This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Chained dissector not working

0

I'm trying to write a chained dissector for the CFLOW protocol, and was attempting to follow the example here: https://wiki.wireshark.org/Lua/Dissectors#chained_dissectors
However, when I try to use it in Wireshark I get the Lua Error: attempt to index upvalue 'original_cflow_dissector' (a nil value).

Does anyone have insight as to what I've done wrong?

I think it has to do with my get_dissector call calling the udp dissector instead of the cflow dissector, but I'm not sure how to fix that. Replacing udp.port with tcp.port obviously didn't work, but it does compile and run so that makes me think its not an issue with the depth of my variable declaration.

Here's the code - I replaced some parts with comments, but they should be working fine.

do
        --create the protocol
    --create the fields for our protocol

    --add the fields to the protocol

    --declare the fields to read

    local original_cflow_dissector
    function cflow_wrapper_proto.dissector(buffer, pinfo, tree)
        original_cflow_dissector:call(buffer, pinfo, tree)
        --do things
    end
    udp_dissector_table = DissectorTable.get("udp.port")
    original_cflow_dissector = udp_dissector_table:get_dissector(2055)
    udp_dissector_table:add(2055, cflow_wrapper_proto)
end</code></pre></div><div id="question-tags" class="tags-container tags"><span class="post-tag tag-link-chained-dissector" rel="tag" title="see questions tagged &#39;chained-dissector&#39;">chained-dissector</span> <span class="post-tag tag-link-lua" rel="tag" title="see questions tagged &#39;lua&#39;">lua</span> <span class="post-tag tag-link-dissector" rel="tag" title="see questions tagged &#39;dissector&#39;">dissector</span> <span class="post-tag tag-link-dissectortable" rel="tag" title="see questions tagged &#39;dissectortable&#39;">dissectortable</span></div><div id="question-controls" class="post-controls"></div><div class="post-update-info-container"><div class="post-update-info post-update-info-user"><p>asked <strong>27 May '16, 16:13</strong></p><img src="https://secure.gravatar.com/avatar/69337c614f643f05439087eb2c42ac6d?s=32&amp;d=identicon&amp;r=g" class="gravatar" width="32" height="32" alt="osarkar&#39;s gravatar image" /><p><span>osarkar</span><br />

6334
accept rate: 0%