Before capturing, the Capture > Options dialog controls how the trace is collected. The interface list shows every available network adapter, and the chosen interface determines which traffic can be observed. Promiscuous mode can be enabled there, instructing the driver to deliver every frame seen on the wire, not just those destined for the local host. Capture filters entered in this dialog use BPF syntax, with keywords like host, src host, dst host, port, src port, dst port, net, tcp, udp, and icmp allowing precise pre-capture narrowing. Examples include host 192.168.1.1, src host 192.168.1.1, dst port 80, and net 192.168.1.0/24.
Several other capture options affect how data is stored. The snapshot length limits how many bytes of each frame are recorded, which is useful for header-only captures on high-volume links; the default of 65535 bytes captures full packets but can be reduced to shrink files. A ring buffer can be enabled to rotate through a fixed number of files, preventing disk exhaustion on long-running captures, and automatic stop conditions let a capture end after a specified number of packets, files, or elapsed time. The output file format is pcapng by default, though the older pcap format is still supported; pcapng adds metadata, multiple interfaces, and better support for modern features compared to pcap.
After capture, files can be exported in several formats. File > Export Specified Packets writes the currently visible (or marked) packets, while File > Export Packet Dissections produces structured representations such as CSV, JSON, PDML, and PSML, each of which is suited to a different downstream tool. File > Export Packet Bytes saves raw payload, and File > Export Objects allows extraction of files transferred over protocols like HTTP, SMB, or DICOM. The Statistics > Resolved Addresses view lists name-resolution results for IPs, MACs, and ports when those features are enabled through View > Name Resolution.