The File menu choice has many common options to work with files such as Open, Import, Save, Print, and Export. One option is to use Save as when you need to save the file as something other than the default extension, which is .pcapng.

When you are ready to save the file, go to the File menu choice and select Save as, which will open a dialog box, as shown in the following screenshot:

Over the years, developers have added many different file formats to Wireshark. As a result, when you drop down the Save as type,  you will see a list of all the supported file formats, as shown here:

Here, there are many formats that include Microsoft NetMon (.cap), Novell LANalyzer (.tr1), Sniffer (Windows: .caz), and K12 text file (.txt). While some of the formats are legacy and might not ever be used, it's nice to know you have the option of saving the file in other formats.

One common use of the Save as menu choice is to open a file in one format, and then save in another format. An example is obtaining a file with a .pcap extension. Although you can do many things with the .pcap file, the .pcapng format is a better option. PCAPNG files have several enhancements and are able to dissect and display payloads better. In addition, in the .pcap format, you cannot save any comments. If you do add any comments, when you close the file, Wireshark will prompt you to save as .pcapng if you want to preserve your comments.

While saving an entire file is common, you may want to export only a portion of the file. The next section covers the various ways to export specific packets, along with various objects found within the capture file, such as images or web pages.