This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi, Given the following example:

local f= mycoolprotocol.fields
f.Length = ProtoField.uint32("MCP.Length","Length",base.DEC)
f.MsgType = ProtoField.uint16("MCP.MsgType","MsgType",base.DEC)

I have declared 2 Protofields. But imagine I have a repeating group or an array of items:

And the message body looks like so:

struct person
{
  int16 age;
  string name;
}
person[] p = new person[2];

Ideally, I would like to create a subtree in Wireshark for that group

+ Persons
 + Person1
    name
    age
 + Person2
    name
    age

The problem is I don't know how to structure this in Lua. This declares 2 protofields:

f.name = Protofield.string("MCP.name","name","Text")
f.age = ProtoField.uint16("MCP.age","age",base.DEC)

But I'd like to create a dynamic array of the group instead, so I can do:

subtree:add_le( f[0].name, buffer(x,y))

So, is there a Protofield.ProtoFieldArray? Is it possible? Any other ideas are welcome.

Thanks

asked 12 Dec '13, 01:14

Lews%20Therin's gravatar image

Lews Therin
11447
accept rate: 100%

edited 12 Dec '13, 01:15


It turns out I can reuse the same fields to build the tree.

So in pseudocode:

begin loop
  subtree= mainsubtree:add(a,buffer())
  subtree:add(f.name, buffer(x,y))
  subtree:add(f.age, buffer(x+name.length,y))
end

So f.name f.age doesn't get overwritten by a newer value. I guess it is just a placeholder for the ProtoField

permanent link

answered 12 Dec '13, 06:02

Lews%20Therin's gravatar image

Lews Therin
11447
accept rate: 100%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×637
×431
×173
×12

question asked: 12 Dec '13, 01:14

question was seen: 7,127 times

last updated: 12 Dec '13, 06:02

p​o​w​e​r​e​d by O​S​Q​A