This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to Display DSCP Column as a DEC or HEX Value as Needed

0

Keywords: Differentiated Services, DifServ, TOS,

I know how to display the column:

Field Name: ip.dsfield.dscp

How do we force that output to display in DEC (decimal) or HEX or even BIN if wanted?

William...

asked 17 Apr '14, 08:44

WAudette's gravatar image

WAudette
1111
accept rate: 0%

Hi William,

That’s a great question and yes, it’s tough to find the answer.

Essentially, you to add an “IP DSCP Value” column. Remember that there are two ways to add columns – you can right click on the DSCP line in an IP header and choose Apply Column. You can also choose Preferences | Columns. That’s what you want to do to see the IP DSCP value in decimal.

In the Preferences | Columns area, click Add. Select IP DSCP Value for the field type. Click on the Title column to enter a new name. Click anywhere in the white space before clicking OK (this gets you out of edit mode).

alt text

Let me know if that doesn’t work for you!

Laura Chappell

(17 Apr '14, 14:32) WAudette

One Answer:

0

For changing the value from hex to decimal, I don't believe there's any way to toggle that for a given field type in Wireshark. TOS/DSCP does have a preference for switching between two formats, but not a preference for changing the field from hex to decimal. Personally I'd prefer the IETF notation (AF12, EF, etc.).

This seems to be controlled around the 2,000 line mark in the packet-ip.c file in Wireshark's source code:

if (g_ip_dscp_actif) {
  tf = proto_tree_add_uint_format(ip_tree, hf_ip_dsfield, tvb, offset + 1,
    1, iph->ip_tos, "Differentiated Services Field: 0x%02x "
    "(DSCP 0x%02x: %s; ECN: 0x%02x: %s)", iph->ip_tos,
    IPDSFIELD_DSCP(iph->ip_tos), val_to_str_ext_const(IPDSFIELD_DSCP(iph->ip_tos),
                                                      &dscp_vals_ext, "Unknown DSCP"),
    IPDSFIELD_ECN(iph->ip_tos), val_to_str_const(IPDSFIELD_ECN(iph->ip_tos),
                                                 ecn_vals, "Unknown ECN"));

field_tree = proto_item_add_subtree(tf, ett_ip_dsfield); proto_tree_add_item(field_tree, hf_ip_dsfield_dscp, tvb, offset + 1, 1, ENC_NA); proto_tree_add_item(field_tree, hf_ip_dsfield_ecn, tvb, offset + 1, 1, ENC_NA); }

answered 17 Apr ‘14, 18:26

Quadratic's gravatar image

Quadratic
1.9k6928
accept rate: 13%

edited 17 Apr ‘14, 18:27