I am certified SNSA (Sonicwall) and work with Sonicwall everyday for a MSP, we only use the libpcap w/wireshark as it is the most detailed and IMO easiest to work with. You can filter streams and the best tool used for sniffing network traffic, again IMO.
All of the data packets thats captured, gets stored in memory then presented on the screen, or in html format via browser, or text via notepad, or App Data which will only show you the application data and skip presenting packets that doesn't have any Layer 7 data such as a ping.
Export As :
Display or save a snapshot of the current buffer in the file format that you select from the drop-down list. Saved files are placed on your local management system (where the management interface is running). Choose from the following formats:
•
Libpcap - Select Libpcap format if you want to view the data with the Wireshark (formerly Ethereal) network protocol analyzer. This is also known as libcap or pcap format. A dialog box allows you to open the buffer file with Wireshark, or save it to your local hard drive with the extension .pcap .
•
Html - Select Html to view the data with a browser. You can use File > Save As to save a copy of the buffer to your hard drive.
•
Text - Select Text to view the data in a text editor. A dialog box allows you to open the buffer file with the registered text editor, or save it to your local hard drive with the extension .wri .
•
App Data - Select App Data to view only application data contained in the packet. Packets containing no application data are skipped during the capture. Application data = captured packet minus L2, L3, and L4 headers.
