This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello,

I am writing a dissection script for wireshark and I should point the replies/ack for specific packets. As a first implementation I create an array and write down the request ID and when a reply arrives checks if it's ID is part of this table. I would like to print an arrow (just like ping request reply) to point out the request and reply.

alt text

asked 29 Jun '17, 03:27

cyberrobot's gravatar image

cyberrobot
21114
accept rate: 0%


In Lua you can add two ProtoField's (one for request and one for response) for this and use frametype.REQUEST / frametype.RESPONSE as valuestring. You will get the arrows when using this fields.

Have a look in the ProtoField documentation.

permanent link

answered 08 Jul '17, 11:44

stig's gravatar image

stig ♦
46337
accept rate: 0%

Thanks for the reply, hyperlink with framenum worked for me. Is there any elegant way to match two packets with the same sequence number?

(10 Jul '17, 05:12) cyberrobot

I think you have to make sure to register the fields appropriately

From the ICMP dissector:

             {&hf_icmp_resp_in,
             {"Response frame", "icmp.resp_in", FT_FRAMENUM, BASE_NONE,
              FRAMENUM_TYPE(FT_FRAMENUM_RESPONSE), 0x0,
              "The frame number of the corresponding response",
              HFILL}},

            {&hf_icmp_resp_to,
             {"Request frame", "icmp.resp_to", FT_FRAMENUM, BASE_NONE,
              FRAMENUM_TYPE(FT_FRAMENUM_REQUEST), 0x0,
              "The frame number of the corresponding request", HFILL}},

I don't know if this can be done from LUA already.

permanent link

answered 29 Jun '17, 03:53

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×637
×431

question asked: 29 Jun '17, 03:27

question was seen: 1,497 times

last updated: 10 Jul '17, 05:12

p​o​w​e​r​e​d by O​S​Q​A