custom lua dissector not called when llc dsap 0x44

I assume your code example is fake, rather than from the real script code, since it uses illegal variable names. (dashes are illegal in names) But the general concept of the script appears ok.

Some basic questions:

1. Do you know that your script is actually being loaded at all? For example if you put a syntactic error in it does wireshark error trying to load it, or if you put a print statement in it does it print when wireshark loads?

2. Is your packet the right kind of packet for that “llc.dsap” table - I don’t know anything about LLC packets, but it appears that “llc.dsap” table only gets looked up for specific xDLC packets, for control information types. It looks like your example packet in the capture above is the right type, but I don’t know for sure.

3. Can you post the capture file somewhere? Like on cloudshark or someplace public?

Hi Hadriel, Sorry for not describe it clearly.

1.Following is detailed code.

qos_llc_data_proto = Proto ("qos-llc-data", "qos test llc data", "protocol qos test llc data")

local f_llc_u8_type = ProtoField.uint8("qos-llc-data.type", "type", base.DEC)
local f_llc_u16_sequence = ProtoField.uint16("qos-llc-data.sequence", "sequence", base.DEC)
local f_llc_u32_tick = ProtoField.uint32("qos-llc-data.tick", "tick", base.DEC)
local f_llc_u8_priority = ProtoField.uint8("qos-llc-data.priority", "priority", base.DEC)
local f_llc_bytes_data = ProtoField.bytes("qos-llc-data.bytesData", "data", base.DEC)
qos_llc_data_proto.fields = { f_llc_u8_type, f_llc_u16_sequence, f_llc_u32_tick, f_llc_u8_priority, f_llc_bytes_data }
f_proto = DissectorTable.new("gnunet.proto", "Gnunet Protocoll", FT_UINT16, BASE_DEC)
function qos_llc_data_proto.dissector(buffer,pinfo,tree)
pinfo.cols.protocol:set("qos-test-llc-data")
pinfo.cols.info:set("qos test llc data")

local buffer_len = buffer:len()
local myProtoTree = tree:add(qos_llc_data_proto, buffer(0, buffer_len), "qos-test-llc-data")

buffer:len_asdf()

local offset = 0
myProtoTree:add_le(f_llc_u8_type, buffer(offset, 1))
offset = offset + 1

myProtoTree:add_le(f_llc_u16_sequence, buffer(offset, 2):uint())
offset = offset + 2

myProtoTree:add_le(f_llc_u32_tick, buffer(offset, 4):uint())
offset = offset + 4

myProtoTree:add_le(f_llc_u8_priority, buffer(offset, 1))
offset = offset + 1

myProtoTree:add_le(f_llc_bytes_data, buffer(offset, (buffer_len - offset)))

end
local my_dsap = 68
local llc_table = DissectorTable.get("llc.dsap")
llc_table:add(68, qos_llc_data_proto)

2 From picture, you can find size of LLC packet is 1052, so i want to parse its data field as above code. I don’t how to add my dissector to it or how to parse it. I already use similar dissector and add it to port of UDP, and it can works well.

1. I already checked that llc_table is not nil after it is get from DissectorTable.get(“llc.dsap”).
2. From picture, you can find DSAP field of packet is 0x44.

1. I tried add some error in dissector function qos_llc_data_proto.dissector(buffer,pinfo,tree), find the dissector is not loaded. I don’t know why?

What kind of error did you try to introduce in the dissector? The error needs to be a syntactic Lua error, as opposed to just accessing an invalid/non-existent function (for example). Because during load the script is parsed by the Lua interpreter, but the dissector function code isn’t actually executed yet until later. So the error needs to be something fundamentally invalid in Lua language. For example, just put the word “foobar” on a line, even outside the dissector function… like at the top of your script.