User Guide

Customizing Wireshark
160
Profile name: You can change the name of the currently selected profile here.
Used as a folder name
The profile name will be used as a folder name in the
configured "Personal configurations" folder. If adding
multiple profiles with the same name, only one profile
will be created.
Illegal characters
On Windows the profile name cannot start or end with
a period (.), and cannot contain any of the following
characters: \ / : * ? " < > |
On Unix the profile name cannot contain the '/' character.
OK This button saves all changes, applies the selected profile and closes
the dialog.
Apply This button saves all changes, applies the selected profile and keeps
the dialog open.
Cancel Close this dialog. This will discard unsaved settings, new profiles will
not be added and deleted profiles will not be deleted.
Help Show this help page.
10.7. User Table
The User Table editor is used for managing various tables in wireshark. Its main dialog works very
similarly to that of Section 10.3, “Packet colorization”.
10.8. Display Filter Macros
Display Filter Macros are a mechanism to create shortcuts for complex filters. For example defining a
display filter macro named tcp_conv whose text is ( (ip.src == $1 and ip.dst == $2 and tcp.srcport ==
$3 and tcp.dstport == $4) or (ip.src == $2 and ip.dst == $1 and tcp.srcport == $4 and tcp.dstport ==
$3) ) would allow to use a display filter like ${tcp_conv:10.1.1.2;10.1.1.3;1200;1400} instead of typing
the whole filter.
Display Filter Macros can be managed with a Section 10.7, “User Table” by selecting Analyze
→
Display
Filter Macros from the menu. The User Table has the following fields
Name The name of the macro.
Text The replacement text for the macro it uses $1, $2, $3, ... as the input arguments.
10.9. ESS Category Attributes
Wireshark uses this table to map ESS Security Category attributes to textual representations. The values
to put in this table are usually found in a XML SPIF, which is used for defining security labels.