Packets….
• In the dialog box, specify the packets you want to export:
  • Range: Enter a range of packet numbers (e.g., 1-10, 25-50).
  • List: Enter a comma-separated list of individual packet numbers (e.g., 1, 5, 12, 30).
• Choose the desired Export file format from the dropdown menu.
• Configure any format-specific options.
• Specify the Filename and Location.
• Click OK.

Mastering the “Export Packets” functionality allows you to leverage the detailed information captured by Wireshark in various external applications and formats, extending its utility beyond just real-time analysis within the application itself.