# How to Import and Export PCAP Files for Network Analysis in Sniffnet

> Learn to import and export PCAP files for network analysis in Sniffnet. Easily analyze offline captures or export live traffic using the GUI or CLI.

- Repository: [Giuliano Bellini/sniffnet](https://github.com/GyulyVGC/sniffnet)
- Tags: how-to-guide
- Published: 2026-04-28

---

**You can import PCAP files by selecting the "Capture file" source to create an offline `CaptureContext` reading from disk, and export live traffic by enabling the export toggle and providing a path before initiating the capture, with both workflows available via the GUI or CLI.**

Sniffnet provides built-in support for reading existing packet captures and recording live traffic to disk using the standard PCAP format. This functionality leverages the underlying `pcap` library to handle both offline analysis of historical data and persistent storage of real-time network monitoring. Understanding how to import and export PCAP files for network analysis in Sniffnet allows you to integrate the tool into forensic workflows and share capture data across different analysis platforms.

## Importing PCAP Files into Sniffnet

Importing allows you to analyze previously recorded network traffic as if it were a live device. The process involves switching the capture source from a network interface to a file path and initializing an offline capture context.

### Configuring the Import Source

To begin importing, you must change the capture source to file mode. In the UI, this is handled by selecting "Capture file" from the source dropdown, which triggers `Message::SetPcapImport`. Programmatically, the path is stored in the global configuration struct.

In [`src/gui/sniffer.rs`](https://github.com/GyulyVGC/sniffnet/blob/main/src/gui/sniffer.rs), the `set_pcap_import` method updates the configuration and capture source:

```rust
// UI message handling (src/gui/sniffer.rs)
Message::SetPcapImport(path) => self.set_pcap_import(path),

fn set_pcap_import(&mut self, path: String) {
    self.conf.import_pcap_path = path; // stored in Conf (src/gui/types/conf.rs)
    self.capture_source = CaptureSource::from_conf(&self.conf); // becomes File source
}

```

This updates `Conf.import_pcap_path` in [`src/gui/types/conf.rs`](https://github.com/GyulyVGC/sniffnet/blob/main/src/gui/types/conf.rs) and creates a `CaptureSource::File` variant using `MyPcapImport::new(import_path)`.

### Initializing the Offline Capture Context

Once the import path is configured, Sniffnet constructs a `CaptureContext` specifically for offline processing. In [`src/networking/types/capture_context.rs`](https://github.com/GyulyVGC/sniffnet/blob/main/src/networking/types/capture_context.rs), the `CaptureContext::new` function receives the file source and builds a `pcap::Capture<pcap::Offline>`:

```rust
let capture_context = CaptureContext::new(
    &CaptureSource::File(my_pcap_import),
    None, // No export path for imports
    &conf.filters,
);

```

This `CaptureContext` is then used by the packet-parsing pipeline in [`parse_packets.rs`](https://github.com/GyulyVGC/sniffnet/blob/main/parse_packets.rs) and [`traffic_preview.rs`](https://github.com/GyulyVGC/sniffnet/blob/main/traffic_preview.rs), processing packets from disk exactly as it would from a live device.

## Exporting Live Captures to PCAP Format

Exporting allows you to persist live network traffic to a file for later analysis. This requires enabling the export flag, configuring the output path, and attaching a savefile to the live capture context.

### Enabling Export and Setting the Target Path

First, toggle the export mechanism and define the output location. The `ExportPcap` struct in [`src/gui/types/export_pcap.rs`](https://github.com/GyulyVGC/sniffnet/blob/main/src/gui/types/export_pcap.rs) manages the enabled state, directory, and filename:

```rust
// Toggle the export switch (Message::ToggleExportPcap in src/gui/sniffer.rs)
self.conf.export_pcap.toggle();               // enable/disable export

// Set the output directory and filename (called after the user selects a folder)
self.conf.export_pcap.set_directory(path);
self.conf.export_pcap.set_file_name(name);

```

The full output path is computed by `ExportPcap.full_path()`, which returns `Option<String>`. If `None`, exporting is disabled; if `Some(path)`, Sniffnet prepares to write to that location.

