11.5. Preferences
Prev | Chapter 11. Customizing Wireshark | Next

## 11.5. Preferences

There are a large number of preferences you can set. Simply select the Edit → Preferences…​ (Wireshark → Preferences…​ on macOS) and Wireshark will pop up the Preferences dialog box as shown in Figure 11.6, “The preferences dialog box”, with the “Appearance” page as default. On the left side is a tree where you can select the page to be shown.

- The OK button will apply the preferences settings and close the dialog.

- The Cancel button will restore all preferences settings to the last saved state.

| Tip
You can also see a protocol’s preferences from the pop-up menus for the “Packet List” or “Packet Details” panes, by going to the Protocol Preferences menu item, which will pop open a sub-menu. The top entry in this new menu will take you to the Preferences dialog box as shown in Figure 11.6, “The preferences dialog box”, with the chosen protocol’s page showing. The final entry in this menu will completely disable the dissection of the chosen protocol. See Section 11.4.1, “The “Enabled Protocols” dialog box” for how to re-enable the protocol. Any other entries in this menu will let you quickly adjust individual preferences for this protocol without needing to open the full Preferences dialog box.

### 11.5.1. Appearance

These preferences give you the option to control the makeup of the GUI.

Figure 11.6. The preferences dialog box

Selecting Remember main window size and placement allow for a repeatable experience when restarting Wireshark.

Selecting Open files in allows you to determine where to start the file selection dialog when opening capture files.

The preference Show up to allows you to determine how much history is tracked for display filter entries and recent files shown in the main application window.

Selecting Confirm unsaved capture files causes a dialog to appear when closing a capture file when it was not yet saved. This may help preventing inadvertent loss of data, eg., when Wireshark is closed.

Selecting Display autocompletion for filter text causes a drop down list to appear when you enter a display filter. This drop down list contains known display filters for easy selection.

The preference Main toolbar style allows you to tailor the toolbar style in one of three ways.

The Wireshark main window title is replaced by the name of the opened capture file. The preferences Window title and Prepend window title allow you to add bracketed strings after and before the window title. These window title strings can contain variables which will be replaced by their respective values.

The following variables are available.

- %C = Capture comment from command line
- %F = File path of the capture file
- %P = Currently selected profile name
- %S = Conditional separator (dash) that only shows when surrounded by variables with values or static text
- %V = Wireshark version info

The Language preference allows you to select the language used in the GUI. Note that the protocol information and details are kept in the language commonly used in this field, that being English.

### 11.5.2. Columns

These preferences give you the option to control the definition of the columns shown in the packet list, once a capture file is loaded.

Figure 11.7. Column preferences

+
  Add new entry to the list.
-
  Remove the selected entry.

Selecting Show displayed columns only hides all non-displayed columns from the list, possibly making navigating the list easier.

The rows can be dragged and dropped to arrange them in the desired order.

The columns in the entries are as follows.

Selecting Displayed causes the column to be shown in the packet list.

The Title is the text shown in the header of the column in the packet list.

The Type is the type of value to be shown. This can be a predefined type, ie. a value in a defined format, or custom.

The following settings are applicable when the Type is set to "custom"

The Fields setting is the display filter name of the field to be shown in the column in the packet list.

The Field Occurrence setting is the count of the given field in the frame, for fields that appear more than once in a frame.

Selecting Resolved causes name resolution to be applied to the field value, when available.

The Width is the width of the column.

The Alignment is the alignment of the text in the column.

### 11.5.3. Layout

These preferences allow you to define the layout of the GUI once a capture file is loaded.

Figure 11.8. Layout preferences

Make sure that you have at least one pane configured to contain the Packet list. Three panes can be active at the same time and they can be laid out as shown in the top layer. The exact sizes of these panes can be changed as needed once a capture file is opened.

Selecting Show packet list separator causes the packet list entries to be slightly set apart, which may improve readability at the cost of the amount of packets shown in the packet list.

Selecting Show column definition in column context menu make the column context menu wider to show the currently configured field type for the column. This may help identify the column to select or modify.

