Wireshark Profiles and Efficiency
Wireshark profiles bundle column layouts, coloring rules, saved display filters, and preferences into named configurations. A "Forensics" profile lets you load an investigation-optimized environment in one click. This chapter covers building, exporting, and sharing profiles, plus the efficiency techniques that separate a 20-minute triage from a 2-hour one.
You get called in to investigate a suspected C2 channel during business hours. You have 30 minutes before a stakeholder meeting. A well-configured Wireshark profile means you open the PCAP, instantly see the right columns and coloring rules, apply a saved "C2 candidates" display filter in one click, pivot to the I/O graph to see the attack timeline, and have actionable evidence in under 15 minutes. Without a pre-built profile, you spend those 15 minutes adjusting columns and remembering filter syntax.
Creating and Using Profiles
Wireshark Profiles — What They Store ═══════════════════════════════════════════════════════════════════ Location: Edit → Configuration Profiles OR: status bar, bottom-right → click "Profile: Default" Each profile stores independently: ├── Column layout (which fields appear in the packet list) ├── Coloring rules (color coding for attack traffic) ├── Display filter buttons (one-click saved filters) ├── Protocol preferences (checksum validation, decode-as rules) ├── Name resolution settings (GeoIP, DNS resolver on/off) └── I/O graph saved configurations Recommended profiles: ┌─────────────────┬─────────────────────────────────────────────┐ │ Profile Name │ Optimized For │ ├─────────────────┼─────────────────────────────────────────────┤ │ Default │ General purpose (Wireshark standard) │ │ Forensics │ IR/forensics: timestamps, ports, stream IDs │ │ C2-Hunt │ C2 detection: TLS SNI, JA3, beacon hunting │ │ Malware-Lab │ Malware sandbox: HTTP/DNS focus, no noise │ │ Red-Team │ Red team review: credential focus, SMB │ └─────────────────┴─────────────────────────────────────────────┘ To create a new profile: 1. Edit → Configuration Profiles → + (New) 2. Name it "Forensics" and select "Copy from: Default" 3. Make your customizations (columns, colors, filters) 4. Changes auto-save to the profile Profile storage location: Linux/macOS: ~/.config/wireshark/profiles// Windows: %APPDATA%\Wireshark\profiles\ \
Display Filter Expression Buttons
Filter expression buttons appear as clickable buttons above the packet list.
One click applies the filter — essential for rapid triage workflow.
To add: click the "+" icon at the far right of the filter bar
OR: Edit → Preferences → Filter Expressions
Recommended button set for forensics profile:
Button Label Filter Expression
──────────────────── ─────────────────────────────────────────────
C2 SYN Candidates tcp.flags.syn==1 && !tcp.flags.ack
RSTs tcp.flags.reset==1
DNS Queries dns.flags.response==0
DNS NXDOMAIN dns.flags.rcode==3
HTTP POST http.request.method=="POST"
TLS ClientHello tls.handshake.type==1
SMB Auth ntlmssp
Kerberoasting kerberos.msg_type==12 && kerberos.etype==23
Large Transfers frame.len>1400 && ip.dst!=10.0.0.0/8
ICMP Tunnel icmp && frame.len>100
PowerShell UA http.user_agent contains "PowerShell"
External Only ip.dst!=10.0.0.0/8 && ip.dst!=192.168.0.0/16
Retransmits tcp.analysis.retransmission
Expert Errors expert.severity==3
Usage workflow:
1. Open PCAP → click "External Only" → see all external traffic at a glance
2. Click "TLS ClientHello" → see all new TLS sessions
3. Click "DNS NXDOMAIN" → see all DGA candidates
4. Click "Kerberoasting" → see all Kerberos attacks
5. Each button applies the filter instantly; clear to return to full view