Wireshark coloring rules
You learn where the default colouring rules come from and how to read them, write your own rule that paints cleartext passwords red, disable a rule and export your rules; at the end you build a rule that marks long DNS queries and find the domain of a hidden data exfiltration channel yourself. The suspicious domain differs in every lab.
Level 101 · 40 min
The fastest way to spot what matters among thousands of packets at a glance is colour. Wireshark tries each packet against a list of rules from top to bottom and applies the colours of the first matching rule to the packet’s line. Analogy: a hospital’s urgency colours (red, yellow, green): each patient gets a colour first, and who to see first is clear at a glance.
The default rules show, for example, bad TCP packets in red on black, HTTP in light green, DNS in light blue. But the real power is your own rules: "show every packet carrying a password in red".
In this lesson you prepare the SOC team’s colouring rules. The capture: ~/captures/renk.pcapng (different in every lab).
What you will do in this lesson
- Open the capture
- Where are the default rules?
- The first rule: Bad TCP
- Your own rule: Parola-Avcisi
- How many packets does the rule match?
- Disable a rule
- Share the rules with the team: Export
- A colour for long DNS queries
- The exfiltration channel’s address
- Short quiz
Skills you will earn
- Opening a capture file in Wireshark
- Reading, disabling and exporting colouring rules
- Writing your own colouring rule
- Spotting DNS exfiltration through long queries
← The Wireshark interface: packet list, details, bytes; columns and profiles · Wireshark fundamentals · Live capture with Wireshark →
Start for free