Colorizing with an Ethereal Display Filter

How to colorize packets using an Ethereal Display Filter

To pick out packets from a trace you can make specific packets appear in different colors. This is done using one of the Display options, Colorize Display.

Step 1 Click Display.

An options drop down box appears.

Step 2 Click Colorize Display...

The Apply Color Filters box appears.

Although Apply Color Filters uses a format similar to that used by Display Filters it does not list any Display Filters that you have already defined.

Step 3 Click New.

Step 4 Type a Name for the new filter.

The name must not include @ symbols.

Step 5 Click Add Expression.

The Filter Expression dialog appears. This allows you to select protocols and parts of protocols to help you build complex filters.

Note: that you can type the string directly into the Filter string box if you know what you want. To begin with it is usually easier to select from the Add Expression options.

Note: if you add a second expression to an existing filter it will not compile and give you an error message. It is possible to use multiple expressions if you separate them by using AND and OR.

You may set the foreground and background colors.

Step 6 Click the Foreground (or background) color button.

Select a color, or specify one using Hue, Saturation, and Value, or RGB.

Step 7 Click OK.

This adds the new filter to the list.

Step 8 Click Apply.

This colors packets matching the filter criteria, using the color(s) specified.