I'm wondering how to get the fields declared in a Lua dissector searchable in the filter bar. When trying to declare fields the same way as in various tutorials/samples, despite the fact that the dissector works fine, packets are recognized and decoded, the fields are unavailable to search. Example :
Are custom fields supposed to be searchable? asked 06 Dec ‘13, 06:17 lepolac edited 06 Dec ‘13, 13:26 multipleinte… |
One Answer:
You get the error message "myproto.f_data is neither a field nor a protocol name" because you have used a different string for your field's filter string. Try In the line
answered 06 Dec '13, 13:30 multipleinte... |
Hi,
Thanks for answering this. I tried to rename the field but still get the error. Below code for the sake of example :
In this code, you haven’t added the
f_data
field to any part of the tree. You have, however, added thef_command
field, so you should be able to filter on myproto.command. Have you looked at the examples at http://wiki.wireshark.org/Lua/Examples ?Hi, Sorry, didn’t catch that one.. This is not my actual dissector, was just trying to quickly give an example. myproto.command doesn’t work either, I still get myproto.command isn’t a valid display filter. By the way, I tested dozens of various dissectors I found, including the simplest wiki examples, and none of them allow me to access field in the filter. Maybe I’m doing something the wrong way…