This is our old Q&A Site. Please post any new questions and answers at


in my wireshark on windows 7 (Version 2.2.4 (v2.2.4-0-gcc3dc1b))I can no longer change the coloring rules. If I open the configuration dialog I can add, change and delete rules but after clicking OK there is a message: "wireshark doesn't recognize one or more of your coloring rules They have been disabled" Is there any way to remove all coloring rules (e.g. by deleting a file). Reinstalling wireshark doesn't help because coloring rules stay the same.

Thanks Ben

asked 24 Jan '17, 08:46

Ben_texxxas's gravatar image

accept rate: 0%

closed 24 Jan '17, 09:04

grahamb's gravatar image

grahamb ♦

There are a number of previous questions on this subject:

(24 Jan '17, 09:04) grahamb ♦

All of the previous questions are answered with "just make the rules valid". BUT I am not able to edit my rules. I can not delete them or anything. So I can not make them valid. I am totally stuck on the rules I have configured years ago...

(25 Jan '17, 03:44) Ben_texxxas

The answer, and the comment by @sindy in the third question I linked to contains the info you require. Use a text editor, such as notepad if you have nothing else available, to manually edit the cfilters file in the profile directory.

(25 Jan '17, 04:38) grahamb ♦

The question has been closed for the following reason "Duplicate Question" by grahamb 24 Jan '17, 09:04

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 24 Jan '17, 08:46

question was seen: 1,119 times

last updated: 25 Jan '17, 04:38

p​o​w​e​r​e​d by O​S​Q​A