User Guide

Files and Folders
215
cfilters This file contains all the capture filters that you have defined and
saved. It consists of one or more lines, where each line has the
following format:
"<filter name>" <filter string>
The settings from this file are read in at program start and written to
disk when you press the Save button in the "Capture Filters" dialog
box.
dfilters This file contains all the display filters that you have defined and
saved. It consists of one or more lines, where each line has the
following format:
"<filter name>" <filter string>
The settings from this file are read in at program start and written to
disk when you press the Save button in the "Display Filters" dialog
box.
colorfilters This file contains all the color filters that you have defined and
saved. It consists of one or more lines, where each line has the
following format:
@<filter name>@<filter string>@[<bg RGB(16-bit)>][<fg RGB(16-bit)>]
The settings from this file are read in at program start and written to
disk when you press the Save button in the "Coloring Rules" dialog
box.
disabled_protos Each line in this file specifies a disabled protocol name. The
following are some examples:
tcp
udp
The settings from this file are read in at program start and written
to disk when you press the Save button in the "Enabled Protocols"
dialog box.
ethers When Wireshark is trying to translate Ethernet hardware addresses
to names, it consults the files listed in Table A.1, “Configuration
files and folders overview”. If an address is not found in /etc/ethers,
Wireshark looks in $HOME/.wireshark/ethers
Each line in these files consists of one hardware address and name
separated by whitespace. The digits of hardware addresses are
separated by colons (:), dashes (-) or periods(.). The following are
some examples:
ff-ff-ff-ff-ff-ff Broadcast