|
Here's my basic dissector
I use wireshark 1.4.4, I start wireshark and load my dissector in the Lua "Evaluate" window, my packet got dissected correctly and I can see my bar field under the foo proto. My problem is that I can't use foo.bar as a filter. When I click on "Expression..." the foo proto appears but it has not fields under. The only filter I can use is: foo When try to evaluate:
I have:
Surprisingly when I use tshark with the option -T fields -e foo.bar and load the lua script, it works, pinfo.number is displayed. How can I get my foo.bar field usable in my lua scripts ? Thanks. |
|
I recreated your problem with Wireshark 1.4.6 on Mac OS X 10.6, but it actually works correctly on Windows XP SP3; Windows Wireshark lets me use I would submit a bug. |
