# Wireshark Profiles Repository: importing shared capture profiles > This repository is a shared collection of Wireshark profiles, one ZIP per protocol, installed by importing the archive from the Wireshark GUI. The author treats the ZIP files as untrusted input and tells users to unpack them first. **amwalding/wireshark_profiles** — Here is my Wireshark Profiles repository. To grab the profiles, click the Release below. These ZIP files contain profiles that can be added to your Wireshark configuration to speed up troubleshooting and packet analysis in Wireshark. Please support my work - see the readme. - Repository: https://github.com/amwalding/wireshark_profiles - Website: https://www.cellstream.com/wireshark-profiles-repository/ - Stars: 621 · Forks: 126 - Language: Unknown - License: MIT - Published: 2026-10-22 · Updated: 2026-10-22 · Language: en - Canonical page: https://hysenlabs.com/projects/amwalding-wireshark-profiles ## One ZIP per protocol, sitting in the repository root There is no build system here, and that is the point. The top level of the repository is a flat list of ZIP archives named after what they dissect: ARP.zip, BGP Default.zip, DHCPv4.zip, DNS.zip, OSPF.zip, HTTP.zip, HTTPS and TLS.zip, ICMP.zip, MPLS.zip, ISCSI.zip, NVMe.zip, Infiniband.zip, CDP.zip, Check Point.zip, MGCP.zip, FCoE.zip and many more. There are IP-specific ones, IPv4 Default.zip, IPv6 Default.zip, IPv6 RA.zip, IPv6 NS.zip, IPv6 NA.zip, and there are variants that layer extra behaviour on top of a default profile, such as Better Default.zip, Better TCP Default.zip, Better Default with Packet Redaction.zip and Better Default with Packet Diagram.zip. The archive names are the documentation. Someone who wants a passive DNS view of a capture does not need to read a guide; they take DNS.zip and check whether the settings inside suit their traffic. The set also includes non-ZIP entries such as LICENSE and a compressed capture file, OLSNS_Comprehensive_Pcap_v12.pcapng.gz, which suggests a profile is sometimes shipped alongside the sample data it was written against. ## Importing a profile through the Wireshark GUI Installation is a GUI operation, and the README is explicit about the steps because the author says many of the people using Wireshark are not coders. 1. Download the profile you want. Every profile is distributed as a zipped file. 2. In the Wireshark GUI, right click on the lower right corner of the window, in the Profile box. 3. Choose Import, select the from zip file option, and pick the archive from your downloads directory. 4. Select the newly imported profile. There is no shell command for this in the repository, and there is no script. The import lands in your own Wireshark configuration directory alongside the profiles you created yourself, which means the profile sits in your machine's config, not in the capture directory. The capture file itself is untouched. The alternative route to the same profiles is the repository on the project's website, and there is also a Wireshark Profiles channel on Discord listed in the README for people who want to ask questions before importing. ## The author tells you to unzip and read first The most unusual thing in this repository is the security warning, and it comes from the author rather than from a scanning process. The README quotes a presenter at a Wireshark webinar who said he does not like sharing profiles, because you do not know what has been set in a profile you did not create yourself. The author's response is that someone could sneak something bad into a profile, so you should be wary, and that you should unzip a zipped profile and make sure it only contains TXT files. That instruction is specific and checkable, and it is the acceptance criterion for trusting anything in this repository. The author adds that the project states below what changes were made to the profiles offered, and that nothing the author would consider shady is posted. The comparison drawn is to open source software in general, where the possibility of a bad contribution exists too but does not stop people from using it. The honest reading is that a Wireshark profile is configuration, and configuration executes on your machine when you open a capture with it loaded, so treat the archive the way you would treat any configuration file from outside your team. ## Releases were parked because users are not coders The recent release list holds a single entry, v1-Wireshark-Profiles from 2025-04-21, while the last push to the repository was on 2026-10-06. That gap is explained at the top of the README rather than left as an accident. The author says he returned to simply listing the ZIP files in the repository, because many users of Wireshark are not coders and struggle with the normal Release page on GitHub. The all in one Release download was left in place, but the README states it will not be updated with the latest versions of the profiles going forward. So there are two distribution paths with different freshness. The Release artifact is a snapshot that is now well behind the working tree, and the per-profile ZIP files in the repository root are the current ones. For anyone pinning versions in a lab, the release tag gives a fixed point; for anyone who wants current settings, the root files are the source. The repository is not archived and the last push was on 2026-10-06, so the tree itself is being worked on, even though the published release has not moved. ## Contribution runs through email, not pull requests The repository does not accept community uploads directly, and the reason is stated: it would be unsafe to simply open this up to anyone who wishes to upload anything. If you want to contribute a profile, or you modify or improve one of the existing profiles, the instruction is to zip up the profile and email the author at andyw@cellstream.com. The author then posts received profiles in the repository. This is the clearest possible difference between this project and a normal open source repository. There is no fork and pull request path, no CI run on incoming content, and no per-contributor review trail beyond a single maintainer. In exchange you get a curated collection where the author states what was changed in each profile, and a smaller risk surface than an open upload area would have. The trade is that improvements are gated on one person, so a corrected setting for a protocol you depend on can take as long as it takes one person to unzip it and decide. ## Where a shared profile is the wrong tool Profiles solve a preference problem, not a discovery problem. A dissection profile changes which fields Wireshark decodes, how packets are coloured, which protocol decoders are enabled and how the interface presents the capture. If your problem is that Wireshark cannot interpret a protocol at all, no profile will fix it, because the dissector has to exist in the Wireshark build itself. There is a second limitation that the repository does not address: profiles are tied to a Wireshark version. The archive list includes protocol-specific settings such as HTTP with no HDR reassembly, HTTPS with HDR reassembly and IETFQUIC.zip or GQUIC.zip, and the behaviour of reassembly and checksum options moves between Wireshark releases. A profile imported from a shared collection can also collide with a profile of the same name you already have, and the README does not describe how to rename or remove an imported copy. The author argues that profiles are the most important capability of Wireshark for speeding up troubleshooting and eliminating false positives, and that is fair, but the speed comes from the settings you already understand, not from the settings you imported. ## Shared profiles versus building your own The alternative to this repository is the one the webinar presenter described: keep the profiles you created yourself. That approach has obvious advantages. You know exactly what every entry does, because you set it, and you can diff it against a colleague's copy. It also scales to an organisation better, since a team can version a profile inside its own configuration management and roll out changes with the same tooling it uses for everything else. The shared collection wins on a different axis: coverage and starting point. There are dozens of protocol profiles here, from BGP and OSPF routing to NVMe over fabrics, InfiniBand and NetSci real time media profiles, and some of them encode decisions that took the author a long time to make, such as redaction settings for packet display or packet diagram overlays. The honest comparison is between time spent and time borrowed. Importing BGP Default.zip gets you a routing view quickly, and reviewing its contents before importing keeps the risk that the author warns about down to the effort of reading a text file. ## Conclusion Adopt this repository if you want a ready made dissection setup for a protocol you analyse often and you are willing to read the profile contents before installing it. Skip it if you need settings you cannot verify, if your Wireshark version differs from the one the profile was written for, or if your organisation requires changes to arrive through an internal review. Verify first by unzipping any archive into a scratch directory and confirming the entries are the text files the README describes, then import the profile from that unpacked copy. ## FAQ ### How do I add a Wireshark profile from this repository to my installation? Download the zipped profile, then in the Wireshark GUI right click the lower right corner in the Profile box, choose Import, select the from zip file option, pick the archive from your downloads directory, and then select the newly imported profile. There is no command line method described in the README. ### What should I check before importing a Wireshark profile ZIP file? The README advises unzipping the archive and checking that it only contains TXT files. The author quotes a Wireshark webinar presenter who did not like sharing profiles because you do not know what has been set in a profile you did not create, and asks users to stay wary of that risk. ### How do I contribute a Wireshark profile to this repository? The README states it would be unsafe to open uploads to anyone who wished to upload anything, so contributions are sent by email. Zip up the profile and email it to andyw@cellstream.com, and the author posts received profiles in the repository. ## Sources - [amwalding/wireshark_profiles on GitHub](https://github.com/amwalding/wireshark_profiles) - [License: MIT](https://github.com/amwalding/wireshark_profiles/blob/main/LICENSE) - [Project website](https://www.cellstream.com/wireshark-profiles-repository/) - [README](https://github.com/amwalding/wireshark_profiles/blob/main/README.md) - [Releases](https://github.com/amwalding/wireshark_profiles/releases) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/amwalding-wireshark-profiles