I saved a capture and sent it on the colleagues, they are able to view it with the color rules. When I view the same capture file it does not show with color rules. What setting am I missing? asked 07 Aug '12, 08:12  mgwolf13 |
One Answer:
Either you do not have color rules defined (you might have deleted them all) or your Wireshark is set to not colorize packets. You can toggle colorization in the toolbar with a button - if you hover over the buttons with a mouse you'll see a hint, and for the colorization button it says "colorize packet list" - it should be visibly pushed "down". You can check your color rule set by using the button saying "edit color rules" or by choosing "View" -> "Coloring Rules" in the menu. If your color rules are empty you can press the "Clear" button which does a funny thing... it doesn't clear anything (as the name would suggest) but restores the default rules (which I find pretty annoying, but that's just me...) answered 07 Aug '12, 08:24  Jasper ♦♦ |
Jasper thank you for the quick response. I applied both of these and not showing color in the view of the saved capture. If I view live the colorize packets appear.
Then I guess your saved capture holds no packets that match any colorization rule. You can open the frame section in the decode pane to see if any rule was matched.
I would try to create a test color rule where I'm sure it matches a packet in the capture, and try loading the file again to see if it works. Or you could compare your color filter set to the one of your coworkers to see which ones they have and why they match.