Column with arbitrary located byte in a packet

Question

How it is possible to create a "Custom" column which refers to an arbitrary offset in UDP payload. For example, in "Filter definition" it is possible to reffer to the 1st byte in UDP payload as udp[8]. Such simple approach seems to be blocked in Packet Display Plain. What am I missing?

Answer 1

1

This is (currently) not possible with Wireshark, although you might be able to do this with the Lua scripting engine that is part of Wireshark.

answered 08 Nov '11, 03:07

SYN-bit ♦♦
17.1k●9●57●245
accept rate: 20%

edited 08 Nov '11, 06:00

helloworld
3.1k●4●20●41

Thanks. Is it possible to add an example. Please assume that the documented method to add LUA file is known.

(09 Nov '11, 12:04) exbungee

1

is it still not possible?

(29 Jan '14, 03:35) Daniil Kharkov

Answer 2

"use the Code, Luk"
add the Custom "udp_dump.data" column in Preferences/Columns and tweak protocol port and byte offset in Preferences/Protocol/UDP_DUMP. Upvote! =)

do
        local udp_dumper_proto = Proto("udp_dump", "UDP dumper");
    udp_dumper_proto.prefs.ofs = Pref.uint( &quot;udp_dump_ofs&quot;, 1, &quot;UDP data byte offset&quot; )
    udp_dumper_proto.prefs.port   = Pref.uint( &quot;udp_dump_port&quot;, 53, &quot;UDP port&quot; )

    udp_dumper_proto.fields.dump   = ProtoField.uint8(&quot;udp_dump.data&quot;, &quot;a dump of byte&quot;, base.HEX)

    local prev_proto
    local f_udp    = Field.new(&quot;udp&quot;)

    function udp_dumper_proto.dissector(tvb, pinfo, tree)
        pcall(function()prev_proto:call(tvb, pinfo, tree)end)

        if not f_udp() then return end

        local ofs = udp_dumper_proto.prefs.ofs -- udp_dumper_proto.prefs.filter
        if (tvb:len() &lt; ofs) then return end

        -- this is just to add text to &quot;udp_dump.data&quot; field, 
        -- which you should display as column.
        -- as an alternate, you may remove set_hidden() and view selected data in the treeview
        tree:add(udp_dumper_proto.fields.dump, tvb(ofs,1)):set_hidden();
    end

    -- if we hook upon UDP port, then offset will mean the beginning of the UDP data
    udp_table = DissectorTable.get(&quot;udp.port&quot;)
    prev_proto = udp_table:get_dissector(udp_dumper_proto.prefs.port)
    udp_table:add(udp_dumper_proto.prefs.port, udp_dumper_proto)

    -- if we hook as post dissector, the offset will be from start of the frame. 
    -- don&#39;t forget to remove the prev_proto call if you&#39;ll use that kind of hook

–        register_postdissector(udp_dumper_proto)
end