Ask Your Question
0

Wireshark column - how to display "value" only?

asked 2018-08-08 10:18:48 +0000

Packet_vlad gravatar image

updated 2018-08-08 10:21:36 +0000

Hi all,

Could you please tell if it is possible to set Wireshark column to display only actual field value, but not description of it?

Pls see screenshot attached containing OSPF protocol. I'd rather have LS types displayed as numbers 1 to 9, not as such extra-long descriptions.

PCAP sample

image description

edit retag flag offensive close merge delete
add a comment

1 Answer

Sort by ยป oldest newest most voted
2

answered 2018-08-08 14:23:06 +0000

cmaynard gravatar image

Yes, this is possible to do. The easiest way is to right-click on the column heading and de-select Resolve Names.

You can also manually edit your preferences file and change the behavior too:

  • Open your preferences file.
  • Search for gui.column.format
  • Modify the LS Type entry, replacing R with U
  • Restart Wireshark

The R is for Resolved; the U is for Unresolved.

One feature that's lacking is the inability to change this from the Edit -> Preferences -> Columns dialog. A Wireshark enhancement bug should probably filed for this.

edit flag offensive delete link more

Comments

Many thanks Christopher! It works.

Packet_vlad gravatar imagePacket_vlad ( 2018-08-08 14:42:47 +0000 )edit

Issue 15394 - It should be possible to set columns as resolved/unresolved via Edit -> Preferences -> Columns. has been fixed, and the feature will be available in the next major release of Wireshark, 4.0, whenever it's released, which according to the Roadmap will likely be some time in August or maybe September of 2022.

cmaynard gravatar imagecmaynard ( 2022-07-01 15:03:41 +0000 )edit
add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

subscribe to rss feed

Stats

Asked: 2018-08-08 10:18:48 +0000

Seen: 1,448 times

Last updated: Aug 08 '18