In this lecture I will explain about how to work with colouring rules and how to save bucket cultures.
So here we see that the sign by Gates is that we have configured the display 54 in the pages various
lecture have the color of grey.
And this is because you go to the colouring rules.
We see that DTV sign and thin packets have this color by default in white shark and we see other coloring
groups and these coloring rules help us to distinguish specific types of packets within our cultures.
So what we want to create our own.
You can click here and then for example I will search for you we dot port
53 which is the port of DNS so we search for the S packets and then you will set the foreground to be
read and the background color to be blue and I have to enable this rule.
Then I will say okay then I care.
So here we see these packets of DNS that are colorized with our colouring rule and we know that DNS
packets are usually packets and we see here that we have BBB packets to be discolored but because the
DNS rule is the first line then it takes precedence.
So coloring rules are working like an access list so the first ones to presidents over the ones at the
bottom so we have to put the most specific ones theirs and the most general ones at the bottom so I
moved the Dennis rule here and then click OK.
We see that
packets belong now to the colouring rule of UDP
we went and able to hold a few dv you see that the rule we have configured.
He's working again and we can also colorized composition for sure.
So for example if I want to colorized this composition I can click on color eyes composition and then
TCB and I can select an existing color or create one.
So we call that Amber
version
and here we see that the colouring rule has the same syntax of spelling filter.
So now we forget the cars only to select yellow and red so when we search for buckets.
This composition was different.
OK so now we see this like it s and you can configure actor for compositions also so for example for
this composition you same composition I can configure a complete composition so leave it there.
So here we see the packets that belongs to these composition and in white shark we can also ignore and
ignore buckets.
And also we can Mark Hurd and Mark buckets.
So for example I marked these two buckets and then came later to compare them so I will fully care spec
it and on the second put them side by side for comparison and if I want to save if I could capture us
I can go to the File menu and then click on Save us.
But that will save the whole catch up so all the brackets capture.
But what if I want to say the specific packets I can use the export features or export specific specific
packets.
And here we see that we can save the all captured buckets or just need split once and we can also save
selected packets market buckets the buckets between the first and last one marked or specific range.
And also we can remove ignore packets and here we see that the default format of saving packet capture
is the pick up easy which is the recommended format of saving packet captures because it saves also
the interfaces for capturing and the comments we write in so here in this lecture I have explained how
to work with colouring rules which is it modified or another type of display filter and we have seen
how to save or export packet captures.