One of the great things about Wireshark is the completely customizable interface. Users can change the layout, column settings, protocol decode options, add/remove buttons, change colors, add/remove filters, and more. There is a lot of documentation on how to even write new protocol dissectors. Due to its open source nature and the active development community, one can modify the code and/or participate in its official development. What this means is no two instances of a Wireshark install have to be the same. Analysts can mold the tool into exactly what they need for their particular job. This is all done through the use of profiles.

In fact, a single install can have multiple profiles. This is useful to tailor different profiles to specific protocols or troubleshooting scenarios. For example, one profile could be used for troubleshooting web traffic and another could be used for diagnosing wireless issues. I currently have about 10 profiles ranging from a minimalist view to one specifically for analyzing the TCP handshakes to other protocol and scenario-based profiles. This is useful in a role where I don’t know what the next problem might require. I do have a single “go to” profile though that I typically use first and for all of my general troubleshooting. Here are some of the items that are modified in that profile:

The Title Bar

The title bar. Make it look more official!

Columns

View important information quickly
View important information quickly (TCP Delta is a must!)

Macros

Web macros
Apply filters instantly

Display Filters

Display filters
View configured display filters quickly!

Coloring Rules

Colorize your packet list view for quick troubleshooting
Colorize your packet list view for quick troubleshooting

IO Graph Filters

Return to previously used IO Graph filters

Do you currently use Wireshark profiles? If so, please leave a comment and let me know how you use them. It’s always interesting to learn how others modify their setup.

Further Resources:

  • To grab a copy of the profile shown above and learn how to share your profiles, click here.
  • To learn how to sync your profiles across multiple devices, check out this post.
  • CloudShark also allows for many of these customizations as a default user setting and per capture setting.

2 Comments

Leave a Reply

Your email address will not be published. Required fields are marked *