In this recipe, we will see some basic configurations for the start window. We will talk about configuring the main window, file formats, and viewing options.

Start Wireshark, and you will get the start window. There are several parameters you can change here in order to adapt the capture window to your requirements:

• Toolbars configuration
• Main window configuration
• Time format configuration
• Name resolution
• Auto scroll in live capture
• Zoom
• Column configuration

First, let's have a look at the menu and the toolbars that are used by the software:

Wireshark's main menu is located at the top of the main window. In the main toolbar you have the following symbols:

• File: File operations such as open and save file, export packets, print, and so on.
• Edit: To find packets, mark packets, add comments, and most importantly, use the preferences' submenu. This will be described in Chapter 2, Mastering Wireshark for Network Troubleshooting.
• View: For configuring Wireshark display, colorization of packets, zooming, font changes, showing a packet in a separate window, expanding and collapsing trees in packet details, and so on.
• Go: To go to a specific packet, for example, to the first packet in the capture, the last packet, a packet number, and so on.
• Capture: To configure capture options and capture filters.
• Analyze: For analysis and display options like display filter configuration, decode options, to follow a specific stream, and so on.
• Statistics: To show statistics, starting from the basic hosts and conversations statistics up to the smart IO graphs and stream graphs.
• Telephony: For displaying IP telephony and cellular protocols information, for example, RTP and RTCP, SIP flows and statistics, GSM or LTE protocols, and so on.
• Wireless: For showing Bluetooth and IEEE 802.11 wireless statistics, later described in Chapter 9, Wireless LAN.
• Tools: For Lua operations as described in Appendix 4, Lua programming.
• Help: For user assistance, sample capture updates, and so on.

The main toolbar provides quick access to frequently used items from the menu. This toolbar can be hidden using the View menu.

The four left-most symbols are for capture operations, then you have symbols for file operations, go to packet operations, auto-scroll, draw packets using coloring rules, zoom and resize.

In the filters toolbar, you have the following symbols:

• Type in a display filter string, with auto complete while showing us previously configured filters
• Manage filter expressions that allow you to bring up filter construction dialog for filter construction assistance
• Configure a new filter and add it to the preferences
• Use filter predefined expressions, and choose a filter

An enhanced description of splay filters is provided in Chapter 4, Using Display Filters.

In the status bar, at the lower side of the Wireshark window, you can see the following data:

You can see here:

• Any errors in the expert system.
• The Capture file properties, including file information, capture time, time and general statistics.
• The name of the captured file (during capture, it will show you a temporary name assigned by the software).
• Total number of captured packets, displayed packets (those which are actually displayed on the screen), and load time, that is, the time it took to load the capture file.
• The profile you work with. For more information of profiles, you can read Chapter 2, Mastering Wireshark for Network Troubleshooting.

In this part, we will go step by step and configure the main menu.

Usually for regular packet capture, you don't have to change anything. This is different when you want to capture wireless data over the network (not only from your laptop); you will have to enable the wireless toolbar, and this is done by clicking on it under the view menu, as shown in the following screenshot:

When marking the Wireless Toolbar option in the View menu, the wireless toolbar opens. The only option available in the current version is to start the preferences' configuration window. There is more about Wireless LAN analysis in Chapter 9, Wireless LAN.

To configure the main menu for capturing, you can configure Wireshark to show the following windows:

Name Resolution is the translation of layer 2 (MAC addresses), layer 3 (IP addresses), and layer 4 (port numbers) into meaningful information.

Name Resolution

In the screenshot, we see that the MAC address 34:08:04:16:09:78 (from D-Link), the website (that is, www.facebook.com), and the HTTPs port number (that is 443).

Usually you start a capture in order to establish a baseline profile of what normal traffic looks like on your network. During the capture, you look at the captured data and you might find a TCP connection, IP, or Ethernet connectivity that are suspects, and you'll want to see them in another color.

To do so, right-click on the packet that belongs to the conversation you want to color, choose Ethernet, IP, or TCP/UDP (TCP or UDP will appear depending on the packet), and choose the color for the conversation.

In the example, you see that we want to color a TCP conversation.

To cancel the coloring rule:

1. Go to the View menu
2. In the lower part of the menu, choose Colorize Conversation and then Reset Colorization or simply click on Ctrl + space bar

As you see in the following screenshot, for zooming in and out:

1. Go to the View menu
2. Click on Zoom In on the main toolbar or press Ctrl++ to zoom in
3. Click on Zoom Out on the main toolbar or press Ctrl +- to zoom out