I have a protocol involving UDP over IP over Ethernet where the last byte of the Ethernet frame before the FCS is not part of the UDP/IP packet but appears as an Ethernet trailer. (I had to disable VSS-Monitoring protocol in Wireshark to see this as VSS-Monitoring keeps interpreting this byte which has nothing to do with VSS.) I need to access this last byte using my lua parser but I can't find a way to do it. I tried the following:
In the dissector:
But x is always returned as nil. I tried this same approach for the Ethernet source address (i.e. "eth.src" instead of "eth.trailer" in the above) and that works fine and returns the string with the Ethernet source address.
Can anyone please provide an approach I can use to access this Ethernet trailer byte?
This question is marked "community wiki".
asked 21 May '15, 12:13