For a specific packet, you can also see the matching coloring rule name
and filter string in the "Frame" tree in the packet detail (middle) pane.
Bland Chuck-CNGR85 wrote:
> Under View, select Coloring Rules. There you will see the default rules
> and what the colors are indicating.
>
> Chuck Bland
>
> ------------------------------------------------------------------------
> *From:* wireshark-users-bounces@xxxxxxxxxxxxx
> [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] *On Behalf Of *jon jon
> *Sent:* Tuesday, July 21, 2009 13:00 PM
> *To:* wireshark-users@xxxxxxxxxxxxx
> *Subject:* [Wireshark-users] colored packets
>
> Hi,
> I am new to wire shark and was wondering when I am running it. I see a
> line that is black with a packet, what does that exaclty mean. I know
> there is a way to set up a color code to different things. but I have'nt
> change any color scheme, just using the default color setup. So what
> does that mean the black colored packet. it says in the information down
> below unreassembled packet incorrect tcp checksum. What is that telling
> me? I don't understand how to tell what the colors are telling me about
> the packets. is there some guide that tells you what color a packet is
> doing?
> thanks,
> lost
>
>
> ------------------------------------------------------------------------
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe