My plugin postdissector dissects, and displays, newly added suboptions in the tcp options field. But I just noticed that I'm unable to filter these fields when I type tcp.options.foo in the filter bar(but tcp.options,foo still appears in the drop down box). When I type tcp.options.foo, it shows absolutely no packets. However, the filter seems to work just fine when I try to filter something like, say, tcp.options. What's the reason for this? Edit: No one has any ideas? :( asked 23 Aug '12, 21:46  SidR edited 24 Aug '12, 02:31 |
One Answer:
Unfortunately, there is only one postdissector as a "reference" (packet-prp.c). Did you check that? Maybe it helps to track down your problem. BTW: is it possible to post the code of your post dissector (on pastebin.com or so...)? Regards answered 26 Aug '12, 02:01  Kurt Knochner ♦ |
Thanks a lot for your reply Kurt. Just checked the packet-prp.c file, but I'm still unable to figure out where the problem might be.
I have pasted a part of my plugin post-dissector code here: http://pastebin.com/1kJ4fLHm
I'm sorry that I had to remove most of the data structures for my suboptions (which include some proprietary information), nevertheless all the essential parts have been included. I also recompiled my code with the above, but the problem persists.
Can anyone please tell me why the display filter does not work for the above code?