ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Modify default settings?

From: Christopher Maynard <Chris.Maynard@xxxxxxxxx>
Date: Mon, 15 Nov 2010 16:47:04 +0000 (UTC)
Stephen Fisher <steve@...> writes:

> Are we using the best default settings when Wireshark is installed for 
> the first time on a machine?  I always make these changes:
> 
>  - <uncheck> Ask for unsaved capture files
>  - <check> Welcome screen and title bar shows version
>  - Always start in directory (Desktop on Windows, ~/captures on Unix)
>  - Change the toolbar style to "Icons & Text"
>  - Add a "Packet Length (Bytes)" column titled "Bytes"
> 
> The one that I think would be the most useful to consider making a 
> default setting is making the toolbar style "Icons & Text" followed by 
> adding the packet length column.
> 
> Comments?  Any other settings we all use that could be useful?

+1 for adding a packet length column by default.

I would vote for changing toolbar style to "Icons & Text" except that this
causes some of the toolbar choices not to be displayed, except through the
drop-down on the far right.  Maybe if the font and/or spacing could be made
smaller so that all the icons still show up, then I would vote for that.  Not
sure if other formatting could be made as well, such as using 2 lines to
display certain text instead of 1 in order to help squeeze more icons into the
displayable area, e.g., "Auto Scroll in Live Capture" is rather long.

BTW, I have a dual-screen display, one 1440 wide and the other 1280 wide.  Even
on the 1440 wide screen, not all icons are displayed when the toolbar text is 
added.

As for other columns and options, I always display both Time (format as
specified) and Delta time displayed, the version, and save window position.  Of
those, the last 2 seem like better defaults to me, especially the last one.

I wonder if "Open a console window" set to Automatic might be a better choice
than Never for windows users?  There are likely more problems occurring that
users are simply not aware of.  Maybe it's better to display them when they 
occur?