Selecting Allow the list to be sorted enables the sort operator on all the columns. This may prevent inadvertently triggering a sort, which may take considerable time for larger capture files.

The Maximum number of cached rows setting determines how much packet list information is cached to speed up sort operations, where a larger number causes more memory to be consumed by the cache. Be aware that changing other dissection settings may invalidate the cache content.

Selecting Enable mouse-over colorization enables the highlighting of the currently pointed to packet in the packet list. The currently selected packet is always highlighted.

Selecting Show selected packet number adds the selected packet number to the capture file details in the status bar, taking up some space in the status bar.

Selecting Show file load time adds the time it took to load the capture file to the status bar, taking up some space in the status bar.

The button Restore Defaults allows you to get back to a working basic configuration.

### 11.5.4. Theme and Font

These preferences let you choose the application theme, the light or dark appearance mode, and the font used in the packet panes.

Figure 11.9. Theme and font preferences

The Main window font button opens a font chooser for the font used in the packet list, the packet details and the other packet panes. A mono spaced font usually gives the cleanest presentation, but a proportional font can be used as well. The sample text below the button previews the currently selected font.

The Appearance mode setting controls whether Wireshark uses a light or a dark color scheme. System follows the operating system setting, while Light and Dark force the respective scheme regardless of the system setting.

The Theme setting selects the color theme applied to the application. Themes bundle the colors used throughout the GUI — including the packet list selection, marked and ignored packets, the “Follow Stream” client and server text, and valid and invalid display filter highlighting — so these colors are no longer configured individually. When the selected theme declares an author, it is shown below the preview.

| Note
The individual color settings from earlier versions of Wireshark (for example marked and ignored packets, the “Follow Stream” client and server text, display filter validity, and the selected packet) have been removed. These colors now come from the selected theme.

The preview shows a mockup of a capture window rendered with the selected theme and appearance mode, so you can see how the combination will look before applying it. Changes to the appearance mode and theme take effect once you accept the preferences dialog with OK; the preview itself updates immediately as you try different combinations.

#### 11.5.4.1. Personal themes

In addition to the themes bundled with the application, Wireshark looks for user-supplied themes in a personal themes directory:

- On Unix-like systems: $HOME/.local/lib/wireshark/themes
- On Windows: %APPDATA%\Wireshark\themes

(For Stratoshark, replace wireshark / Wireshark with stratoshark / Stratoshark.)

Personal themes are single .jsonc files dropped directly into that directory — there is no per-theme subdirectory. The filename (without the .jsonc extension) becomes the theme’s internal name and is what appears in the Theme dropdown. For example, midnight.jsonc shows up as a selectable theme named midnight.

The exact path can also be seen under Help → About Wireshark in the Folders tab, labelled Personal Themes.

The file format is identical to the bundled themes; see the README.md next to the built-in default theme in the source distribution for the schema and the list of supported color tokens.

If a personal theme file shares a name with a built-in theme (for example default.jsonc), the built-in copy wins and the personal file is ignored with a warning on stderr. This guarantees that core themes the application falls back to can never be accidentally shadowed by a broken override.

### 11.5.5. Welcome Page

These preferences allow you to define the layout of the GUI welcome page, before a capture file is loaded.

### 11.5.6. Capture

These preferences allow you to set the default conditions for packet capture.

Figure 11.10. Capture preferences

The default interface is the interface used for packet capture in case no other is selected on the opening page of GUI. Note that this can be multiple interfaces separated by a comma.

Selecting Capture packets in promiscuous mode causes the network interface(s) to capture on to be configured in promiscuous mode. This allows all (Ethernet) frames to be received by the network interface to be capture, not only those that are addressed to the capture interface.

Selecting Capture packets in monitor mode on 802.11 devices causes the WiFi interface(s) to capture on to be configured in monitor mode. This allows all WiFi frames to be received by the WiFi interface to be captured, not only those that are addressed to the capture interface. Results may vary, depending on the actual capabilities of the operating system, the WiFi driver software and WiFi interface itself.

Selecting Capture packets in pcapng format causes the Next-Generation packet capture file format to be used when capturing. This much more capable packet capture file format has many advantages over the original format, although not every external tool may be capable of handling packet captures in this format.

