Wireshark-dev: Re: [Wireshark-dev] Diameter Code Status Display Question
From: Jeff Morriss <[email protected]>
Date: Mon, 14 Feb 2011 11:07:12 -0500
Rick Gudmundson wrote:
I'm playing around with a customized diameter profile with respect to the columns. I'm getting different results between the command code and the result code.
If I add a new custom column for the result code, it gets presented as 
its enumerated value. So instead of 2001 it prints "DIAMETER_SUCCESS". 
If I do the same for the command code, it instead prints 280 instead of 
Device-WatchdogAnswer. The difference is that the result code is an AVP 
while the command code is a fixed three bytes in the diameter protocol.
I'd like to change my presentation, if possible, to print the text 
version of the command code, but I'm not sure where to find that part of 
the code within Wireshark.
I don't think it can be made to work like you want.

You get result codes listed as strings because (eventually) the hf_ entry for the AVP can be registered with a (single) value_string in the FIELDCONVERT field. That is, there's only one possible value for any given result-code number.
This is also why you can enter a display filter like:

diameter.Result-Code == "DIAMETER_SUCCESS"

Command codes, OTOH, have numerous name spaces, depending on the VendorID. In order to know the integer<->string mapping you need to know both the Command Code and the Vendor ID. Wireshark can't (AFAIK) handle the fact that, to look up the string value for command code 42, you need to also know the VendorID.
(Wireshark can, when building the protocol tree, show you the 
appropriate string for a given VendorID+CommandCode because the 
dissector has access to both fields before generating the string 
presentation.)