Lua Post Dissector from 1.4 breaks in 1.6

Question

I've been building a post dissector in Lua for the last month, and have used pinfo.columns.protocol:set("G2S") to assign packets the G2S name in the Protocol column that I've identified as my application protocol. In V1.4.x, this worked just fine. But now with 1.6, my first identified packet displays G2S in the protocol column, but all subsequent packets continue to show HTTP/XML. When I look at these HTTP/XML packets, they are green highlighted, meaning WireShark has identified them as part of my protocol, and I find my G2S Protocol Post Dissector tree in the middle pane. So my protocol is being properly identified, and my Post Dissector is executing. But my setting of pinfo.columns.protocol is being ignored.

Has anyone else also seen this behavior? If others are seeing that it worked in 1.4.x and no longer does in 1.6, then I'll file this as a bug.

Thanks

Answer 1

Just thought I'd point out that you can shorten

pinfo.columns.protocol:set("G2S")

to:

pinfo.cols.protocol = "G2S"

I just confirmed this behavior in 1.7.0 (Ubuntu 11.04, 64-bit), but it seems inconsistent in that it happens only when setting the column text inside an if block, as shown below. I agree you should file a bug.

Based on the sample code from the Wireshark wiki:

-- trivial postdissector example
-- declare some Fields to be read
ip_src_f = Field.new("ip.src")
ip_dst_f = Field.new("ip.dst")
tcp_src_f = Field.new("tcp.srcport")
tcp_dst_f = Field.new("tcp.dstport")
– declare our (pseudo) protocol
trivial_proto = Proto("trivial","Trivial Postdissector")
– create the fields for our "protocol"
src_F = ProtoField.string("trivial.src","Source")
dst_F = ProtoField.string("trivial.dst","Destination")
conv_F = ProtoField.string("trivial.conv","Conversation","A Conversation")
– add the field to the protocol
trivial_proto.fields = {src_F, dst_F, conv_F}
– create a function to "postdissect" each frame
function trivial_proto.dissector(buffer,pinfo,tree)
– obtain the current values the protocol fields
local tcp_src = tcp_src_f()
local tcp_dst = tcp_dst_f()
local ip_src = ip_src_f()
local ip_dst = ip_dst_f()
--###############################################################
--# XXX: If we set the column here, the text always shows up
--# properly in the Protocol column.
--###############################################################
--pinfo.cols.protocol = &quot;Trivial&quot;
pinfo.cols.protocol:set(&quot;Trivial&quot;)

if tcp_src then

   --###############################################################
   --# FIXME: But if we set the column here, the Protocol column
   --# is almost always not set to &quot;Trivial&quot; (or it&#39;s overwritten).
   --# The packets that do have &quot;Trivial&quot; in its Protocol column
   --# won&#39;t necessarily show it again when the pcap is reloaded.
   --###############################################################
   --pinfo.cols.protocol = &quot;Trivial&quot;
   pinfo.cols.protocol:set(&quot;Trivial&quot;)

   local subtree = tree:add(trivial_proto,&quot;Trivial Protocol Data&quot;)
   local src = tostring(ip_src) .. &quot;:&quot; tostring(tcp_src)
   local dst = tostring(ip_dst) .. &quot;:&quot; tostring(tcp_dst)
   local conv = src  .. &quot;-&gt;&quot; .. dst
   subtree:add(src_F,src)
   subtree:add(dst_F,dst)
   subtree:add(conv_F,conv)
end

end
– register our protocol as a postdissector
register_postdissector(trivial_proto)

Answer 2

This is discussed in bug 6020, and there's a patch attached to that bug to fix it as well.