Packet colorization

A very useful mechanism available in Ethereal is packet colorization. You can set Ethereal up so that it colorizes packets according to a filter. This allows you to emphasize the packets you are interested in.

To colorize packets, select the Colorize Display... menu item from the Display menu, and Ethereal will pop up the Add Color to Protocols dialog box as shown in Figure 18.

Once the Add Color to Protocol dialog box is up, there are a number of buttons you can use, depending on whether or not you have any color filters installed already. If this is the first time you have used Add Color to Protocol, click on New which will bring up the Edit color filter dialog box as shown in Figure 19.

In the Edit Color dialog box, simply enter a name for the color filter, and enter a filter sting in the Filter text field. Figure 19 shows the values smb and smb which means that the name of the color filter is smb and the filter will select protocols of type smb. Once you have entered these values, you can choose a background and foreground color for packets that match the filter expression. Click on Choose background color or Choose foreground color to do achieve this and Ethereal will pop up the Choose foreground/background color for protocol dialog box as shown in Figure 20.

Select the color you desire for the selected packets and click on OK.

	Note!
	You must select a color in the colorbar next to the colorwheel to load values into the RGB sliders. Alternatively, you can use the sliders to select the color you want.

You will need to carefully select the order that filters are listed (and thus applied) as they are applied in order. So, more specific filters need to be listed before more general filters. For example, if you have a color filter for UDP before the one for DNS, the color filter for DNS will never be applied.

Figure 21 shows an example of several color filters being used in Ethereal. You may not like the color choices, however, so feel free to choose your own.