Selecting Update list of packets in real time causes the packet list to fill up and possibly scroll up during the packet capture process. This does give an insight in the packets captured, although it takes processing power to dissect the capture packets.

The preference Interval between updates (ms) allows you to configure how often the packet list is updated during the packet capture process. A higher interval reduces processing, but causes more delay between capture and display in the packet list.

Selecting Don’t load interfaces on startup prevents Wireshark from spawning dumpcap to populate the list of capture interfaces on the local system. This might be a time consuming operation delaying the start of the program, however on most systems this is not an issue. The interface list can always be populated after Wireshark is started via Capture → Refresh Interfaces.

Selecting Disable external capture interfaces prevents Wireshark from spawning extcap programs to list off their capture interfaces. This might be a time consuming operation delaying the start of the program, however on most systems this is not an issue.

### 11.5.7. Aggregation Fields

These preferences allow you to configure the aggregation fields.

Figure 11.11. Aggregation fields preferences

The preference Aggregation fields lets you choose which packet fields Wireshark uses to group packets in the Aggregation View. Packets with the same frame key appear in the same row. For example, on a CAN bus, you can use the CAN ID as the frame key. This way, all frames with the same CAN ID are grouped together, and the Aggregation View will show the most recently received frame for each CAN ID.

+
  Add new entry to the list.
-
  Remove the selected entry.
Copy
  Copy the selected entry.
⌃
  Move the selected entry up in the list.
⌄
  Move the selected entry down in the list.
Clear
  Clear the list of user specified aggregation fields.
Copy from
  Copy the list of user specified aggregation fields from another profile.

### 11.5.8. Expert Items

These preferences allow you to modify the severity set for expert items.

Figure 11.12. Expert item preferences

If, for whatever reason, you find that the severity for certain expert items does not match your needs you can change them here and have them used as such, showing up in the appropriate lists and overviews. Get the Field name from selecting the field in the packet details pane, then observe the name shown in the status bar. This is the name you enter on a new line in the list, while setting the desired Severity in the next column.

+
  Add new entry to the list.
-
  Remove the selected entry.
Copy
  Copy the selected entry.
⌃
  Move the selected entry up in the list.
⌄
  Move the selected entry down in the list.
Clear
  Clear the list of user specified expert item severities.
Copy from
  Copy the list of user specified expert item severities from another profile.

### 11.5.9. Filter Buttons

Having quick access to regularly used display filter expressions can be a real productivity boost. Here you can define your own display filter buttons.

Figure 11.13. Filter buttons

+
  Add new entry to the list.
-
  Remove the selected entry.
Copy
  Copy the selected entry.
⌃
  Move the selected entry up in the list.
⌄
  Move the selected entry down in the list.
Clear
  Clear the list of user specified display filter buttons.
Copy from
  Copy the list of user specified display filter buttons from another profile.

The columns in the entries are as follows.

Selecting Show in toolbar causes the button to be shown in the toolbar besides the display filter text entry.

The Button Label is the text shown on the button in the toolbar. The use of a double slash causes the button to create a dropdown list to allow grouping of multiple buttons, e.g. TCP//Syn and TCP//Res.

The Filter Expression is the display filter expression entered into the display filter text entry when the button is clicked.

The Comment is the comment text which appears in a bubble when the mouse hovers over the button.

### 11.5.10. Name Resolution

These preferences allow you to configure which numeric identifiers in protocols are translated into human readable text. For some of these identifiers the readable texts are read from configurable external sources.

Figure 11.14. Name resolution preferences

Selecting Resolve MAC addresses causes the OUI (Organizationally Unique Identifier) at the start of an Ethernet address to be translated into the name registered with the IEEE for that OUI.

Selecting Resolve transport names causes the UDP and TCP port numbers to be translated into the service registered to these ports by IANA.

Selecting Resolve network (IP) addresses causes IPv4, IPv6 and IPX addresses to be translated into their corresponding host name. To do this Wireshark reaches out to DNS servers to request names for addresses it finds in packets. There are several ways to do this, which can be controlled through the following preferences.

