Ok, our next module will be on colorizing.
So, colorizing is an option
that you have within Wireshark.
It's not the most glamorous option
available within Wireshark but
it's definitely helpful. It's good for when
you want to customize your data.
Or I should say, the data that you're
shown in the capture window.
And it's very, very helpful for when you want
to specifically target data that you know about.
So, why do we set up coloring rules?
Ease of use - you want to basically get in.
You want to set up Wireshark in a way
where when you start troubleshooting data,
specific data, like for example,
tracking a conversation is brought
to the fore front to view.
A lot of times we are creatures
that we see things, we react to them.
So that when you see something, for example
that is very bold and colorful,
or stands out to you or you configure it
to do so, you can quickly view it
and start drilling down into it.
So essentially, that's one of the major reasons.
Other reasons is that you may have
data that you want to separate.
So for example, if you have ethernet,
and you have multiple frame types
or something of that nature, you may want
to highlight them with colors.
You may want to dissect
specific things in your capture
to show up in a certain way where
if you saw them, if you did not colorize
some of it, you may miss it.
It may be confusing to you.
So, that's essentially why you're going
to set up coloring rules.
So, just so you know, obviously when you
install Wireshark, there's a default set,
default set of colors or coloring rule
that are in use and a lot of them
are things that you've probably
commonly seen if you've used Wireshark.
Generally, something show up
when the Expert flags it.
It will show up as a certain color
so that you know that it was flagged.
But particularly, there's 2 major
components of the rule.
And that's things that are set up permanently,
and things that are set up temporarily.
So, when you open up your capture,
you may want to say, just for this session,
or just for this capture,
I want to just flag this in particular in this color.
So you can go in and do that.
And then there's more permanent things
that you may want to always leave
status quo. So there's many ways to colorize.
There are dialog box options.
So you could go into the dialog box
as well as the context menu
In this section here, you will see the,
the dialogue box, the coloring rule.
So there's a lot of different things
you can do here.
So, as an example, one of the things that
we want to look at is the,
how the list is processed
so that you can order these.
It's, it's kind of like an ACL.
It goes from top down and you can move
things up higher for processing.
And you can move them down
based on your filter selection.
Other things you can do is
you can create new filters.
You can edit pre-existing.
You can enable and disable.
And you can delete them completely.
So, these are just some of the different
things that you can do within
the Wireshark coloring rules.
What's nice about them is that you can
import things that are online.
Some of them are already pre-configured
on wireshark.org.
So if you go up on the website,
you can find specifically that there are,
there are ones that are already pre-configured,
specific settings that you may already
want to see and you can import them here
so that you can use them.
You can also export ones that you've built,
as well, and give them to others.
So with temporary, it's quick and easy.
It's accessed from the toolbar menu.
Wireshark coloring rules dialog box or the
contect menu within the capture window.
They'll be, is removed as soon as
you load another profile.
So, the thing with temporary is it's exactly
that you go in, you set up, let's say,
you wanted a file of conversation very quickly,
you colorize it temporarily, you do your filtering,
there it is and you're done.
With permanent, it's going to be saved
to the profile for later use.
So this hearkens to what we're talking about,
about working quickly and efficiently.
There may be a profile you want to set up or
you can set up some more permanent
coloring rules.
You configure them how you've always
want to see them within the profile.
And you save them for future use.
As you can see here, you can name them.
Set up regular expressions,
specifically on what you want to filter.
Set up your colors, so you can go to
foreground and background colors.
Essentially, the background will be
the highlight color in the back.
And the foreground color will be
specifically the wording that you see.
And you can quickly disable
in here if you need to.