User Guide

Files and Folders
202
• time references set with "Edit/Time Reference"
• the current display filter
• ...
A.2. Configuration Files and Folders
Wireshark uses a number of files and folders while it is running. Some of these reside in the personal
configuration folder and are used to maintain information between runs of Wireshark, while some of them
are maintained in system areas.
Tip
A list of the folders Wireshark actually uses can be found under the Folders tab in the dialog
box shown when you select About Wireshark from the Help menu.
The content format of the configuration files is the same on all platforms. However, to match the different
policies for Unix and Windows platforms, different folders are used for these files.
Table A.1. Configuration files and folders overview
File/Folder Description Unix/Linux
folders
Windows folders
preferences Settings from the
Preferences dialog
box.
/etc/
wireshark.conf,
$HOME/.wireshark/
preferences
%WIRESHARK%\wireshark.conf,
%APPDATA%\Wireshark\preferences
recent Recent GUI
settings (e.g.
recent files lists).
$HOME/.wireshark/
recent
%APPDATA%\Wireshark\recent
cfilters Capture filters. $HOME/.wireshark/
cfilters
%WIRESHARK%\cfilters, %APPDATA%
\Wireshark\cfilters
dfilters Display filters. $HOME/.wireshark/
dfilters
%WIRESHARK%\dfilters, %APPDATA%
\Wireshark\dfilters
colorfilters Coloring rules. $HOME/.wireshark/
colorfilters
%WIRESHARK%\colorfilters, %APPDATA
%\Wireshark\colorfilters
disabled_protos Disabled
protocols.
$HOME/.wireshark/
disabled_protos
%WIRESHARK%\disabled_protos,
%APPDATA%\Wireshark\disabled_protos
ethers Ethernet name
resolution.
/etc/ethers,
$HOME/.wireshark/
ethers
%WIRESHARK%\ethers, %APPDATA%
\Wireshark\ethers
manuf Ethernet name
resolution.
/etc/manuf,
$HOME/.wireshark/
manuf
%WIRESHARK%\manuf, %APPDATA%
\Wireshark\manuf
hosts IPv4 and IPv6
name resolution.
/etc/hosts,
$HOME/.wireshark/
hosts
%WIRESHARK%\hosts, %APPDATA%
\Wireshark\hosts
services Network services. /etc/services,
$HOME/.wireshark/
services
%WIRESHARK%\services, %APPDATA%
\Wireshark\services