This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I saved a capture and sent it on the colleagues, they are able to view it with the color rules. When I view the same capture file it does not show with color rules. What setting am I missing?

asked 07 Aug '12, 08:12

mgwolf13's gravatar image

mgwolf13
1111
accept rate: 0%


Either you do not have color rules defined (you might have deleted them all) or your Wireshark is set to not colorize packets. You can toggle colorization in the toolbar with a button - if you hover over the buttons with a mouse you'll see a hint, and for the colorization button it says "colorize packet list" - it should be visibly pushed "down".

You can check your color rule set by using the button saying "edit color rules" or by choosing "View" -> "Coloring Rules" in the menu. If your color rules are empty you can press the "Clear" button which does a funny thing... it doesn't clear anything (as the name would suggest) but restores the default rules (which I find pretty annoying, but that's just me...)

permanent link

answered 07 Aug '12, 08:24

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Jasper thank you for the quick response. I applied both of these and not showing color in the view of the saved capture. If I view live the colorize packets appear.

(07 Aug '12, 08:38) mgwolf13

Then I guess your saved capture holds no packets that match any colorization rule. You can open the frame section in the decode pane to see if any rule was matched.

I would try to create a test color rule where I'm sure it matches a packet in the capture, and try loading the file again to see if it works. Or you could compare your color filter set to the one of your coworkers to see which ones they have and why they match.

(07 Aug '12, 08:43) Jasper ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×549
×17
×15

question asked: 07 Aug '12, 08:12

question was seen: 7,605 times

last updated: 07 Aug '12, 08:43

p​o​w​e​r​e​d by O​S​Q​A