5.6. File Sets
Prev Chapter 5. File Input, Output, And Printing Next

5.6. File Sets

When using the “Multiple Files” option while doing a capture (see: Section 4.8, “Capture files and file modes”), the capture data is spread over several capture files, called a file set.

As it can become tedious to work with a file set by hand, Wireshark provides some features to handle these file sets in a convenient way.

How does Wireshark detect the files of a file set?

A filename in a file set uses the format Prefix_Number_DateTimeSuffix (or, in Wireshark 4.4.0 and later, Prefix_DateTime_NumberSuffix) which might look something like test_00001_20240714183910.pcap. All files of a file set share the same prefix (e.g., “test”) and suffix (e.g., “.pcap”) and a varying middle part. Files are also allowed to have a second compression suffix of types that Wireshark can open; the compression suffix does not have to match for all files in a set.

To find the files of a file set, Wireshark scans the directory where the currently loaded file resides and checks for files matching the filename pattern (prefix and suffix) of the currently loaded file.

This simple mechanism usually works well but has its drawbacks. If several file sets were captured with the same prefix and suffix, Wireshark will detect them as a single file set. If files were renamed or spread over several directories the mechanism will fail to find all files of a set.

The following features in the File → File Set submenu are available to work with file sets in a convenient way:

5.6.1. The “List Files” Dialog Box

Figure 5.9. The “List Files” dialog box

ws file set dialog

Each line contains information about a file of the file set:

Filename
The name of the file. If you click on the filename (or the radio button left to it), the current file will be closed and the corresponding capture file will be opened.
Created
The creation time of the file.
Last Modified
The last time the file was modified.
Size
The size of the file.

The last line will contain info about the currently used directory where all of the files in the file set can be found.

The content of this dialog box is updated each time a capture file is opened/closed.

The Close button will, well, close the dialog box.

Prev Up Next
5.5. Import Hex Dump Home 5.7. Exporting Data