Ask Your Question

Is it possible to change temporary colors (1-10) to other colors and the draw packets color rules button behavior?

asked 2022-05-15 19:53:11 +0000

Hi all! I have a couple of questions and would appreciate any guidance.

  1. Is it possible to modify the default colors listed when choosing to colorize an item? I know you can make custom rules, but was curious if you could change the quick list options?

Reference image: Temporary Colors

  1. Is it possible to modify the behavior of the "draw packets using your coloring rules" button at the top in the items bar? Specifically, I was wondering if it could be modified to instead of disabling ALL colors, that it would disable YOUR coloring rules and leave the temporary ones (as referred to in my first question) still visible?

Reference Image: Button

edit retag flag offensive close merge delete


1 Answer

Sort by ยป oldest newest most voted

answered 2022-05-16 04:14:19 +0000

Chuckc gravatar image

Changing the colors is "lightly" documented in the WSDG ( set_color_filter_slot(row, text)):

The color list can be set from the command line using two unofficial preferences: and gui.colorized_frame.fg, which require 10 hex RGB codes (6 hex digits each), e.g.

wireshark -o${RGB0},${RGB1},${RGB2},${RGB3},${RGB4},${RGB5},${RGB6},${RGB7},${RGB8},${RGB9}
For example, this command yields the same results as the table above (and with all foregrounds set to black):

wireshark -o,ffc0ff,e0c0e0,c0c0ff,c0e0e0,c0ffff,c0ffc0,ffffc0,e0e0c0,e0e0e0 -o gui.colorized_frame.fg:000000,000000,000000,000000,000000,000000,000000,000000

The best solution to the second request (button disable/enable permanent rules) would be to open an Ehancement Request on the Wireshark Gitlab Issues page.

You could duct tape something together with Lua to add menu buttons to set a custom field on each packet. This custom field would need to be checked by each of the permanent colors rules (and foobar.color). Rescanning all the packets to set/clear the field each time might be too slow depending on the size of the capture files.

edit flag offensive delete link more


Thank you so much, Chuck! I had no idea it was even noted in the documentation! I made a simple batch file to apply the new colors - I assume there's no way to edit a config file somewhere to make it more permanent?

justah117 gravatar imagejustah117 ( 2022-05-16 17:03:23 +0000 )edit and gui.colorized_frame.fg and only used to override prefs.gui_colorized_bg and prefs.gui_colorized_fg which are always set to the default colors on startup (prefs.c).
If it's something you would want to change often, open an enhancement request to have them added to the regular preferences where they could be updated in the Wireshark gui.

Chuckc gravatar imageChuckc ( 2022-05-16 17:36:16 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2022-05-15 19:51:40 +0000

Seen: 162 times

Last updated: May 16 '22