Revision history [back]

I don't think this is possible using pinfo.dl_src and pinfo.dl_dst. Even if you disable MAC address name resolution, the :'s will still be inserted between the bytes. You should be able to achieve this using field extractors of the eth.src and eth.dst fields though. For example:

local eth_post = Proto("EthPost", "Ethernet Postdissector")

local pf = {
    eth_dst = ProtoField.bytes("eth_post.dst", "Destination"),
    eth_src = ProtoField.bytes("eth_post.src", "Source")
}
eth_post.fields = pf

local eth_src = Field.new("eth.src")
local eth_dst = Field.new("eth.dst")

function eth_post.dissector(tvbuf, pinfo, tree)
    if eth_dst()() ~= nil and eth_src() ~= nil then
        local eth_post_tree = tree:add(eth_post, "Ethernet Postdissector")
        local eth_dst_ex = {eth_dst()}
        local eth_src_ex = {eth_src()}
        local i
        local v

        for i,v in ipairs(eth_dst_ex) do
            eth_post_tree:add(pf.eth_dst, v.range)
        end
        for i,v in ipairs(eth_src_ex) do
            eth_post_tree:add(pf.eth_src, v.range)
        end
    end
end

register_postdissector(eth_post)