qutefu's profile - activity

Hi Hurris, thank you so much. I am going to use the first one. It should work fine locally now.

Hi Hurris, thank you o much. I am going to use the first one. It should work fine locally now.

In the chapter 9.2.1 of developing guide book,

there is a disssector example 9.2. (Dissector Handoff)

void proto_reg_handoff_foo(void)
{

    static dissector_handle_t foo_handle;

    foo_handle = create_dissector_handle(dissect_foo, proto_foo);

    dissector_add_uint("udp.port", FOO_PORT, foo_handle);
}

The example always has a related basement, like UDP, TCP or so on. I would like to parse the whole enhanced packet block (data payload) from the first byte(bit) [of course, I have a header in the packet, to identify it from other interface's protocol ], how to wirte the code?

I try to follow plugins\grython code and the developing guide book, but all code are related with some conditions, like udp, or tcp, and just parse the data from a special port, I would like to get help for the new idea.

Thanks in advance.

/* Reserved for private use. */ { 147, WTAP_ENCAP_USER0 }, { 148, WTAP_ENCAP_USER1 }, { 149,

Since LinkType is 2 bytes, I set it to 999 in IDB now, since I know it should be available in my testing for time being.

Since LinkType is 2 bytes, I set it to 145 in IDB now, since I know it should be available in my testing for time being.

Since LinkType is 2 bytes, I set it to 1000 in IDB now, also it could be 1000 to 2000, since I know it should be availab

Since LinkType is 2 bytes, I set it to 1000 now, also it could be 1000 to 2000, since I know it should be available in m

Hi Stig, I also try your way, it is working fine. Thanks!

With C code, in the code sample, I guess:

Location at the WSDG 9.3. Dissection the code is

 col_set_str(pinfo->cinfo, COL_PROTOCOL, "FOO");

It will change the the content of PROTOCOL in the Wireshark, my question is, how to do the same thing with lua code.

i can see it in the same doc:

11.5.5.9. pinfo.curr_proto

It should be the VAR for changing it. But, how to use the "pinfo.curr_proto" to change protocol in column of main display pane with lua.

Thanks in advance!

Yes, I need to parse it from the first byte of the whole payload in EPB (pcapng format file), I have some special bytes

Thank you very much, it works very well. With the following code, I also change the column of source and destination.

Thank you very much, it works very well. With the following code, I also change the column of source and destination.

Thank you very much, it works very well. With the following code, I also change the column of source and destination. pk

How to setup a totally new dissector for the data without UDP/TCP header In the chapter 9.2.1 of developing guide book,

How to setup a totally new dissector for the data without UDP/TCP header In the chapter 9.2.1 of developing guide book,

how to change COL_PROTOCOL with lua code sorry for the repeating.

how to change COL_PROTOCOL with lua code With C code, in the code sample, I guess: Location at "https://www.wireshark.o

how to change COL_PROTOCOL with lua code With C code, in the code sample, I guess: Location at "https://www.wireshark.o

how to change COL_PROTOCOL with lua code With C code, in the code sample, I guess: Location at "https://www.wireshark.o

how to change COL_PROTOCOL with lua code With C code, in the code sample, I guess: Location at "https://www.wireshark.o

Honestly, in the instruction web page the command : choco install VisualStudio2015Community --timeout 0 -package-parame

I found the answer by myself, "https://social.msdn.microsoft.com/Forums/en-US/4d035e42-0618-476b-b309-ae2673f14de4/the

my QT version is 5.6.3, is it a reason for the error? Since I found QT version is 5.9.1 in the instruction web page.

No CMAKE_C(XX)_COMPILER could be found I try to compile wireshark in my windows(10) PC, Follow the instruction "https://

No CMAKE_C(XX)_COMPILER could be found I try to compile wireshark in my windows(10) PC, Follow the instruction "https://

No CMAKE_C(XX)_COMPILER could be found I try to compile wireshark in my windows(10) PC, Follow the instruction "https://

No CMAKE_C(XX)_COMPILER could be found I try to compile wireshark in my windows(10) PC, Follow the instruction "https://

The dedicated problem is solved, which has been described in the above comments. Thank you guys.

I found it was from windows SDK issue, windows SDK 8.1 is not installed in my PC, so that is it. Of course, after solvi