Feature request: Dynamic Colorization Rules
EDIT: Discussion now taking place on Gitlab https://gitlab.com/wireshark/wireshark/-/issues/19802
Background:
So it took me forever to google the correct way to change the "active selected item" coloring rule. Turns out it's in the preferences area under fonts & color. Seems rather obvious now, but that something this basic was so hard to find on google seems like there needs to be something somewhere in the manual about how to do it. That said, seeing where the selected item coloring was, and how it worked when changed, left me disappointed at what I found.
In learning about Display filters I was intrigued by the ability to use field references. Because of the project I'm currently working on for school I am particularly interested in seeing conversations taking place easily and following them quickly. To help with that I created a filter button with "tcp.stream == ${tcp.stream}" as the expression. It works great. With the push of a button the packet list is re-filtered to show just the packets that are a part of the currently selected packet's conversation.
Knowing that the coloring rules use the same criteria as the display filters I immediately wanted to create a rule that did visually the same thing as but button I had just created. I tried to create a coloring rule at the top of my list with the criteria: "tcp.stream == ${tcp.stream}", but unfortunately it didn't do anything. I learned that the coloring rules are applied as a "pre-filter" to all of the packets before they are displayed, so a dynamically referenced field doesn't have anything selected to reference. Even if a packet is selected at the time you hit "ok" in the color rules dialog box, the coloring is applied before focus has been passed back to the packet list, so the dynamic rule still doesn't even "sort of" work.
The Idea:
I'm sure I'm not the only one who thinks it would be awesome to have Dynamic coloring rules that are applied each time you select a packet in the packet list. In my case I think I would be awesome to be able to assign "tcp.stream == ${tcp.stream}" to the "selected item" property so that as I move through the packets the rest of the conversation is instantly highlighted (and stays highlighted as part of the "inactive selected" state).
Even better would be if there was a Dynamic Color Filter bar above the display filter bar (perhaps toggle-able. not everyone would want to see it or use it) where we could put in on the fly a new coloring rule. This would be especially handy on larger pcaps where re-filtering the packet list takes longer than desired.
I can see this being handy for those who like to run without any present color filters. They could define a single filter on the fly to instantly hone in on what they are looking for without ...
The enhancement request was raised in GitLab as: https://gitlab.com/wireshark/wireshar...
Yeah, I posted it there with a little more refinement after I saw in other questions that gitlab was the proper place to make requests. I meant to come back here and link it myself, but it was 4am so it slipped my mind :)