Ask Your Question

Wireshark column - how to display "value" only?

asked 2018-08-08 10:18:48 +0000

updated 2018-08-08 10:21:36 +0000

Hi all,

Could you please tell if it is possible to set Wireshark column to display only actual field value, but not description of it?

Pls see screenshot attached containing OSPF protocol. I'd rather have LS types displayed as numbers 1 to 9, not as such extra-long descriptions.

PCAP sample

image description

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2018-08-08 14:23:06 +0000

cmaynard gravatar image

Yes, this is possible to do. The easiest way is to right-click on the column heading and de-select Resolve Names.

You can also manually edit your preferences file and change the behavior too:

  • Open your preferences file.
  • Search for gui.column.format
  • Modify the LS Type entry, replacing R with U
  • Restart Wireshark

The R is for Resolved; the U is for Unresolved.

One feature that's lacking is the inability to change this from the Edit -> Preferences -> Columns dialog. A Wireshark enhancement bug should probably filed for this.

edit flag offensive delete link more


Many thanks Christopher! It works.

Packet_vlad gravatar imagePacket_vlad ( 2018-08-08 14:42:47 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2018-08-08 10:18:48 +0000

Seen: 345 times

Last updated: Aug 08 '18