json dissector

asked 2020-07-12 07:47:53 +0000

yaroni gravatar image

updated 2020-07-12 07:49:03 +0000

I have a json format in my packet payload, for example as following

{
    "key1":"value1",
    "key2":0.5,
    "key3":"value3"
}

My dissector is named "mydissector"
I wanted to use json dissector that exist in wireshark but it does no allow to filter pairs
This is the filter that i can run in wireshark, which don't search a pair but separately for a packet with a key and a value, but it could be in 2 separate pairs.

json.key=="key1" and json.value.string=="value1"

I would like to be able to run the following:

mydissector.key1==value1

or

mydissector.key2>=0.3

Is it possible?
Which function should i use?
I have no idea how to do it, if you could redirect me to an example

edit retag flag offensive close merge delete