Columns and Coloring

Default Columns

The packet list ships with seven columns. Each is a column type, not a field, which is why some of them cannot be filtered on directly.

Ctrl+Shift+R resizes every column to its content, which is slow on a large file. Drag a header to reorder, right-click a header to hide a column without deleting it, and right-click → Column Preferences to edit the whole set.

Add a Custom Column

The fast way: click the field in the packet detail pane, right-click, then Apply as Column. The field name goes in as a Custom column and the column appears immediately.

Manual route, Preferences → Appearance → Columns → +, set Type to Custom and Fields to a display-filter field. A few field names in one column, separated by or, render the first one that exists in the frame.

Occurrence matters for fields that repeat. Occurrence 0 prints every occurrence comma-separated, 1 prints the first, 2 the second, -1 the last. Setting ip.addr occurrence to 1 gives you the source and 2 the destination.

The same expression works headless, which is how you get a CSV out:

tshark -r cap.pcapng -T fields -E header=y -E separator=, \
  -e frame.number -e frame.time_relative -e ip.src -e ip.dst \
  -e tcp.stream -e _ws.col.info \
  -Y "tcp.flags.reset == 1"

Time Display

View → Time Display Format changes the Time column without touching the data.

Precision is a separate submenu, from Automatic down to nanoseconds. pcapng can carry nanosecond timestamps, classic pcap cannot.

Ctrl+T sets a time reference on the selected packet, so relative time restarts from zero there. That is the cheapest way to measure a transaction without arithmetic.

Coloring Rules

View → Coloring Rules is an ordered list. The first matching rule wins, so order is the whole game. Each rule is a display filter plus a foreground and background color, and the set is stored in the colorfilters file in your profile.

The shipped set, in order, so you can read a packet's color without looking it up:

Two things fall out of the order. Anything red is a problem the dissector found, and DNS has no rule of its own, so plain DNS is colored by the UDP rule at 19.

Useful rules to add, near the top so they win:

tcp.analysis.zero_window or tcp.analysis.window_full
http.response.code >= 500
tls.record.content_type == 21
dns.flags.rcode != 0
tcp.time_delta > 1 and tcp.len > 0
ip.addr == 10.0.0.5

Other coloring controls:

- View → Colorize Conversation paints one conversation in one of ten temporary colors, at the Ethernet, IP, TCP, or UDP level. Handy for eyeballing interleaved streams without filtering them apart. - View → Colorize Packet List toggles all coloring. Off is measurably faster on huge files. - Disable a rule with its checkbox instead of deleting it. - Export the rule set and share it. It is a plain text file, one rule per line, formatted @Name@filter@[fg][bg] with 16-bit RGB components. - frame.coloring_rule.name and frame.coloring_rule.string are real fields, so you can filter on which rule matched, or add them as a column.

Profiles

A configuration profile bundles columns, coloring rules, filters, preferences, and decode-as settings. Edit → Configuration Profiles (Ctrl+Shift+A), or click the profile name in the bottom-right of the status bar.

# Where profiles live
ls ~/.config/wireshark/profiles/            # Linux
ls ~/.config/wireshark/                     # global files: colorfilters, preferences, dfilters
ls "~/Library/Application Support/Wireshark/profiles/"   # macOS

# Run tshark with a named profile
tshark -C "TCP tuning" -r cap.pcapng

Keep one profile per job. A "TCP performance" profile with stream, delta, RTT, and window columns plus aggressive Bad-TCP coloring looks nothing like a "DNS" profile with query name, rcode, and response time, and switching beats re-editing columns.

Files inside a profile directory: