This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

lua: little-endian ProtoField

0

Is there a way to create a ProtoField and indicate that it is to be interpreted little-endian? I only find constructors for e.g. uint16, while the vtbuff does have methods to extract little-endian values (buff:le_uint16())

asked 28 May '14, 05:13

xtofl's gravatar image

xtofl
16●2●2●5
accept rate: 0%

One Answer:

1

You can use: t:add_le( proto_foo.fields.u16, buf(0,2) ) as mentioned in http://wiki.wireshark.org/LuaAPI/TreeItem

answered 04 Jun '14, 00:57

bavh's gravatar image

bavh
51●2
accept rate: 50%