Profiles

Packet Viewer supports loading Wireshark-compatible profiles for customized packet analysis configuration. This article covers how to deploy profiles to your Packet Viewer container.

For information on what profiles contain and how to configure Wireshark analysis settings, see Analysis Configuration.

Profile Directory Structure

A profile is a directory containing a wireshark/ subdirectory with configuration files:

profile-name/
└── wireshark/
    ├── preferences
    ├── decode_as_entries
    ├── colorfilters
    ├── dfilter_buttons
    ├── hosts
    └── ...

All files are optional - include only what your use case requires.

Loading Profiles

The --profiles-dir option specifies where Packet Viewer loads profiles from. The default location is /data/profiles inside the Docker container.

You can specify --profiles-dir multiple times to load profiles from multiple directories. When profiles with the same name exist in multiple directories, the profile from the last specified directory takes precedence. This allows you to layer profiles, overriding stock profiles or providing user-specific customizations without modifying the original files.

Example with multiple profile directories:

/usr/share/profiles/          # Stock profiles
├── sample/
│   └── wireshark/
│       └── preferences
└── wifi/
    └── wireshark/
        └── preferences

/data/profiles/               # User customizations (takes precedence)
├── sample/                   # Overrides /usr/share/profiles/sample
│   └── wireshark/
│       └── decode_as_entries
└── custom/
    └── wireshark/
        └── preferences

With --profiles-dir /usr/share/profiles --profiles-dir /data/profiles, the sample profile uses /data/profiles/sample (overriding the stock version), while wifi uses /usr/share/profiles/wifi (no override exists).

Deployment Methods

Profiles can be added to the Docker container either by building a custom image or by mounting local directories as volumes at runtime.

Custom Image

Create a custom Dockerfile that adds your profiles to the container:

FROM packet-viewer:[version]

# Copy profiles
COPY profiles/ /data/profiles/

# Set the entrypoint with profiles directory
ENTRYPOINT ["/pv-service", "--sharkd", "/usr/cloudshark/bin/sharkd", \
            "--config-dir", "/config", \
            "--captures-dir", "/data/captures", \
            "--profiles-dir", "/data/profiles"]

This approach bundles profiles with your container image, ensuring consistent configuration across deployments.

Volume Mounts

Alternatively, mount your profiles directory when running the container:

docker run --rm -p 443:443 \
  -v /path/to/profiles:/data/profiles \
  packet-viewer:[version]

This approach allows you to modify profiles without rebuilding the container.

Multiple Profile Directories

To layer profiles from multiple sources:

docker run --rm -p 443:443 \
  -v /path/to/stock-profiles:/usr/share/profiles \
  -v /path/to/custom-profiles:/data/profiles \
  packet-viewer:[version] \
  --profiles-dir /usr/share/profiles \
  --profiles-dir /data/profiles

Profiles in /data/profiles will override profiles with the same name in /usr/share/profiles.

Using Profiles

When using the React component, specify a profile using the profile prop:

<PacketViewer profile="voip" file="capture.pcap" />

When using the API, include the profile parameter:

GET /api/packets/list?file=capture.pcap&profile=voip

If no profile is specified, Packet Viewer uses global default settings from /usr/cloudshark/share/wireshark/.

The profile picker in the status bar allows users to switch profiles dynamically. The profile prop sets the initial selection.