Columns display format

asked 2017-11-20 07:44:59 +0000

franjorge
1 ●2 ●3 ●2

Hello,

I was wondering if there is a way to change the format of the data shown in the columns of the packet list.

For example, I have created a column that displays the ip.tos.precedence value of the packets. What that column displays is the names of the precedence ("inmediate,routine", "routine,routine", ...). Is it possible to show the content of that field as decimal values ("2", "0") or binary values ("101", "000")?

Thanks in advance. Fran

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2017-11-20 13:19:49 +0000

Jaap

13742 ●711 ●115

Changing the format of a column is only available for the frame time column. All custom columns get the presentation from the field they represent.

edit flag offensive delete link

Comments

OK. Thanks for your answer.

I think this could be a nice feature to add.

Regards, Fran

franjorge ( 2017-11-20 14:42:01 +0000 )edit

The way dissection of protocols is done, I'm afraid adding such feature won't be that easy. When writing a dissector for a particular protocol field, you basically tell the common dissection engine to take a byte or bit range, assign it a name and choose the field type (string, signed/unsigned integer, enumeration of text names etc.). So to allow choosing from several different output conversions for eligible fields, a new method would have to be added and integrated to the UI of both Wireshark and tshark, and the choice for each field would have to be stored in the preference file(s).

Having said that, I would suggest you a workaround: have a look at Lua dissectors. If you need the numeric representation only for a single field of the IP layer, you can save the link to the ip dissector and replace it in all dissector ...(more)