THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

Microsoft Network Monitor cap file can be opened by Wireshark but save as function is disabled

I need to capture wireless traffic in monitor mode, so use Microsoft Network Monitor 3.4. To me, it seems to be the only solution on Windows 10.

The cap file generated by Network Monitor can be opened by Wireshark and displayed correctly. However, I found that both the "save as" and "Export Specified Packets ..." functions (from the "File" menu) are disabled.

How can I make such functions work?

ssss's avatar
1
ssss
asked 2018-05-30 08:01:11 +0000
edit flag offensive 0 remove flag close merge delete

Comments

it seems to be the only solution on Windows 10.

FYI: There are other solutions. See the Wireshark CaptureSetup/WLAN wiki page. In particular Npcap, a modern WinPcap replacement, provides a very good solution.

cmaynard's avatar cmaynard (2018-05-30 13:33:22 +0000) edit
more
  • delete

I have added an answer to this question which may be of interest to you.

cmaynard's avatar cmaynard (2019-02-05 15:53:23 +0000) edit
more
  • delete
add a comment see more comments

3 Answers

0

Theres a lenghtly explanation here and a shorter here

Anders's avatar
5k
Anders
answered 2018-05-30 08:13:32 +0000
edit flag offensive 0 remove flag delete link
more

Comments

Ok, so it's still not possible now?

ssss's avatar ssss (2018-05-30 08:18:45 +0000) edit
more
  • delete

Yes, it's still not possible.

Anders's avatar Anders (2018-05-30 08:42:14 +0000) edit
more
  • delete
add a comment see more comments
0

It is possible. The feature exists in version 2.2.6. It has been removed at some point in the development thread, but the Save As will work with CAP file in version 2.2.6. The latest versions of Wireshark will have the feature greyed out.

markGE's avatar
1
markGE
answered 2018-10-05 01:01:13 +0000
edit flag offensive 0 remove flag delete link
more

Comments

add a comment see more comments
0

There are two issues:

  1. Saving in the Wireshark "standard" formats of pcap and pcapng might not be possible, as not all record types and not all link-layer header types in NetMon files are supported by pcap and pcapng.
  2. We currently don't even support writing out all record types in NetMon format.
Guy Harris's avatar
19.9k
Guy Harris
answered 2018-10-06 18:53:36 +0000
edit flag offensive 0 remove flag delete link
more

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer