# Wireshark preferences for VoIP analysis profile
# Network Analysis for VoIP Engineers — Cheesman Press
#
# Validated against Wireshark 4.6. Legacy pre-3.x keys (name_resolve,
# gui.time_format, gui.ms_timestamps, sip.reassemble, etc.) have been
# replaced with their modern equivalents.
#
# See profile installation instructions in README_PROFILE.txt

# ─────────────────────────────────────────────────────────────────
# COLUMN LAYOUT
# Time column uses %Rt (Relative time) — seconds since first packet,
# baked into the column so it survives GUI time-format changes.
# Delta column shows time since previous displayed packet — the key
# addition for spotting retransmit intervals (Timer T1: 0.5/1/2/4/8s).
# Right-click any INVITE > Set/Unset Time Reference to reset Time to 0
# at call start; relative time then shows seconds since that packet.
# ─────────────────────────────────────────────────────────────────
gui.column.format: "No.", "%m", "Time", "%Rt", "Source", "%s", "Destination", "%d", "Protocol", "%p", "Length", "%L", "Delta", "%Cus:frame.time_delta_displayed:0:R", "Info", "%i"

# ─────────────────────────────────────────────────────────────────
# NAME RESOLUTION — off for performance and clarity.
# (Replaces the pre-3.x single-boolean `name_resolve`.)
# ─────────────────────────────────────────────────────────────────
nameres.mac_name: FALSE
nameres.network_name: FALSE
nameres.transport_name: FALSE
nameres.use_external_name_resolver: FALSE

# ─────────────────────────────────────────────────────────────────
# SIP — reassemble headers and bodies across TCP segments.
# (Replaces the old `sip.reassemble`.)
# ─────────────────────────────────────────────────────────────────
sip.desegment_headers: TRUE
sip.desegment_body: TRUE

# ─────────────────────────────────────────────────────────────────
# TCP — reassemble streams and handle out-of-order segments (TCP SIP).
# ─────────────────────────────────────────────────────────────────
tcp.desegment_tcp_streams: TRUE
tcp.reassemble_out_of_order: TRUE

# ─────────────────────────────────────────────────────────────────
# PACKET LIST
# ─────────────────────────────────────────────────────────────────
gui.packet_list_separator.enabled: TRUE
gui.recent_files_count.max: 20

# ─────────────────────────────────────────────────────────────────
# TLS key log file — uncomment and update path to decrypt SIPS/TLS.
# ─────────────────────────────────────────────────────────────────
# tls.keylog_file: /path/to/sslkeylog.txt
