Shark SE400 User's Guide download pdf (Page 195)

Customizing Wireshark

186

The profile name will be used as a folder name in the configured

“Personal configurations” folder. If adding multiple profiles

with the same name, only one profile will be created.

On Windows the profile name cannot start or end with a period

(.), and cannot contain any of the following characters: ‘\’, ‘/’,

‘:’, ‘*’, ‘?’, ‘`’, ‘<’, ‘>’, ‘|’, or ‘+’. On Unix the profile name

cannot contain the ‘/’ character.

OK This button saves all changes, applies the selected profile and

closes the dialog.

Apply This button saves all changes, applies the selected profile and

keeps the dialog open.

Cancel Close this dialog. This will discard unsaved settings, new

profiles will not be added and deleted profiles will not be

deleted.

Help Show this help page.

10.7. User Table

The User Table editor is used for managing various tables in wireshark. Its main dialog works very

similarly to that of Section 10.3, “Packet colorization”.

10.8. Display Filter Macros

Display Filter Macros are a mechanism to create shortcuts for complex filters. For example defining a

display filter macro named tcp_conv whose text is ( (ip.src == $1 and ip.dst == $2 and tcp.srcport ==

$3 and tcp.dstport == $4) or (ip.src == $2 and ip.dst == $1 and tcp.srcport == $4 and tcp.dstport

== $3) ) would allow to use a display filter like ${tcp_conv:10.1.1.2;10.1.1.3;1200;1400} instead of

typing the whole filter.

Display Filter Macros can be managed with a Section 10.7, “User Table” by selecting Analyze →

Display Filter Macros from the menu. The User Table has the following fields

Name The name of the macro.

Text The replacement text for the macro it uses $1, $2, $3, … as the input arguments.

10.9. ESS Category Attributes

Wireshark uses this table to map ESS Security Category attributes to textual representations. The

values to put in this table are usually found in a XML SPIF, which is used for defining security labels.

This table is handled by an Section 10.7, “User Table” with the following fields.

Tag Set An Object Identifier representing the Category Tag Set.

Value The value (Label And Cert Value) representing the Category.

Name The textual representation for the value.

10.10. GeoIP Database Paths

If your copy of Wireshark supports MaxMind’s GeoIP library, you can use their databases to match IP

addresses to countries, cites, autonomous system numbers, ISPs, and other bits of information. Some

1 2 ... 190 191 192 193 194 195 196 197 198 199 200 ... 227 228

No comments

Shark SE400 User's Guide Page 195