Wireshark is a cross-platform tool that runs on Linux, Microsoft Windows, macOS, BSD, Solaris, and other Unix-like operating systems. It lets you see what’s happening on your network at a microscopic level and is the de facto (and often de jure) standard across many commercial and non-profit enterprises, government agencies, and educational institutions. It is used for network troubleshooting, analysis, software, and communications protocol development. For example I have '802.11 retry bit set' and '802.11 power management bit set' filter rules positioned at the top as I want to highlight such frames in my wireless analysis.Wireshark is a free and open-source packet analyzer. (Note 2: Coloring rules are read from top of list down so the first matched filter will be applied. Once the colorfilters file is imported you should manually select all these new rules and drag them to the top of your rule set so they can be applied in the correct order.) Please backup your colorfilters file before importing this colorfilters file in Wireshark's menu selection 'View->Coloring Rules.->Import'. ( Note 1: These color filters were based on using Wireshark version 2.6.3. These rules are permanently saved and used each time Wireshark is started. The attached file contains my colorfilters file that can be imported into Wireshark's 'Coloring Rules' for displaying different protocol communication for analyzing WiFi frames. As shown at Atmosphere 19' Las Vegas last week, it is recommended to use Wireshark's 'Coloring Rules' for the common protocols you need to analyze to help improve the efficiency of browsing through a large sniffer trace file for monitoring or troubleshooting.

Why does wireshark use different colors