I am trying to build a dissector, and what I would like to do is extract pieces of data, perform some data manipulation (ie, logic, concatenating two separate sets of data together). After working on it some myself and looking at the documentation, it seems to me that the only way to add anything to a tree is the "proto_tree_add_item(tree, id, tvb, start, length, encoding)". Is there a different function I can use for my purposes? Or is it better for me to build this dissector in Lua (which from my understanding, will allow the functionality that I need)? I am new to building dissectors, so any help would be appreciated. asked 18 Oct '11, 09:32  JMalanga |
3 Answers:
Check out doc/README.developer. There is a multitude of proto_tree_add functions. And you should read the rest too.... answered 18 Oct '11, 09:56  Jaap ♦ |
Any of the For example, if you have a little-endian protocol with a two-byte field you want to examine, you could use The Lua interface, while powerful, typically lags behind the C interface feature-wise for a long time. Where possible, you should prefer to write production-level dissectors in C, anyway, so that you can leverage the full featureset that Wireshark offers. answered 18 Oct '11, 10:03  multipleinte... edited 18 Oct '11, 10:04 |
Hope this helps Requirement : Get some packet bytes and manipulate them and add to tree to view in pane 2 Suggestion : use proto_tree_add_*(_tree, hf_type,tvb,OFFSET,size, var); "var" is what you actually display in pane ...offset will help in highlighting the corresponding bytes in pane3 based upon your requirement proto_tree_add_text() will suit you most as you can use printf like arguments answered 18 Oct '11, 23:13  flashkicker |
That's true...the Lua API doesn't expose that much from C (but nobody has asked for it). The Lua API gets updated with a new feature mostly upon request. Someone has to see a need for it, or else it stays exactly where it is (and rightly so).
IMHO, it really depends on your requirements. If the Lua API provides everything you need (and you don't need the full feature set from C), then choose Lua. Sometimes, the path of least resistance is best. On the other hand, Lua might pose a language barrier for you (or maybe you know it already...it's similar to Python), in which case, it might be easier for you to go with C.