This is our old Q&A Site. Please post any new questions and answers at

Hi all. I have a small dissector, which keeps returning nil values for a normal TCP packets from time to time.

For some reason, even if pinfo.net_src is set, ip_src_f() may return nil. Also, I can't get how to decode ip_len_f() return, which is userdata, to number.

        local testdissector = Proto("Test", "Test");

        ip_src_f ="ip.src")
        ip_dst_f ="ip.dst")
        tcp_src_f ="tcp.srcport")
        tcp_dst_f ="tcp.dstport")
        time_f ="frame.time_epoch")
        ip_len_f ="ip.len")
        frame_len_f ="frame.len")
        tcp_hlen_f ="tcp.hdr_len")
        tcp_ack ="tcp.flags.ack")
        tcp_syn ="tcp.flags.syn")
        tcp_psh ="tcp.flags.push")
        tcp_rst ="tcp.flags.reset")
        tcp_fin ="tcp.flags.fin")

        function testdissector.dissector(tvbuffer, pinfo, treeitem)
            if 1 == 1 then ---sport then

               local sport = tcp_src_f() -- alright
               local dport = tcp_dst_f() -- alright
               local saddr = pinfo.net_src -- 50% nil
               local daddr = pinfo.net_dst -- 50% nil
           --- do something
         return -- nil, to comply with no-reassembly requirements

TCP reassembly is turned off, HTTP dissector is disabled

asked 29 Feb '12, 08:04

cagali-san's gravatar image

accept rate: 0%

edited 29 Feb '12, 08:07

Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 29 Feb '12, 08:04

question was seen: 3,802 times

last updated: 29 Feb '12, 08:07

p​o​w​e​r​e​d by O​S​Q​A