Revision history [back]

If by Protocol ID of the LLC, you mean the llc.type field, then maybe something like the following could help?

local legrandnono = Proto("legrandnono", "legrandnono dissector")

local pf = {
    data = ProtoField.bytes("legrandnono.data", "legrandnono Data", base.NONE)
}

-- Register protocol fields
legrandnono.fields = pf

-- Assume an OUI of 00:00:00 and LEGRANDNONO_ETYPE Ethertype represents a legrandnono packet
local LEGRANDNONO_ETYPE     = 0xa861
local LEGRANDNONO_OUI       = 0

local etypetable = DissectorTable.get("ethertype")
local etype_orig = etypetable:get_dissector(LEGRANDNONO_ETYPE)
local data_dis = Dissector.get("data")
local llc_oui = Field.new("llc.oui")

function legrandnono.dissector(tvbuf, pinfo, tree)

    local llc_oui_ex = llc_oui()
    if llc_oui_ex == nil or llc_oui_ex.value ~= LEGRANDNONO_OUI then
        if etype_orig ~= nil then
            etype_orig:call(tvbuf, pinfo, tree)
        else
            data_dis:call(tvbuf, pinfo, tree)
        end
        return
    end

    pinfo.cols.protocol:set("legrandnono")

    local legrandnono_tree = tree:add(legrandnono, tvbuf(0, tvbuf:len()))
    legrandnono_tree:add(pf.data, tvbuf(0, tvbuf:len()), tvbuf:len())
end

etypetable:add(LEGRANDNONO_ETYPE, legrandnono)