User Guide

A.2. Configuration Files and Folders
Wireshark uses a number of files and folders while it is running. Some of these reside in the person-
al configuration folder and are used to maintain information between runs of Wireshark, while some
of them are maintained in system areas.
Tip
A list of the folders Wireshark actually uses can be found under the Folders tab in the
dialog box shown when you select About Wireshark from the Help menu.
The content format of the configuration files is the same on all platforms. However, to match the
different policies for Unix and Windows platforms, different folders are used for these files.
Table A.1. Configuration files and folders overview
File/Folder Description Unix/Linux
folders
Windows folders
preferences Settings from the
Preferences dialog
box.
/
etc/wire-
shark.conf,
$HOME/.wireshar
k/preferences
%WIRESHARK%\wireshark.conf,
%APPDATA%\Wireshark\preferences
recent Recent GUI set-
tings (e.g. recent
files lists).
$HOME/.wireshar
k/recent
%APPDATA%\Wireshark\recent
cfilters Capture filters. $HOME/.wireshar
k/cfilters
%WIRESHARK%\cfilters,
%APPDATA%\Wireshark\cfilters
dfilters Display filters. $HOME/.wireshar
k/dfilters
%WIRESHARK%\dfilters,
%APPDATA%\Wireshark\dfilters
colorfilters Coloring rules. $HOME/.wireshar
k/colorfilters
%WIRESHARK%\colorfilters,
%APPDATA%\Wireshark\colorfilters
dis-
abled_protos
Disabled proto-
cols.
$HOME/.wireshar
k/disabled_protos
%WIRESHARK%\disabled_protos,
%APPDATA%\Wireshark\disabled_prot
os
ethers Ethernet name res-
olution.
/etc/ethers,
$HOME/.wireshar
k/ethers
%WIRESHARK%\ethers,
%APPDATA%\Wireshark\ethers
manuf Ethernet name res-
olution.
/etc/manuf,
$HOME/.wireshar
k/manuf
%WIRESHARK%\manuf,
%APPDATA%\Wireshark\manuf
hosts IPv4 and IPv6
name resolution.
/etc/hosts,
$HOME/.wireshar
k/hosts
%WIRESHARK%\hosts,
%APPDATA%\Wireshark\hosts
services Network services. /etc/services,
$HOME/.wireshar
k/services
%WIRESHARK%\services,
%APPDATA%\Wireshark\services
subnets IPv4 subnet name
resolution.
/etc/subnets,
$HOME/.wireshar
k/subnets
%WIRESHARK%\subnets,
%APPDATA%\Wireshark\subnets
ipxnets IPX name resolu-
tion.
/etc/ipxnets,
$HOME/.wireshar
k/ipxnets
%WIRESHARK%\ipxnets,
%APPDATA%\Wireshark\ipxnets
plugins Plugin directories. / %WIRESHARK%\plugins\<version>,
Files and Folders
235