Selecting Use captured DNS packet data for name resolution causes DNS response packets in the capture file to fill the network address resolution table. These can then be used to resolve addresses found in the packets.

Selecting Use SNI information from captured handshake packets causes TLS client hello packets with a Server Name Indication extension to fill the network address resolution table.

Selecting Use your system’s DNS settings for name resolution causes DNS requests to be made as would be for other network applications.

Selecting Use a custom list of DNS servers for name resolution causes DNS requests to be made to manually configured DNS servers.

The DNS Servers Edit…​ button provides access to the dialog to manage these manually configured DNS servers.

The Maximum concurrent requests input field allows you to limit the amount of DNS queries made at the same time.

Selecting Resolve VLAN IDs causes the file "vlans" to be read and used to name VLANs. This file has the simple format of one line per VLAN, starting wit VLAN ID, a tab character, followed by the name of the VLAN.

Selecting Resolve SS7 PCs causes the file "ss7pcs" to be read and used to name SS7 Point Codes. This file has the simple format of one line per Point Code, starting with Network Indicator, a dash, the Point Code in decimal, a tab character, followed by the name of the Point Code.

Selecting Enable OID resolution causes the SMI library to be initialized. This library is capable of loading MIB/PIB files to provide name resolution for SMI objects, as present in SNMP packets.

Selecting Suppress SMI errors prevents the SMI library from emitting error messages while loading MIB/PIB files. The SMI library is very sensitive to irregularities in these files often resulting in harmless error being emitted.

The SMI (MIB and PIB) paths Edit…​ button provides access to the dialog to manage the directories where the MIB/PIB files to be loaded can be found.

The SMI (MIB and PIB) modules Edit…​ button provides access to the dialog to manage the MIB/PIB modules to be loaded.

Selecting Enable IP geolocation causes the background MaxMind database IP geolocation resolver to be used to attempt to geolocate IP addresses in the packets.

The MaxMind database directories Edit…​ button provides access to the dialog to manage the directories where the MaxMind database files can be found. See Section 11.9, “MaxMind Database Paths”.

### 11.5.11. Protocols

Wireshark supports quite a few protocols, which is reflected in the long list of child entries of the “Protocols” pane. You can jump to the preferences for a specific protocol by expanding “Protocols” and typing the first few letters of the protocol name.

Figure 11.15. Protocol preferences

There are a few general protocol related preferences, listed below.

Selecting Display hidden protocol items influences what is shown in the packet details pane of the packet selected from the packet list. Some protocol dissectors add hidden protocol items that provide additional interpretations of the packet data, or with different display filter strings. These may or may not provide valuable information to the user and may clutter the output, therefor these items can be hidden.

Selecting Display byte fields with a space character between bytes influences the way a byte field in shown in the packet details pane of the packet selected in the packet list, if the dissector creates a byte field that is. The bytes in the byte field are normally shown as a concatenated sequence of hexadecimals. This preference allows you to get the representation of each byte separated by a space. This may improve readability of the individual bytes in the byte field.

The preference Format absolute times like asctime allows you to define how absolute times are formatted, in the columns and in the protocol tree. Either in the old format used in previous Wireshark versions, or using the more unambiguous method defined in ISO 8601.

Selecting Look for incomplete dissectors causes expert items to be added to the dissection of packet data for which the dissector does not create an interpretation. Dissectors should strive to not skip packet bytes and this preference allows you to be made aware of this.

Selecting Enable stricter conversation tracking heuristics allows dissectors to take more identifiers into consideration when creating "conversations". These are used to track related packets. The heuristics for these conversations are sensitive to mis-identification of packets, possibly corrupting conversation analysis. Adding more identifiers can reduce the change of this happening. Currently only the IPv4, ICMP and ICMPv6 dissector use this preference.

Selecting Ignore duplicate frames causes a duplicate frame to appear in the packet list, but flagged as ignored, hence not dissected. The determination of a duplicate frame is made based on the SHA256 hash of the bytes in the frame.

