Revision history [back]

Hi Kurniawan,

First of all, "QoS" is usually at the IP (or VLAN) layer not TCP itself.

I'll assume you are talking about IPv4 traffic to show you one way of getting the "QoS" info.

If you have captured IPv4 packets then expand Internet Protocol Version 4 in the packet details pane. You should be able to right click on the Differentiated Services Field line and Apply as Column to have all 8 bits of "QoS" marking shown in the packet list pane. The bits are shown in hex.

You may want to expand more if you only want Differentiated Services Codepoint (DSCP) or first 6 bits.

You have to know that Wireshark decodes the bits in the Type Of Service (TOS) field in the IPv4 header has DiffServ by default.

You can go to Edit - Preferences and find IPv4 under Protocols.

You can uncheck "Decode IPv4 TOS field as DiffServ field" if you want to see plain IP Preference.

Hope this helps.

Cheers,