This is our old Q&A Site. Please post any new questions and answers at

I made dissector in Lua as following. And decorded as "MYPROTO" TCP payload. When the first byte of TCP palyload is 0x02, dissector shows "First byte: Two (2)". But the first byte is not 0x02 (for example 0x01), dissector shows "First byte: Unknown (1)". I want to show "First byte: Not two (1)". How can I replace default string ("Unknown") to other string?

local myproto = Proto("myproto", "My Protocol")
myproto.fields = {ProtoField.uint8("myproto.firstbyte", "First byte", base.DEC, {[2] = "Two"})}
function myproto.dissector (buf, pkt, root)
   local t = root:add(myproto, buf())
   t:add(myproto.fields[1], buf(0, 1))
DissectorTable.get("tcp.port"):add(10000, myproto)

asked 07 Apr '15, 20:55

cosmos's gravatar image

accept rate: 0%

You can add your own string like this

local myproto = Proto("myproto", "My Protocol") function myproto.dissector (buf, pkt, root) local t = root:add(myproto, buf()) local s1 = "Mystring" t:add(buf(0, 1),string.format("First Byte: %s %d",s1,buf(0,1):uint())) end local tcp_table = DissectorTable.get("tcp.port") tcp_table:add(8443, myproto) tcp_table:add(61639, myproto)

You can also append the text after buf like this t:add(buf(0, 1),string.format("First Byte: %s %d",s1,buf(0,1):uint())):append_text("Demo")

permanent link

answered 08 Apr '15, 22:49

ankit's gravatar image

accept rate: 25%

Do you want to say that I should not use valuestring feature of ProtoFiled()?

(08 Apr '15, 23:22) cosmos

if you want to use valuestring then you have to create each and every entry of first byte of TCP payload of each and every frame in your pcap file. like this myproto.fields = {ProtoField.uint8("myproto.firstbyte","1st byte",base.DEC,{ [0]="zero", [1]="one", [2]="two", })}

(09 Apr '15, 04:29) ankit

Thank you very much. I understand.

(09 Apr '15, 17:03) cosmos
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 07 Apr '15, 20:55

question was seen: 2,409 times

last updated: 09 Apr '15, 17:03

p​o​w​e​r​e​d by O​S​Q​A