How to aquire treenode name from tree in post-dissector?
I would like to write a lua script which performs some analysis on an EtherCAT capture file capture by Wireshark. The protocol is EtherCAT and and EtherCAT frame can contain many datagrams which are represented as treenodes by the dissector. I would like to loop over treenodes (datagrams) to find a specific one.
I have tried to modify Hadriel's post-dissector example and I used it in tshark but the script breaks down at all_field_infos(). The "Treefields query:" is printed out but "... succeeded!" missing. What could be wrong?
How I use the script: tshark.exe -r ecat.pcapng -X lua_script:extarct.lua
-- calling tostring() on random FieldInfo's can cause an error, so this func handles it
local function getstring(finfo)
local ok, val = pcall(tostring, finfo)
if not ok then val = "(unknown)" end
return val
end
-- our fake protocol
local exproto = Proto.new("extract", "Data Extractor")
function exproto.dissector(tvbuf, pktinfo, tree)
print("")
print("Actual packet no: " .. pktinfo.number .. " Length: " .. pktinfo.len .. " bytes")
print("Call ESL dissector...")
Dissector.get("esl"):call(tvbuf, pktinfo, tree)
print("... succeeded!")
if tree == nil then
print("Tree is nil!")
else
print("Treefields query:")
local TreeFieldInfo = { all_field_infos() }
print("... succeeded!")
if TreeFieldInfo == nil then
print("Treefield info is nil!")
else
-- Processing fields to find a datagram and aquire data from it.
for ix, finfo in ipairs(TreeFieldInfo) do
print("\t[" .. ix .. "] " .. finfo.name .. " = " .. getstring(finfo) .. "\n")
end
end
end
end
-- register it as a postdissector, and force all fields to be generated
register_postdissector(exproto, true)
According to this stackoverflow topic I thought the ESL (EtherCAT Switch Link) dissector is not called I put a dissector call into the exproto dissector in my lua script but it did not help, the situation is the same.
https://stackoverflow.com/questions/4...
I printed the tree type and I got these:
Tree type: userdata
TreeItem: expired=false, has item=false, has subtree=false, they are the same
Does it say that the tree is empty? Could it be the cause that the all_field_infos() fails?