How to create a Protofield sub array for Lua Wireshark Dissector

3.2k views Asked by At

Given the following example:

local f= mycoolprotocol.fields
f.Length = ProtoField.uint32("MCP.Length","Length",base.DEC)
f.MsgType = ProtoField.uint16("MCP.MsgType","MsgType",base.DEC)

I have declared 2 Protofields. But imagine I have a repeating group or an array of items:

And the message body looks like so:

struct person
{
  int16 age;
  string name;
}
person[] p = new person[2];

Ideally, I would like to create a subtree in Wireshark for that group

+ Persons
 + Person1
    name
    age
 + Person2
    name
    age

The problem is I don't know how to structure this in Lua. This declares 2 protofields:

f.name = Protofield.string("MCP.name","name","Text")
f.age = ProtoField.uint16("MCP.age","age",base.DEC)

But I'd like to create a dynamic array of the group instead, so I can do:

subtree:add_le( f[0].name, buffer(x,y)) 

So, is there a Protofield.ProtoFieldArray? Is it possible? Any other ideas are welcome.

Thanks.

Also, as reference: http://ask.wireshark.org/questions/28038/how-to-create-a-protofield-sub-array-in-lua

1

There are 1 answers

0
Lews Therin On

It turns out I can reuse the same fields to build the tree.

So in pseudocode:

begin loop
  subtree= mainsubtree:add(a,buffer())
  subtree:add(f.name, buffer(x,y))
  subtree:add(f.age, buffer(x+name.length,y))
end

So f.name f.age doesn't get overwritten by a newer value. I guess it is just a placeholder for the ProtoField