Lucent Technologies Ethereal manual Open capture files, Open Capture File dialog box

File Input / Output and Printing

5.2. Open capture files

Ethereal can read in previously saved capture files. To read them, simply select the menu or toolbar

item: "File/ Open". Ethereal will then pop up the File Open dialog box, which is discussed in

more detail in Section 5.2.1, “The "Open Capture File" dialog box”.

Note!

You can also use drag-and-dropto open a file, by simply dropping the desired file from your file manager onto Ethereal's main window. However, drag-and-drop is not available/won't work in all desktop environments.

If you didn't save the current capture file before, you will be asked to do so, to prevent data loss (this behaviour can be disabled in the preferences).

In addition to its native file format (libpcap format, also used by tcpdump/WinDump and other libp- cap/WinPcap-based programs), Ethereal can read capture files from a large number of other packet capture programs as well. See Section 5.2.2, “Input File Formats” for the list of capture formats Eth- ereal understands.

5.2.1. The "Open Capture File" dialog box

The "Open Capture File" dialog box allows you to search for a capture file containing previously captured packets for display in Ethereal. Figure 5.1, “The "Open Capture File" Dialog box” shows an example of the Ethereal Open File Dialog box.

Note

Ethereal uses the open dialog box from the version of the GTK+ toolkit that it's using. This dialog was completely redesigned in GTK version 2.4. Depending on the installed GTK version, your dialog box might look different. However, as the functionality re- mains almost the same, much of this description will work with your version of Ether- eal.

Figure 5.1. The "Open Capture File" Dialog box

78