### Attaching the Savefile to the Capture Context

When `CaptureContext::new` is called in [`src/networking/types/capture_context.rs`](https://github.com/GyulyVGC/sniffnet/blob/main/src/networking/types/capture_context.rs), it checks for the export path. If `full_path()` returns `Some(path)`, Sniffnet creates a `pcap::Savefile` using `Capture::savefile` and wraps the live capture in the `CaptureContext::LiveWithSavefile` variant:

```rust
let pcap_path = self.conf.export_pcap.full_path(); // Option<String>
let capture_context = CaptureContext::new(
    &self.capture_source,      // either Device or File source
    pcap_path.as_ref(),       // None → no export, Some(&String) → write to file
    &self.conf.filters,
);

```

### Writing Packets in Real Time

With `LiveWithSavefile` active, every captured packet is automatically written to the `Savefile` by the underlying pcap library. This occurs within the `CaptureContext::consume` method, ensuring that your exported PCAP contains the exact traffic seen during the live capture session without requiring manual buffer management.

## Using the Command-Line Interface

Both import and export workflows are fully exposed via CLI flags defined in [`src/cli/mod.rs`](https://github.com/GyulyVGC/sniffnet/blob/main/src/cli/mod.rs), mapping directly to the configuration fields used by the GUI:

```bash

# Import a PCAP file for offline analysis

sniffnet --capture-source file --import-pcap-path my_capture.pcap

# Export captured traffic to a PCAP file during live monitoring

sniffnet --export-pcap --export-pcap-dir /tmp --export-pcap-name capture.pcap

```

These arguments populate the same `Conf` fields (`import_pcap_path` and `export_pcap`), ensuring identical runtime behavior whether you use the terminal or the graphical interface.

## Summary

- **Import workflow**: Set `Conf.import_pcap_path` via the UI or `--import-pcap-path`, which creates a `CaptureSource::File` and initializes a `pcap::Capture<pcap::Offline>` in `CaptureContext::new`.
- **Export workflow**: Enable `ExportPcap.enabled`, set the directory and filename using methods in [`src/gui/types/export_pcap.rs`](https://github.com/GyulyVGC/sniffnet/blob/main/src/gui/types/export_pcap.rs), then pass the result of `full_path()` to `CaptureContext::new` to create a `pcap::Savefile` attached to the live capture.
- **Key files**: Configuration lives in [`src/gui/types/conf.rs`](https://github.com/GyulyVGC/sniffnet/blob/main/src/gui/types/conf.rs), export logic in [`src/gui/types/export_pcap.rs`](https://github.com/GyulyVGC/sniffnet/blob/main/src/gui/types/export_pcap.rs), capture context management in [`src/networking/types/capture_context.rs`](https://github.com/GyulyVGC/sniffnet/blob/main/src/networking/types/capture_context.rs), and CLI parsing in [`src/cli/mod.rs`](https://github.com/GyulyVGC/sniffnet/blob/main/src/cli/mod.rs).
- **Persistence**: All paths and toggle states are stored in the `Conf` struct and persisted between sessions using `confy`.

## Frequently Asked Questions

### Can I export traffic when importing from an existing PCAP file?

No. Sniffnet only supports exporting when performing a live capture from a network device. The `CaptureContext::LiveWithSavefile` variant is only created for live sources, not for the `CaptureSource::File` used during import.

### What file formats does Sniffnet support for import?

Sniffnet supports standard **PCAP** and **PCAPNG** files through the underlying `pcap` library's offline capture functionality, which handles the file format specifics when creating `pcap::Capture<pcap::Offline>` in `CaptureContext::new`.

### Where does Sniffnet store the export configuration between sessions?

Export settings, including the enabled flag, directory path, and filename, are stored in the `ExportPcap` struct within `Conf`. This configuration is persisted to disk via `confy` in [`src/gui/types/conf.rs`](https://github.com/GyulyVGC/sniffnet/blob/main/src/gui/types/conf.rs), so your export preferences survive application restarts.

### Is there a performance penalty when exporting live captures?

The performance impact is minimal because the `pcap::Savefile` write operation is handled internally by the native pcap library during the standard packet consumption loop. The `LiveWithSavefile` branch in `CaptureContext::consume` writes packets directly without additional buffering in Rust, ensuring efficient I/O.