Columns display format

franjorge
1 ●2 ●3 ●2

Hello,

I was wondering if there is a way to change the format of the data shown in the columns of the packet list.

For example, I have created a column that displays the ip.tos.precedence value of the packets. What that column displays is the names of the precedence ("inmediate,routine", "routine,routine", ...). Is it possible to show the content of that field as decimal values ("2", "0") or binary values ("101", "000")?

Thanks in advance. Fran

add a comment

2 Answers

Sort by » oldest newest most voted

answered Nov 20 '17

Jaap

13782 ●715 ●115

Changing the format of a column is only available for the frame time column. All custom columns get the presentation from the field they represent.

link

Comments

OK. Thanks for your answer.

I think this could be a nice feature to add.

Regards, Fran

franjorge ( Nov 20 '17 )

The way dissection of protocols is done, I'm afraid adding such feature won't be that easy. When writing a dissector for a particular protocol field, you basically tell the common dissection engine to take a byte or bit range, assign it a name and choose the field type (string, signed/unsigned integer, enumeration of text names etc.). So to allow choosing from several different output conversions for eligible fields, a new method would have to be added and integrated to the UI of both Wireshark and tshark, and the choice for each field would have to be stored in the preference file(s).

Having said that, I would suggest you a workaround: have a look at Lua dissectors. If you need the numeric representation only for a single field of the IP layer, you can save the link to the ip dissector and replace it in all dissector ...(more)