lua script to force interpret mpls payload as ether frame without PW

Question

Trying to have a lua script to interpret mpls payload as ether frame without control word.

I have to match certain mpls label value. Is there any way to match all label values? Looks like dissectortable:add(pattern, dissector) doesn't like regex in pattern

Here is the script.

local dis_eth = Dissector.get("eth")
local mpls_table = DissectorTable.get("mpls.label")
mpls_table:add(261,dis_eth)

Answer 1

2

It does not like a pattern because the "pattern" values in the DissectorTable are indices to it, so using a pattern would require a change of the lookup method from the current plain

dissector_to_use = table[value_x]

to a more complex (and thus much slower) procedure involving regex-based matching of the plain value_x against the list of all defined key values of an associative table where the key values would be the regexes.

Repeating my suggestion in the follow-up of my answer to your older question, you may want to file a "nice to have" category bug at Wireshark bugzilla, asking for a generic mechanism allowing some kind of reserved index value (such as other) to be used to set a default dissector (using Decode as... or Lua DissectorTable:add) for a given DissectorTable, which could still be overridden by the individual ones (meaning that if nothing would be found in the table for the given value, the default dissector would be used).

You may also ask for the regex way, maybe there is a way to implement use of regex (or numeric ranges) which would not cause a big slowdown, I'm not that deep in programming.

In any case, it is a matter for bugzilla, not for Q&A.

answered 08 Mar '16, 08:38

sindy
6.0k●4●8●51
accept rate: 24%

Thanks Sindy. I am new to wireshark. Will check how to file a "nice to have" bug.

Trying to find an immediate way to solve my need as for now. Where can I find all the available DissectorTable for mpls? Trying to use something like DissectorTable.get("mpls.ttl"), but the DissectorTable doesn't exist.

(08 Mar '16, 09:01) yacare

"All the available payload dissector tables for MPLS" are the single one which uses MPLS label as an index, as you can see when you click Decode as.... The dissector tables for choosing payload dissector per transport's field are hardcoded - normally, the most logical field is chosen, which is the label in case of MPLS. I. e. you cannot arbitrarily choose any field of the transport protocol and dynamically attach to it a dissector table. The reason is once again the processing speed, if done that way, each dissector would have to go field by field and check whether by chance a table isn't hooked to it.

(08 Mar '16, 12:58) sindy

we were using a slight modification to this:

local dis_eth = Dissector.get("eth") local mpls_table = DissectorTable.get("mpls.label") for label=0,1048575 do mpls_table:add(label,dis_eth) end

now, in the recent wireshark versions (cannot tell when it started) we receive the error

Lua: Error during loading: [string "path"]:1: bad argument #1 to 'get' (Dissector_get: No such dissector)

any hint or idea what we may do to make this working again ?

(21 Oct '16, 02:26) x42

@x42, your post was not an Answer to the original Question, so I've converted it into a Comment.

The issue you are facing is related to a change of ethernet handling in 2.2.0. You can find all you need in answers to this and this Question.

(21 Oct '16, 02:32) sindy

cool ... thanks a lot for your info :-)

so we have simply substituted "eth" in our script with "eth_withoutfcs" and are able to work again.

our script IS working for all mpls-labels ... well it's ugly, since we have a huge loop, but wireshark seem to be able to handle this very nicely ;-)

we are still facing a slight complication detemining whether we have a control-word (cw) present or not: mpls-traffic flowing through our core-routers contain a mix of frames with and without cw.

it is not a big problem since we are planning to turn on cw's on all traffic, yet we may post a detailed question about this in future ...

(21 Oct '16, 02:53) x42

so we have simply substituted "eth" in our script with "eth_withoutfcs" and are able to work again.

If you do not need that your Lua dissector is backward compatible, it is enough indeed.

we may post a detailed question about this in future ...

Before doing that, please have a look at this Question:

(21 Oct '16, 03:00) sindy

great ... thanks a lot again for your extremely quick and competent answers :-)

(21 Oct '16, 03:03) x42

showing 5 of 7 show 2 more comments