This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi all. I have a small dissector, which keeps returning nil values for a normal TCP packets from time to time.

For some reason, even if pinfo.net_src is set, ip_src_f() may return nil. Also, I can't get how to decode ip_len_f() return, which is userdata, to number.

    do
        local testdissector = Proto("Test", "Test");

        ip_src_f = Field.new("ip.src")
        ip_dst_f = Field.new("ip.dst")
        tcp_src_f = Field.new("tcp.srcport")
        tcp_dst_f = Field.new("tcp.dstport")
        time_f =  Field.new("frame.time_epoch")
        ip_len_f = Field.new("ip.len")
        frame_len_f = Field.new("frame.len")
        tcp_hlen_f = Field.new("tcp.hdr_len")
        tcp_ack = Field.new("tcp.flags.ack")
        tcp_syn = Field.new("tcp.flags.syn")
        tcp_psh = Field.new("tcp.flags.push")
        tcp_rst = Field.new("tcp.flags.reset")
        tcp_fin = Field.new("tcp.flags.fin")

        function testdissector.dissector(tvbuffer, pinfo, treeitem)
            if 1 == 1 then ---sport then

               local sport = tcp_src_f() -- alright
               local dport = tcp_dst_f() -- alright
               local saddr = pinfo.net_src -- 50% nil
               local daddr = pinfo.net_dst -- 50% nil
           --- do something
               end
         return -- nil, to comply with no-reassembly requirements
         end
    register_postdissector(testdissector)
end

TCP reassembly is turned off, HTTP dissector is disabled

asked 29 Feb '12, 08:04

cagali-san's gravatar image

cagali-san
1112
accept rate: 0%

edited 29 Feb '12, 08:07

Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×431
×12

question asked: 29 Feb '12, 08:04

question was seen: 3,148 times

last updated: 29 Feb '12, 08:07

p​o​w​e​r​e​d by O​S​Q​A