Hi,
It's probably due to the mime encoding specified on the server side - Safari tends to believe what it's told.
Assuming you're getting the file from wireshark.org, that download is reported as 'Content-Type: application/x-tar'
(Compare that to the gzipped tar file there which is correctly defined as 'application/x-gzip')
