B.3. Configuration Files

B.3. Configuration Files
Prev	Appendix B. Files and Folders	Next

Wireshark uses a number of configuration files while it is running. Some of these reside in the personal configuration folder and are used to maintain information between runs of Wireshark, while some of them are maintained in system areas.

The content format of the configuration files is the same on all platforms.

On Windows:

The personal configuration folder for Wireshark is the Wireshark sub-folder of that folder, i.e., %APPDATA%\Wireshark.
The global configuration folder for Wireshark is the Wireshark program folder and is also used as the system configuration folder.

On Unix-like systems:

The personal configuration folder is $XDG_CONFIG_HOME/wireshark. For backwards compatibility with Wireshark before 2.2, if $XDG_CONFIG_HOME/wireshark does not exist and $HOME/.wireshark is present, then the latter will be used.
If you are using macOS and you are running a copy of Wireshark installed as an application bundle, the global configuration folder is APPDIR/Contents/Resources/share/wireshark. Otherwise, the global configuration folder is INSTALLDIR/share/wireshark.
The /etc folder is the system configuration folder. The folder actually used on your system may vary, maybe something like: /usr/local/etc.

Table B.1. Configuration files overview

File/Folder	Description
cfilters	Capture filters.
colorfilters	Coloring rules.
dfilter_buttons	Display filter buttons.
dfilters	Display filters.
disabled_protos	Disabled protocols.
dmacros	Display filter macros.
ethers	Ethernet name resolution.
hosts	IPv4 and IPv6 name resolution.
ipxnets	IPX name resolution.
manuf	Ethernet name resolution.
preferences	Settings from the Preferences dialog box.
recent	Per-profile GUI settings.
recent_common	Common GUI settings.
services	Network services.
ss7pcs	SS7 point code resolution.
subnets	IPv4 subnet name resolution.
subnetsipv6	IPv6 subnet name resolution.
vlans	VLAN ID name resolution.
wka	Well-known MAC addresses.

File contents

cfilters

This file contains all the capture filters that you have defined and saved. It consists of one or more lines, where each line has the following format:

"<filter name>" <filter string>

At program start, if there is a cfilters file in the personal configuration folder, it is read. If there isn’t a cfilters file in the personal configuration folder, then, if there is a cfilters file in the global configuration folder, it is read.

When you press the Save button in the “Capture Filters” dialog box, all the current capture filters are written to the personal capture filters file.

colorfilters

This file contains all the color filters that you have defined and saved. It consists of one or more lines, where each line has the following format:

@<filter name>@<filter string>@[<bg RGB(16-bit)>][<fg RGB(16-bit)>]

At program start, if there is a colorfilters file in the personal configuration folder, it is read. If there isn’t a colorfilters file in the personal configuration folder, then, if there is a colorfilters file in the global configuration folder, it is read.

When you press the Save button in the “Coloring Rules” dialog box, all the current color filters are written to the personal color filters file.

dfilter_buttons

This file contains all the display filter buttons that you have defined and saved. It consists of one or more lines, where each line has the following format:

"TRUE/FALSE","<button label>","<filter string>","<comment string>"

where the first field is TRUE if the button is enabled (shown).

At program start, if there is a dfilter_buttons file in the personal configuration folder, it is read. If there isn’t a dfilter_buttons file in the personal configuration folder, then, if there is a dfilter_buttons file in the global configuration folder, it is read.

When you save any changes to the filter buttons, all the current display filter buttons are written to the personal display filter buttons file.

dfilters

This file contains all the display filters that you have defined and saved. It consists of one or more lines, where each line has the following format:

"<filter name>" <filter string>

At program start, if there is a dfilters file in the personal configuration folder, it is read. If there isn’t a dfilters file in the personal configuration folder, then, if there is a dfilters file in the global configuration folder, it is read.

