I've been building a post dissector in Lua for the last month, and have used pinfo.columns.protocol:set("G2S") to assign packets the G2S name in the Protocol column that I've identified as my application protocol. In V1.4.x, this worked just fine. But now with 1.6, my first identified packet displays G2S in the protocol column, but all subsequent packets continue to show HTTP/XML. When I look at these HTTP/XML packets, they are green highlighted, meaning WireShark has identified them as part of my protocol, and I find my G2S Protocol Post Dissector tree in the middle pane. So my protocol is being properly identified, and my Post Dissector is executing. But my setting of pinfo.columns.protocol is being ignored.
Has anyone else also seen this behavior? If others are seeing that it worked in 1.4.x and no longer does in 1.6, then I'll file this as a bug.
asked 10 Jun '11, 14:12
retagged 10 Jun '11, 18:11
Just thought I'd point out that you can shorten
I just confirmed this behavior in 1.7.0 (Ubuntu 11.04, 64-bit), but it seems inconsistent in that it happens only when setting the column text inside an
Based on the sample code from the Wireshark wiki:
answered 10 Jun ‘11, 18:08
This is discussed in bug 6020, and there's a patch attached to that bug to fix it as well.
answered 19 Feb '13, 11:21