In this video we are going to learn about the Wireshark profiles how to create a delete and configure
the profiles.
Wireshark profiles help us to optimize the performance of Wireshark.
All right.
So what is the Wireshark profile?
A profile saves the settings and configurations.
Changes that you make to Wireshark are saved into the profile.
It depends on the profile that you are using.
Every change that you make is saved into the default profile.
By default, when you install the Wireshark, Wireshark creates a default profile for you.
Every change or setting that you make gets written into the default profile.
For example, let me increase the font size here, and I also want to hide the, let's say, destination
column.
So right click and click on the destination.
As you can see, the destination column has been hidden.
Now let me close the Wireshark and restart it.
As you can see, guys, all the changes that I made before closing the Wireshark are intact.
Font size has been maintained and destination column is also hidden.
Now your question might be why we need profiles, right?
Wireshark is used for multiple tasks like capturing packets, detecting and analyzing different types
of packets and threats.
ATC Right.
So to get the different tasks done quickly and efficiently, then we have to configure and modify Wireshark
differently according to the given task.
Now it is a time consuming process when you have to configure and reconfigure Wireshark for every different
task.
Right?
So this is what the Wireshark profiles solve.
So instead of configuring and reconfiguring Wireshark for different tasks, we can create profiles.
Once you create profiles, then you can switch between them with a single click.
Wireshark allows us to create multiple profiles.
Each profile can have different settings and configurations.
We can configure each profile according to the given task.
For example, we can create one profile just for capturing packets and another profile for analyzing
packets, and third profile for, let's say, detecting WiFi attacks and another profile for analyzing
HTTP traffic.
ATC right now let's do it practically to understand its real power.
On your bottom, right click on profile.
It displays all the profiles default and the profiles that you have created.
These are the default profiles.
Wireshark automatically creates these profiles when you install it.
Right.
And this is the default profile.
Default.
It is currently in use as indicated by this article.
All the changes that you make are saved to this default profile.
Now we can switch between these available profiles.
So let me click on, let's say, Bluetooth.
As you can see, guys.
Each profile has a different appearance and configurations right now.
Let's create our own profile.
So go to the edit, click on Configuration Profiles.
Another way to access Configuration Profiles is right click on a profile.
Click on Manage Profiles.
Now to demonstrate the profiles I'm going to create to profiles.
One for capturing packets and another for analyzing DHCP packages.
So to create a new profile, click on plus a button.
Now give your profile a name.
I'm going to start with creating a capture profile.
So capture profile you can give any name to your profile.
Now hit enter.
Now click on.
Okay.
Again, click on Profile.
As you can see, guys, the capture profile has been created and it is currently in use.
All the profiles that you create appear here.
Now let's configure this capture profile.
First thing that I'm going to do is increase the font size.
When you are capturing packets, we don't need these two panels.
Write packet details and packet bytes.
They unnecessarily occupy the space.
So go to The View.
Click on packet details again.
We will click on packet bytes.
Now we can easily, you know, monitor the packets that Wireshark captures.
Now let's create a profile for analyzing TCP packets.
So right click on a profile.
Click on Manage Profile again, click on Plus Button.
Now give your profile a new name, TCP IP Analysis Press enter, click on.
Okay, now let me pull up the packet bytes and packet details.
As you can see, DHCP profile has been created and it is currently in use.
Now let's configure this DCP analysis profile and I'm going to look at some DCP packets now, expand
the DCP values.
And here I want to add a few fields from TCP IP into these columns.
But so I'm going to add a sequence number field.
So right click on it, click on Apply S column.
As you can see, sequence number field has been added.
I'm also going to add acknowledgement number field right click click on Apply S column.
And another field that I would like to add is Windows.
Apply as a column.
As you can see, all the three fields have been added sequence number, acknowledgment number and receive
window.
It is a neat and basic profile for analyzing the TCP traffic.
Now that I have created this TCP analysis profile, I can switch between all these available profiles.
When I want to capture packets, then I can switch to capture the profile, right?
And when I want to analyze TCP traffic, then I can easily switch to TCP analysis profile.
And in this way, you can create as many profiles as you like.
There is no limit to it.
Now we are going to learn how to save or export the profiles.
Wireshark allows us to export the existing profiles.
Once you export a profile, then you can use that profile on other systems as well, right?
Another advantage of exporting a profile is that if you delete a profile from here, then you can import
the saved profile.
Right.
So how to export a profile?
Click on the profile that you want to export.
Then click on export.
Click on one selected personal profile.
Then give your profile a name.
Now click on Save.
As you can see, profile has been exported or saved.
Wireshark saves profiles in dot zip format.
Now how to remove a profile.
It is easy as well.
Click on the profile that you want to remove, then click on minus button and click on okay.
Now let me click on profile.
As you can see guys, the DHCP analysis profile is no longer appearing here.
Right now let's import a profile to import profile.
Click on import.
Either you can import from a zip file or from a directory.
I have a profile in the dot zip format, so I'm going to click on from zip file.
Now click on the profile DHCP analysis.
As you can see, guys, profile has been imported.
Now to use it, click on it, click on.
Okay.
As you can see, guys, the TCP analysis profile is back.
It has been successfully imported and applied.