Wireshark Profile Setup: Custom Columns and Preferences (2026)

A Wireshark profile is more than just a saved set of preferences; it’s a personalized lens through which you view network traffic, allowing you to instantly surface the data most relevant to your current task.

Let’s see this in action. Imagine you’re troubleshooting a slow web application. You’ve captured some traffic, and by default, Wireshark shows you a lot of noise. You want to quickly see HTTP requests and their corresponding responses, along with timing information.

First, create a new profile. Go to Edit > Configuration Profiles... and click Create. Name it something descriptive, like HTTP Troubleshooting.

Now, let’s customize the columns. Right-click on any column header and select Column Preferences.... We’ll remove some default columns and add new ones.

• Remove: Select columns like Protocol, Source, Destination, Length, and Info (unless Info is particularly useful for your specific HTTP troubleshooting).
• Add: Click the + button to add new columns.
  • Name: HTTP Method
    • Type: Custom
    • Protocol: HTTP
    • Field: http.request.method
    • Display: Selected
  • Name: HTTP Host
    • Type: Custom
    • Protocol: HTTP
    • Field: http.host
    • Display: Selected
  • Name: HTTP URI
    • Type: Custom
    • Protocol: HTTP
    • Field: http.request.uri
    • Display: Selected
  • Name: HTTP Response Code
    • Type: Custom
    • Protocol: HTTP
    • Field: http.response.code
    • Display: Selected
  • Name: HTTP Response Phrase
    • Type: Custom
    • Protocol: HTTP
    • Field: http.response.reason_phrase
    • Display: Selected
  • Name: TCP Delta Time
    • Type: Custom
    • Protocol: TCP
    • Field: tcp.analysis.delta_time
    • Display: Selected
    • Format: Absolute (or Relative if you prefer)

Arrange these new columns to your liking in the Column Preferences dialog. You’ll likely want TCP Delta Time near the beginning to see request/response timings, followed by the HTTP-specific fields.

With your new profile active (select it from Edit > Configuration Profiles...), your packet list will transform. You’ll see a cleaner view, with columns dedicated to the HTTP method, host, URI, and response details. The TCP Delta Time column will immediately highlight delays between packets, crucial for identifying slow requests or responses.

This profile allows you to quickly filter for specific HTTP requests (e.g., http.request.method == "GET") and then analyze the timing and response codes directly in the packet list, without digging into individual packet details for every step.

Beyond columns, profiles manage all Wireshark preferences: display filters, coloring rules, protocol dissector settings, name resolution, and more. This means you can have a profile optimized for DNS troubleshooting, another for VoIP analysis, and yet another for wireless security, each pre-configured to show you exactly what you need, when you need it.

The true power of custom columns and profiles lies in their ability to transform Wireshark from a raw data viewer into an intelligent, task-specific analysis tool. By curating the information displayed, you reduce cognitive load and accelerate your troubleshooting process, focusing on the meaning of the traffic rather than its sheer volume.

For example, you can create a profile that prioritizes showing TCP retransmissions and duplicate ACKs. When you activate this profile and apply a filter like tcp.analysis.retransmission, the packet list will immediately highlight problem areas, and the custom columns might show you the sequence numbers involved and the time deltas between the original transmission and the retransmission, giving you a direct view into network reliability issues.

What many users miss is that Wireshark profiles are stored as individual .ini files in your Wireshark configuration directory. This means you can back them up, share them with colleagues, or even version control them. You can find this directory by looking at About Wireshark > Folders. On Windows, it’s typically in %APPDATA%\Wireshark, and on Linux/macOS, it’s usually ~/.config/wireshark.

The next step is to explore how to create and apply custom coloring rules within your profiles to visually emphasize specific types of traffic or anomalies.