Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Adding DSCP column in Wireshark 1.4.0rc1

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 2 Jul 2010 12:11:03 -0700
On Jul 1, 2010, at 8:24 AM, Keith French wrote:

> It is only the DSCP filter that causes this problem, not the one for 802.1P 
> COS. When set to be unresolved in the Column context menu, the COS value 
> shown for each packet is in decimal. The only problem then is that the DSCP 
> column unresolved shows a packet's value in hex, not decimal.
> 
> In V1.2.x where the filter used to be:-
> 
> ip.dscp.value

In no version of Ethereal/Wireshark that we ever shipped was there a field named "ip.dscp.value"; the field for the Differentiated Services Code Point has always been named "ip.dsfield.dscp", dating back to January 2000.  (I tried it with a 1.2.x release; it did *not* allow filtering on "ip.dscp.value", and *did* allow filtering on "ip.dsfield.dscp".)

The change that caused the problem was not a change to the field for the DSCP; the change was, as noted by Jaap Keuter, that 1.2.x had several column types that were removed in 1.3.x/1.4.x in favor of using the new "custom columns" feature:

> 1.2.x was a bit different. There you had a program defined column type DSCP, 
> which was filled in by the dissector with the unresolved value of the field.
> 
> The new development and 1.4 branch code tries to convert these program defined 
> column types into custom columns in order to reduce the number of program 
> defined columns.

so it's not that the field name changed - it didn't - it's that the way the column is generated changed.

> It would be very useful if there was 
> a way to display the entries for packets in decimal.

I suspect the code point is displayed in hex because it's specified in binary - see, for example:

	http://www.iana.org/assignments/dscp-registry/dscp-registry.xml

However, if people are used to seeing it in decimal, the ip.dsfield.dscp field could be changed to be displayed either in decimal or in decimal and hex, which would affect both the display in the packet detail field and the display when the field is used as a custom column.