Here you will find some details about the folders used in Wireshark on different Windows versions.
As already mentioned, you can find the currently used folders in the “About Wireshark” dialog.
Windows uses some special directories to store user configuration files which define the “user profile”. This can be confusing, as the default directory location changed from Windows version to version and might also be different for English and internationalized versions of Windows.
![[Note]](images/note.svg) | Note |
|---|---|
|
If you’ve upgraded to a new Windows version, your profile might be kept in the former location. The defaults mentioned here might not apply. |
The following guides you to the right place where to look for Wireshark’s profile data.
- Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Vista, and associated server editions
- C:\Users\username\AppData\Roaming\Wireshark.
- Windows XP and Windows Server 2003 [1]
- C:\Documents and Settings\username\Application Data. “Documents and Settings” and “Application Data” might be internationalized.
Some larger Windows environments use roaming profiles. If this is the case the configurations of all programs you use won’t be saved on your local hard drive. They will be stored on the domain server instead.
Your settings will travel with you from computer to computer with one exception. The “Local Settings” folder in your profile data (typically something like: C:\Documents and Settings\username\Local Settings) will not be transferred to the domain server. This is the default for temporary capture files.
Wireshark uses the folder which is set by the TMPDIR or TEMP environment variable. This variable will be set by the Windows installer.
- Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Vista, and associated server editions
- C:\Users\username\AppData\Local\Temp
- Windows XP and Windows Server 2003 [1]
- C:\Documents and Settings\username\Local Settings\Temp