Ask Your Question
0

lua dissector not a TreeItem!

asked 2021-04-29 14:03:45 +0000

DanS gravatar image

Hi, I am using lua to write a dissector for my own message format, and I get "not a TreeItem" part way through my data

With the TCP payload data :

46 49 4e 53 00 00 00 1a 00 00 00 02 00 00 000080 00 07 00 1a 00 00 01 00 20 01 01 82 07 d0 00 00 b8

and my dissector

fins_proto = Proto("FINS", "FINS protocol")

fins_proto.fields.header     = ProtoField.string("fins.header", "Header")
fins_proto.fields.length     = ProtoField.uint32("fins.length", "Length")
fins_proto.fields.command    = ProtoField.uint32("fins.command", "Command", base.HEX)
fins_proto.fields.tcpErr     = ProtoField.uint32("fins.tcpErr", "TCP Err", base.HEX)
fins_proto.fields.icf        = ProtoField.uint8("fins.icf", "ICF", base.HEX)
fins_proto.fields.rsv        = ProtoField.uint8("fins.rsv", "RSV", base.HEX)

function fins_proto.dissector(buffer, pinfo, tree)

    local subtree = tree:add(fins_proto, buffer(), "FINS Protocol Data")
    subtree:add(fins_proto.fields.header, buffer(0,4))
    subtree:add(fins_proto.fields.length, buffer(4,4))
    subtree:add(fins_proto.fields.command, buffer(8,4))

    pinfo.cols.protocol = "FINS"
    subtree.add(fins_proto.fields.tcpErr, buffer(12,4))
    subtree:add(fins_proto.fields.icf, buffer(16,1))
    subtree:add(fins_proto.fields.rsv, buffer(17,1))
end

tcp_table = DissectorTable.get("tcp.port")
tcp_table:add(8085, fins_proto)

I get the output

FINS Protocol Data
       Header: FINS
       Length: 26
       Command: 0x00000002
Lua Error: [string "fins2.lua"]:18: not a TreeItem!

If I comment out line 18 -- subtree.add(fins_proto.fields.tcpErr, buffer(12,4)) then I can proceed through the dissection.

FINS Protocol Data
       Header: FINS
       Length: 26
       Command: 0x00000002
       ICF: 0x80
       RSV: 0x00

Please can someone tell me what a TreeItem is, and what I am doing wrong here?

many thanks dan

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2021-04-29 14:54:01 +0000

Chuckc gravatar image

updated 2021-04-29 14:55:30 +0000

subtree.add(fins_proto.fields.tcpErr, buffer(12,4))

Typo? . instead of : ?

(see Rubber duck debugging)

edit flag offensive delete link more

Comments

Thank you ChuckC. I had been checking that the members had been correctly spelt etc. but this detail escaped my checks.

DanS gravatar imageDanS ( 2021-04-29 15:01:30 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2021-04-29 14:03:45 +0000

Seen: 967 times

Last updated: Apr 29 '21