|
The primary file format used by FrameSeer is tcpdump’s native file format. However, FrameSeer can also export information in text format which can then be imported into word-processing and spreadsheet applications.
The commands for manipulating whole files in the File menu are:
|
New
|
Creates a new, untitled FrameSeer document and prepares it for capture on your Primary Interface (see Selecting an Interface for an explanation).
|
Open...
Open Recent
|
Opens existing tcpdump-format files. The Start button and interface menu are disabled to prevent accidentally overwriting data.
|
|
Close
|
Closes the current FrameSeer document window, prompting the user to save any unsaved information in a tcpdump-format file.
|
Save
Save As...
|
Writes tcpdump-format data to disk. The entire contents of the capture buffer are written to the file.
|
The Save Selection... command works with subsets of information. As the name suggests, only the frames which are selected in the Capture tab are saved. In addition, a File Format: popup menu allows you to save information in the following file formats:
|
TCPDump
|
The selected frames are saved in tcpdump-native format. Note that a Select All in the Capture tab followed by a Save Selection... in TCPDump format is the same as a Save or Save As...
|
|
Summary
|
Information is written to a text file in tab-separated format. The first line contains column titles. Then, for each frame which is selected in the Capture tab, a summary line is written to the file.
You can import saved data into other applications such as spreadsheets and databases. See Copying captures to the clipboard for an example of how you can perform additional analysis on captured packets.
All possible columns are written to the file, regardless of whether the columns are actually visible in the Capture tab. The columns are exported in the following order:
-
Frame Number
-
Source Address
-
Data-Link Source Address
-
Network Source Address
-
Destination Address
-
Data-Link Destination Address
-
Network Destination Address
-
Protocol
-
Data-Link Protocol
-
Network Protocol
-
Transport Source Protocol
-
Transport Destination Protocol
-
Frame Length
-
Frame Timestamp
-
“Marked” state
|
|
Decode
|
For each frame which is selected in the Capture tab, a full decode is generated and written to a TEXT file in tab-separated-format. The columns are exported in the following order:
|
Files created by FrameSeer use the following extensions:
-
Files in tcpdump-format are given the extension “.dmp”.
-
Text files are given the extension “.txt”.
|
|