The preference Deinterlacing conversations key gives you options for deinterlacing the conversations, for the Ethernet encapsulation only. As opposed to hardware duplicates which show absolutely similar frames, capture duplicates are the consequence of the capture method (capture on multiple interfaces for example) and show similar payloads with one or more different fields. While NONE keeps the historical behaviour, the other options are built on three keys with the following meanings: V (VLAN), M (MAC Address), I (Interface). The presence of packets which seem to be duplicates because they have the same payload but aren’t filtered by the other preference Ignore duplicate frames, is a strong indication that a deinterlacing key is likely to change the interpretation. Check carefully the different values of Interface IDs, MAC Addresses, and VLAN Tags, to identify which deinterlacing key is appropriate for isolating the conversations and bringing the proper interpretation, but keep in mind that capturing on different interfaces or VLANs doesn’t necessarily mean that deinterlacing is needed.

When the deinterlacing key has any impact on the dissection, either the IPv4/IPv6 tabs of the Conversations dialog or the tuple values related to Ethernet or IPv4/IPv6 in the Conversation Hash Tables dialog will make this obvious (protocols supporting multiple incarnations of a connection such as TCP are harder to interpret and then rather not checked first).

The preference The max number of hashes to keep in memory for determining duplicate frames allows you to set how large the set of frames to consider for duplication is.

### 11.5.12. RSA Keys

For more information see https://wiki.wireshark.org/TLS.

Figure 11.16. RSA keys

### 11.5.13. Statistics

These preference have influence on the Statistics Tree (stats_tree) based dialogs accessible via the Statistics menu.

Figure 11.17. Statistics preferences

The preference Tap update interval in ms allows you to set how quickly protocol taps are being updated, partially determining the update speed of various dialogs and graphs.

The preference Maximum Flow Graph items to export as image allows you to set how dense or expansive the exported graph may become.

Selecting Enable the calculation of burst information allows the Statistics Tree system to calculate burst information.

Selecting Show burst count for item rather than rate allows the statistics nodes to show the count of events within the burst window instead of a burst rate. Burst rate is calculated as number of events within burst window divided by the burst window length.

The preference Burst rate resolution (ms) sets the duration of the time interval into which events are grouped when calculating the burst rate. Setting a higher resolution (ie., a smaller number) increases processing overhead.

The preference Burst rate window size (ms) sets the duration of the sliding window during which the burst rate is measured. Longer window relative to burst rate resolution increases processing overhead. This value will be truncated to a multiple of the Burst rate resolution preference setting.

The preference Default sort column for stats_tree stats gives you to option to select one of the columns to sort on.

Selecting Default stats_tree sort order is descending causes a descending sort order based on the previously selected column.

Selecting Case sensitive sort of stats_tree item names causes a case sensitive sort based on the previous selected order and column.

Selecting Always sort 'range' nodes by name causes the sort to take place by name rather than values.

Selecting Always sort 'range' nodes in ascending order makes an exception for range nodes to the previously selected sort order.

Selecting Display the full stats_tree plug-in name causes the full menu path of the Statistics Tree plugin to be shown in the title.

The preference Default output format allows you to select how you want the statistics to be saved by default, either as plain text or some structured format.

### 11.5.14. Advanced

The “Advanced” pane will let you view and edit all of Wireshark’s preferences, similar to about:config and chrome:flags in the Firefox and Chrome web browsers.

Figure 11.18. Advanced preferences

You can search for a preference by typing text into the “Search” entry. The search text will be matched against the internal name of the preference, but also associated help texts in order to improve discoverability.

Selecting Show changed values restricts the list to settings having non-default values. This may help finding what has changed more easily.

You can also pass preference names to Wireshark and TShark on the command line. For example, the gui.prepend_window_title can be used to differentiate between different instances of Wireshark on your screen:

    $ wireshark -o "gui.prepend_window_title:LAN" &
    $ wireshark -o "gui.prepend_window_title:External Network" &

For more information, including how to specify a User Accessible Table entry on the command line, see the documentation for `-o` in Section 11.2, “Start Wireshark from the command line”.

Prev | Up | Next
11.4. Control Protocol Dissection | Home | 11.6. Configuration Profiles