This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I made dissector in Lua as following. And decorded as "MYPROTO" TCP payload. When the first byte of TCP palyload is 0x02, dissector shows "First byte: Two (2)". But the first byte is not 0x02 (for example 0x01), dissector shows "First byte: Unknown (1)". I want to show "First byte: Not two (1)". How can I replace default string ("Unknown") to other string?

local myproto = Proto("myproto", "My Protocol")
myproto.fields = {ProtoField.uint8("myproto.firstbyte", "First byte", base.DEC, {[2] = "Two"})}
function myproto.dissector (buf, pkt, root)
   local t = root:add(myproto, buf())
   t:add(myproto.fields[1], buf(0, 1))
end
DissectorTable.get("tcp.port"):add(10000, myproto)

asked 07 Apr '15, 20:55

cosmos's gravatar image

cosmos
6224
accept rate: 0%


You can add your own string like this

local myproto = Proto("myproto", "My Protocol") function myproto.dissector (buf, pkt, root) local t = root:add(myproto, buf()) local s1 = "Mystring" t:add(buf(0, 1),string.format("First Byte: %s %d",s1,buf(0,1):uint())) end local tcp_table = DissectorTable.get("tcp.port") tcp_table:add(8443, myproto) tcp_table:add(61639, myproto)

You can also append the text after buf like this t:add(buf(0, 1),string.format("First Byte: %s %d",s1,buf(0,1):uint())):append_text("Demo")

permanent link

answered 08 Apr '15, 22:49

ankit's gravatar image

ankit
65232328
accept rate: 25%

Do you want to say that I should not use valuestring feature of ProtoFiled()?

(08 Apr '15, 23:22) cosmos
1

if you want to use valuestring then you have to create each and every entry of first byte of TCP payload of each and every frame in your pcap file. like this myproto.fields = {ProtoField.uint8("myproto.firstbyte","1st byte",base.DEC,{ [0]="zero", [1]="one", [2]="two", })}

(09 Apr '15, 04:29) ankit

Thank you very much. I understand.

(09 Apr '15, 17:03) cosmos
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×637
×431
×29

question asked: 07 Apr '15, 20:55

question was seen: 2,143 times

last updated: 09 Apr '15, 17:03

p​o​w​e​r​e​d by O​S​Q​A