Saving packet captures
A packet capture is most useful after saving it to disk. This is because a saved packet capture can be re-opened, shared, or even converted to other file formats for analysis in third-party applications.
The available file formats you can save to depend on the network topology of the captured traffic—although Observer’s native BFR format can be saved to regardless of topology. Observer can save packet captures to any of the formats listed in Table 12.
Except for XML, Observer can load all of the files formats that it can save to, plus the DMP format. To load packet captures, see Decoding network traffic and the loadable file formats of Observer.
After starting a packet capture—described in Capturing network traffic—save the packet capture:
Click the File tab, and click Save > Save Capture.
Tip! You can also press CTRL+S on the keyboard to save.
 
You can now choose which packets to save (all packets since the capture began are chosen by default) and in which file format.
 
 
Table 12. Save Capture Buffer options
File format
Supported topologies
Limitations and other information
BFR
Ethernet and Wireless
BFR can only be read in Observer and Wireshark. Retains both nanosecond resolution and expert information packets. Only BFR captures can be merged directly in Observer.
PCAPNG
Ethernet and Wireless
PCAPNG retains both nanosecond resolution and expert information packets.
PCAP
Ethernet and Wireless
PCAP retains nanosecond resolution, but loses expert information packets.
CAP
Ethernet
CAP loses nanosecond resolution and expert information packets.
ENC
Ethernet
ENC loses nanosecond resolution and expert information packets.
XML1
Ethernet
XML loses nanosecond resolution, but retains expert information packets. Limited in usefulness.

1 XML formatted packet captures cannot be re-opened by Observer.

Saving to any format other than Observer’s native BFR format or PCAPNG removes all expert information packets from the resulting saved packet capture. For more information about expert information packets, see Excluding non-native packets from capture.
Saving to any format other than Observer’s native BFR format, or the PCAPNG or PCAP formats, removes all nanosecond resolution from the resulting saved packet capture. If you need to retain nanosecond resolution, ensure you save a packet capture to BFR, PCAPNG, or PCAP format. See the table for a full list of limitations per format.