Whireshark Lua解剖器未显示树 [英] Whireshark Lua dissector not showing tree
问题描述
像ixia timestamp预告片中那样,在封包之后我有预告片数据包.我正在尝试为Wireshark编写一个解剖器,该解剖器与ixia-packet_trailer插件完全相同. https://raw.githubusercontent.com/boundary/wirehark/master/epan/dissectors/packet-ixiatrailer.c
I have packet with trailer data after the packet as in ixia timestamp trailer. I am trying to write a dissector for Wireshark that is quite the same as ixia-packet_trailer plugin. https://raw.githubusercontent.com/boundary/wireshark/master/epan/dissectors/packet-ixiatrailer.c
但是我想用Lua编写,所以最容易更改.
But i wanted to write in Lua, so it is easiest to change.
我使用函数is_my_trailer(如 Wireshark Lua解剖器中的建议)对lua进行了启发式处理插件表错误),现在它停止显示以太网树中的预告片,因此我相信它可以识别出模式0xae12,但它不显示我的我的预告片"树
I did the lua as heuristic with the function is_my_trailer (as proposed in Wireshark Lua dissector plugin table error), it now stop to show the trailer in ethernet tree so i believe it recognize the pattern 0xae12, but it doesn't show my "my trailer" tree
-- declare our protocol
local my_trailer_proto = Proto("my_trailer","my Trailer")
-- Header fields
local timestamp = ProtoField.uint64 ("my_trailer_proto.timestamp", "timestamp", base.HEX)
local proto_flag = ProtoField.uint8 ("my_trailer_proto.proto_flag", "protoFlag", base.HEX)
local msg_id = ProtoField.uint16("my_trailer_proto.msg_id" , "msdId" , base.HEX)
my_trailer_proto.fields = { timestamp, proto_flag, msg_id }
-- does this packet contains a trailer
local function is_my_trailer(buffer,pinfo,tree)
local length = buffer:len()
if length < 12 then return 1 end
local type = buffer(length-12, 2):uint()
if type == 0xae12 then return true end
return false
end
function my_trailer_proto.dissector(buffer, pinfo, tree)
length = buffer:len()
if length == 0 then return end
local subtree = tree:add(my_trailer_proto, buffer(), "my trailer")
-- Header
subtree:add(timestamp, buffer(length-10,8))
subtree:add(proto_flag, buffer(length-3,1))
subtree:add(msg_id, buffer(length-2,2))
pinfo.cols.protocol = my_trailer_proto.name
pinfo.cols.protocol:set("proto_flag")
pinfo.cols.info:set("proto_flag: " .. proto_flag)
end
my_trailer_proto:register_heuristic("eth.trailer", is_my_trailer)
这是一个带有预告片 https://transfernow.net/87kwt2k0dne7
推荐答案
您忘记了关键代码行:
if type == 0xae12 then return true end
return false
应该是:
if type == 0xae12 then
my_trailer_proto.dissector(buffer, pinfo, tree)
return true
end
return false
您还有另一个错误.这行是错误的:
You also have another bug. This line is an error:
pinfo.cols.info:set("proto_flag: " .. proto_flag)
应该是这样的:
pinfo.cols.info:set("proto_flag: " .. buffer(length-3,1):uint())
这篇关于Whireshark Lua解剖器未显示树的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!