Format column display

edit

But i display it as a string with the function proto_tree_add_uint_format_value

Don't do that.

Instead, display it as a string and a number by doing

static const value_string event_type_vals[] = {
    { 0,       "Start" },
    { 1,       "Stop" },
    { 0, NULL },
};

...

{ &hf_EventType,
    { "Event Type", "rtcp_stats.event_type", FT_UINT8, BASE_DEC,
       VALS(event_type_vals), 0x0, NULL, HFILL }  }

and just add it to the protocol tree with

proto_tree_add_item(rtcp_stats_tree, hf_EventType, tvb,
    nOffset, 1, ENC_NA);

and let the Wireshark dissector core do the work of showing it as a string for you.

That will also allow doing

rtcp_stats.event_type=="Start"

in a packet-matching expression.

As you have declared the field as FT_UINT8 the field will be displayed and filtered as an unsigned integer.

To have the field displayed as a string, declare a field as a string (FT_STRING) and use proto_tree_add_string() setting the last parameter (value) to point to the appropriate strings in your code. Note that the item is then marked as generated to show that the string doesn't exist in the packet, but is generated from other values:

proto_item *pi = proto_tree_add_string(rtcp_stats_tree, hf_EventTypeString, tvb, nOffset, 1, EventType ? "Stop" : "Start");
proto_item_set_generated(pi);

...

{ &hf_EventTypeString, { "Event Type String", "rtcp_stats.event_type_string", FT_STRING, STR_ASCII, NULL, 0x0, NULL, HFILL }  }