Columns and profiles

Add the field you keep clicking

The default columns are a reasonable start and a poor fit for a single question. If you are reading window sizes, add the calculated window as a column. If you are reading names, add the DNS query name or the TLS server name. Right-click the field in the details tree and choose Apply as Column. The list grows a column, and you can sort and scan.

A column is a view of a field. It is empty on frames where the field is absent, which is itself useful: a tls.handshake.extensions_server_name column stays blank on pure ACK packets and fills in on Client Hellos. You scroll the handshake rows without opening each one.

Keep a lab profile

Profiles store columns, coloring rules, and many protocol preferences. Edit, then Configuration Profiles, and copy the default into one named for the lab. Switch back to the default when you open a file for a different job, so a DNS-heavy layout does not hide what you need for a TCP job.

The profile lives in your Wireshark configuration, not in the pcapng. A teammate who opens the same file sees their profile. If a column was essential to the finding, say the field name in the note. The field is in the file. The column was your shortcut to it.

Worked case: a layout for the lab web host

You are about to read a morning capture of 10.8.0.20, the lab web server. The questions you expect are “who opened TCP,” “what name did TLS ask for,” and “did the window close.” Make a profile called lab-web. Add columns for tcp.stream, tcp.window_size, and tls.handshake.extensions_server_name. Leave the default columns in place so the time and the addresses stay put. When the stream column shows 7 on the session you care about, tcp.stream == 7 is the filter that keeps only that session.

Sort is a trap worth knowing. Sorting by a column reorders the list on screen, and time order is what a handshake depends on. When the story is a sequence, sort by the packet number or the time column again before you follow a stream. The file’s order has not changed. The view has.

tcp.stream == 7

• tcp.stream, so one conversation shares a number.
• tcp.window_size, the scaled window.
• tls.handshake.extensions_server_name, blank except on Client Hellos.

What travels with the evidence

Hand over the pcapng, the capture-point note, and the display filters you used. A profile export is a courtesy if you want someone to see the same columns, and it is optional. Findings that only exist as a column arrangement will not survive the handoff.

Protocol preferences can change a decode. Relative sequence numbers, TCP reassembly, and name resolution are the ones that most often change what a second person sees. If you changed one while reading the lab file, write that down next to the profile name.