This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Keywords: Differentiated Services, DifServ, TOS,

I know how to display the column:

Field Name: ip.dsfield.dscp

How do we force that output to display in DEC (decimal) or HEX or even BIN if wanted?

William...

asked 17 Apr '14, 08:44

WAudette's gravatar image

WAudette
1111
accept rate: 0%

Hi William,

That’s a great question and yes, it’s tough to find the answer.

Essentially, you to add an “IP DSCP Value” column. Remember that there are two ways to add columns – you can right click on the DSCP line in an IP header and choose Apply Column. You can also choose Preferences | Columns. That’s what you want to do to see the IP DSCP value in decimal.

In the Preferences | Columns area, click Add. Select IP DSCP Value for the field type. Click on the Title column to enter a new name. Click anywhere in the white space before clicking OK (this gets you out of edit mode).

alt text

Let me know if that doesn’t work for you!

Laura Chappell

(17 Apr '14, 14:32) WAudette

For changing the value from hex to decimal, I don't believe there's any way to toggle that for a given field type in Wireshark. TOS/DSCP does have a preference for switching between two formats, but not a preference for changing the field from hex to decimal. Personally I'd prefer the IETF notation (AF12, EF, etc.).

This seems to be controlled around the 2,000 line mark in the packet-ip.c file in Wireshark's source code:

if (g_ip_dscp_actif) {
  tf = proto_tree_add_uint_format(ip_tree, hf_ip_dsfield, tvb, offset + 1,
    1, iph->ip_tos, "Differentiated Services Field: 0x%02x "
    "(DSCP 0x%02x: %s; ECN: 0x%02x: %s)", iph->ip_tos,
    IPDSFIELD_DSCP(iph->ip_tos), val_to_str_ext_const(IPDSFIELD_DSCP(iph->ip_tos),
                                                      &dscp_vals_ext, "Unknown DSCP"),
    IPDSFIELD_ECN(iph->ip_tos), val_to_str_const(IPDSFIELD_ECN(iph->ip_tos),
                                                 ecn_vals, "Unknown ECN"));

  field_tree = proto_item_add_subtree(tf, ett_ip_dsfield);
  proto_tree_add_item(field_tree, hf_ip_dsfield_dscp, tvb, offset + 1, 1, ENC_NA);
  proto_tree_add_item(field_tree, hf_ip_dsfield_ecn, tvb, offset + 1, 1, ENC_NA);
}
permanent link

answered 17 Apr '14, 18:26

Quadratic's gravatar image

Quadratic
1.9k6928
accept rate: 13%

edited 17 Apr '14, 18:27

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×5
×5
×3
×2
×1

question asked: 17 Apr '14, 08:44

question was seen: 23,285 times

last updated: 18 Apr '14, 01:44

p​o​w​e​r​e​d by O​S​Q​A