When you press the Save button in the “Display Filters” dialog box, all the current display filters are written to the personal display filters file.

disabled_protos

Each line in this file specifies a disabled protocol name. The following are some examples:

tcp
udp

At program start, if there is a disabled_protos file in the global configuration folder, it is read first. Then, if there is a disabled_protos file in the personal configuration folder, that is read; if there is an entry for a protocol set in both files, the setting in the personal disabled protocols file overrides the setting in the global disabled protocols file.

When you press the Save button in the “Enabled Protocols” dialog box, the current set of disabled protocols is written to the personal disabled protocols file.

dmacros

This file contains all the display filter macros that you have defined and saved. It consists of one or more lines, where each line has the following format:

"<macro name>" <macro expression>

At program start, if there is a dmacros file in the personal configuration folder, it is read. If there isn’t a dmacros file in the personal configuration folder, then, if there is a dmacros file in the global configuration folder, it is read.

In versions of Wireshark prior to 4.4, the display filter macros were stored in a dfilter_macros file with a somewhat different format, a UAT. At program start if the dmacros file is not found a dfilter_macros file is looked for in the personal and global configuration folders and converted to the new format.

When you press the Save button in the "Display Filter Macros" dialog box, all the current display filter macros are written to the personal display filter macros file.

More information about Display Filter Macros is available in Section 6.7, “Defining And Saving Filter Macros”

ethers

When Wireshark is trying to translate a hardware MAC or EUI-64 address to a name, it consults the ethers file in the personal configuration folder first. If the address is not found in that file, Wireshark consults the ethers file in the system configuration folder.

This file has a similar format to the /etc/ethers file on some UNIX-like systems. Each line in these files consists of one hardware address and name separated by whitespace (tabs or spaces). The hardware addresses are expressed as pairs of hexadecimal digits separated by colons (:), dashes (-), or periods(.), with the same separator used in the entire address. A # can be used to indicate a comment that extends to the rest of the line. NIS lookups, as in some UNIX-like systems, are not supported. Both 6 byte MAC and 8 byte EUI-64 addresses are supported. The following are some examples:

ff-ff-ff-ff-ff-ff    Broadcast
c0-00-ff-ff-ff-ff    TR_broadcast
00.2b.08.93.4b.a1    Freds_machine
00:00:00:00:00:00:00:00    zb_zero_broadcast

The settings from this file are read in at program start, and reloaded when opening a new capture file or changing the configuration profile, and never written by Wireshark.

hosts

Wireshark uses the entries in the hosts files to translate IPv4 and IPv6 addresses into names.

Wireshark reads hosts files from multiple locations in a hierarchical manner:

Global hosts file (e.g., C:\Program Files\Wireshark\hosts on Windows)
Base personal hosts file (e.g., %APPDATA%\Wireshark\hosts on Windows)
Profile hosts file (e.g., %APPDATA%\Wireshark\profiles\<name>\hosts on Windows)

All three files are read in sequence. When entries conflict, the last file loaded wins, creating a three-tier precedence system: - Enterprise/global settings (lowest priority) - User-wide personal overrides (medium priority) - Profile-specific overrides (highest priority)

The profile hosts file is always loaded when name resolution is enabled. The base personal hosts file allows users to maintain user-wide name resolution mappings across all profiles without needing write access to system directories or duplicating entries in every profile.

This file has the same format as the usual /etc/hosts file on Unix systems.

An example is:

# Comments must be prepended by the # sign!
192.168.0.1 homeserver

The settings from these files are read in at program start, and reloaded when opening a new capture file or changing the configuration profile, and never written by Wireshark.

ipxnets

When Wireshark is trying to translate an IPX network number to a name, it consults the ipxnets file in the personal configuration folder first. If the address is not found in that file, Wireshark consults the ipxnets file in the system configuration folder.

An example is:

C0.A8.2C.00      HR
c0-a8-1c-00      CEO
00:00:BE:EF      IT_Server1
110f             FileServer3

The settings from this file are read in when an IPX network number is to be translated to a name, and never written by Wireshark.

manuf

At program start, if there is a manuf file in the global configuration folder, it is read first. Then, if there is a manuf