Colorize your packet list for fast diagnosis and troubleshooting

 

One of the great things about Wireshark is the completely customizable interface. Users can change the layout, column settings, protocol decode options, add/remove buttons, change colors, add/remove filters, and more. There is a lot of documentation on how to even write new protocol dissectors. Due to its open source nature and the active development community, one can modify the code and/or participate in its official development. What this means is no two instances of a Wireshark install have to be the same. Analysts can mold the tool into exactly what they need for their particular job. This is all done through the use of profiles.

 

In fact, a single install can have multiple profiles. This is useful to tailor different profiles to specific protocols or troubleshooting scenarios. For example, one profile could be used for troubleshooting web traffic and another could be used for diagnosing wireless issues. I currently have about 10 profiles ranging from a minimalist view to one specifically for analyzing the TCP handshakes to other protocol and scenario-based profiles. This is useful in a role where I don’t know what the next problem might require. I do have a single “go to” profile though that I typically use first and for all of my general troubleshooting. Here are some of the items that are modified in that profile:

 

The Title Bar

Make it look more official!
Make it look more official! (edit this in the preferences file)

Columns

View important information quickly
View important information quickly (TCP Delta is a must!)

Macros

Apply filters instantly
Apply filters instantly

Display Filters

View configured display filters quickly
View configured display filters quickly

Coloring Rules

Colorize your packet list view for quick troubleshooting
Colorize your packet list view for quick troubleshooting

IO Graph Filters

Return to previously used IO Graph filters
Return to previously used IO Graph filters

 

Do you currently use Wireshark profiles? If so, please leave a comment and let me know how you use them. It’s always interesting to learn how others modify their setup.

 

Further Resources:

  • To grab a copy of the profile shown above and learn how to share your profiles, click here.
  • To learn how to sync your profiles across multiple devices, check out this post.
  • CloudShark also allows for many of these customizations as a default user setting and per capture setting.

2 Comments

Leave a Reply