In Wireshark, which action saves the payload bytes of a selected packet to a file?

• A. Export Packet Bytes
• B. Copy
• C. Save As
• D. Export Packet Data

Answer: (A)

Export Packet Bytes is the action you use when you want the exact sequence of bytes that make up the selected packet saved to a file. This exports the raw on-the-wire bytes for that frame, which inherently includes the payload portion as part of the packet. It’s the straightforward way to capture the real data carried by that packet for offline analysis or transfer.

The other options don’t deliver the raw packet bytes in the same way. Copy sends data to the clipboard, not a file. Save As is for saving the entire capture file (not just one packet’s bytes). Export Packet Data, depending on version, exports a representation of the data fields or a protocol payload in a format that isn’t guaranteed to be the exact raw byte sequence of the whole packet. So exporting the packets’ raw bytes best serves the goal of saving the payload bytes.