Is it possible to change temporary colors (1-10) to other colors and the draw packets color rules button behavior?

Hi all! I have a couple of questions and would appreciate any guidance.

Is it possible to modify the default colors listed when choosing to colorize an item? I know you can make custom rules, but was curious if you could change the quick list options?

Is it possible to modify the behavior of the "draw packets using your coloring rules" button at the top in the items bar? Specifically, I was wondering if it could be modified to instead of disabling ALL colors, that it would disable YOUR coloring rules and leave the temporary ones (as referred to in my first question) still visible?

Reference Image: Button

Comments

Changing the colors is "lightly" documented in the WSDG (11.3.3.11. set_color_filter_slot(row, text)):

The color list can be set from the command line using two unofficial preferences: 
gui.colorized_frame.bg and gui.colorized_frame.fg, which require 10 hex RGB codes (6 hex digits each), e.g.

wireshark -o gui.colorized_frame.bg:${RGB0},${RGB1},${RGB2},${RGB3},${RGB4},${RGB5},${RGB6},${RGB7},${RGB8},${RGB9}
For example, this command yields the same results as the table above (and with all foregrounds set to black):

wireshark -o gui.colorized_frame.bg:ffc0c0,ffc0ff,e0c0e0,c0c0ff,c0e0e0,c0ffff,c0ffc0,ffffc0,e0e0c0,e0e0e0 -o gui.colorized_frame.fg:000000,000000,000000,000000,000000,000000,000000,000000

The best solution to the second request (button disable/enable permanent rules) would be to open an Ehancement Request on the Wireshark Gitlab Issues page.

You could duct tape something together with Lua to add menu buttons to set a custom field on each packet. This custom field would need to be checked by each of the permanent colors rules (and foobar.color). Rescanning all the packets to set/clear the field each time might be too slow depending on the size of the capture files.

Chuckc

answered 2022-05-16 04:14:19 +0000

edit flag offensive 0 remove flag delete link

Comments

Thank you so much, Chuck! I had no idea it was even noted in the documentation! I made a simple batch file to apply the new colors - I assume there's no way to edit a config file somewhere to make it more permanent?

justah117 (2022-05-16 17:03:23 +0000) edit

gui.colorized_frame.bg and gui.colorized_frame.fg and only used to override prefs.gui_colorized_bg and prefs.gui_colorized_fg which are always set to the default colors on startup (prefs.c).
If it's something you would want to change often, open an enhancement request to have them added to the regular preferences where they could be updated in the Wireshark gui.

Chuckc (2022-05-16 17:36:16 +0000) edit

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Is it possible to change temporary colors (1-10) to other colors and the draw packets color rules button behavior? edit

Comments

1 Answer

Comments