How to Display DSCP Column as a DEC or HEX Value as Needed

Question

Keywords: Differentiated Services, DifServ, TOS,

I know how to display the column:

Field Name: ip.dsfield.dscp

How do we force that output to display in DEC (decimal) or HEX or even BIN if wanted?

William...

Answer 1

For changing the value from hex to decimal, I don't believe there's any way to toggle that for a given field type in Wireshark. TOS/DSCP does have a preference for switching between two formats, but not a preference for changing the field from hex to decimal. Personally I'd prefer the IETF notation (AF12, EF, etc.).

This seems to be controlled around the 2,000 line mark in the packet-ip.c file in Wireshark's source code:

if (g_ip_dscp_actif) {
  tf = proto_tree_add_uint_format(ip_tree, hf_ip_dsfield, tvb, offset + 1,
    1, iph->ip_tos, "Differentiated Services Field: 0x%02x "
    "(DSCP 0x%02x: %s; ECN: 0x%02x: %s)", iph->ip_tos,
    IPDSFIELD_DSCP(iph->ip_tos), val_to_str_ext_const(IPDSFIELD_DSCP(iph->ip_tos),
                                                      &dscp_vals_ext, "Unknown DSCP"),
    IPDSFIELD_ECN(iph->ip_tos), val_to_str_const(IPDSFIELD_ECN(iph->ip_tos),
                                                 ecn_vals, "Unknown ECN"));
field_tree = proto_item_add_subtree(tf, ett_ip_dsfield);
proto_tree_add_item(field_tree, hf_ip_dsfield_dscp, tvb, offset + 1, 1, ENC_NA);
proto_tree_add_item(field_tree, hf_ip_dsfield_ecn, tvb, offset + 1, 1, ENC_NA);
}