Filter on header field with name in dbus

asked 2020-11-11 14:24:03 +0000

mrnx gravatar image

I am using a pcap file generated from dbus-monitor. The dissector seems to create multiple header fields.

Header Field: PATH
    Field Code: PATH (1)
    Type signature: o
    OBJECT_PATH: /my/object/path
Header Field: DESTINATION
    Field code: DESTINATION (6)
    Type signature: s
    STRING: :1.23

And more of this data. It seems that dbus only contains a dbus.value.str, that contains all the data. Can I filter on a specific occurrence or header field instead? Something like dbus.value.str["DESTINATION"] would be nice.

I have also tried to make this in MATE, but I didn't get any further then

Pdu dbus_call_pdu Proto dbus Transport dbus {
    Extract all_values From dbus.value.str;
};

Done;

And then I still get multiple entries.

Perhaps lua scripting can help me out here? Can I get specific indices in lua?

edit retag flag offensive close merge delete