This is a static archive of our old Q&A Site. Please post any new questions and answers at

display only portion of data field as column



my company is using custom data packets to send info to access points and other devices. i was wondering is there a way to have only a specific position in the data field byte array that can be displayed as a column (like data[52]), in the table.

alternatively can you create a custom column with labels that would display a string if data[52]==3 and another string in case another data[52]==4 , similar to the coloring rules, only with labels (as it is hard to remember which colors belong to each message)

asked 03 Mar '15, 03:40

emaayan's gravatar image

accept rate: 0%

One Answer:


See my answer to a similar questions.

To sum it up: Wireshark does not offer that functionality by default. You can however write a Post-Dissector (e.g. in Lua) and add your own fields to the frame, which can then be used to show data in a column.

See also here:


answered 03 Mar '15, 10:08

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
accept rate: 15%

actually the using color rules and then 'apply as column' on the color is pretty close to what i want, i understand that from 1.9.0 it's considered buggy?

(08 Mar '15, 08:14) emaayan

I think the Lua postdissector code would get you much closer to the desired result than anything of Wiresharks built in functionality.

(09 Mar '15, 13:44) Kurt Knochner ♦