Hi Jens,
You typically use offline capturing on a very heavily loaded network. In this mode, packets are directly streamed to disk (a temporary file) as they are captured. If you stop the capture, the captured packets are read back and displayed in Unsniff. The temporary file is then automatically deleted.
The captured packets are saved in the windows temp folder (to find out the location, open a DOS prompt and type echo %TEMP% )
We dont recommend you change the temp folder unless you are running out of disk space, but if you want to do it use the \"Tools->Customize->Capture\" dialog. Check the \"Custom Temp Folder\" and select another folder.
Regards,