User guide

6.4. Capture Files

Wireshark can read and write capture files in its natural file format, the libpcap format, which is

used by many other network capturing tools, e.g. tcpdump. In addition to this, as one of its strengths,

Wireshark can read/write files in many different file formats of other network capturing tools. The

wiretap library, developed together with Wireshark, provides a general purpose interface to read/

write all the file formats. If you need to add another capture file format, this is the place to start.

How Wireshark Works