The wireshark documentation says that these paths are traversed:
http://www.wireshark.org/docs/wsug_html_chunked/ChAppFilesConfigurationSection.html