Ask Your Question

How to store information in previous packet to decode next packet in lua script

asked 2023-10-09 01:38:49 +0000

navahoo gravatar image

When to decode a few field in the present packet, there need to use a few field information in previous packets, so how to implement in lua decode script.

For example:

when to decode previous A packet , we need to store ID_a and String_a mapping when to decode previous B packet, we need to store ID_b and ID_a mapping

then finally when to decode present packet, we use ID_b inside present packet to find the string_a, we can finally use string_a to decode field information.


edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2023-10-09 02:38:54 +0000

Chuckc gravatar image

updated 2023-10-09 02:41:00 +0000

You could store the values in a global table indexed by packet number.

filtcols - A post-dissector to allow filtering on Protocol and Info column

-- variables to persist across all packets
local pkt_data = {} -- indexed per packet

pkt_data.protocol = {} = {}
    if  cols_protocol ~= "(protocol)" then
        pkt_data.protocol[pinfo.number] = cols_protocol
edit flag offensive delete link more


You could store the values in a global table indexed by packet number.

Which is similar to how most if not all dissectors that we provide handle this, although the tables keys aren't necessarily packet numbers. For example, with a number of request/response protocols, there's a request ID in both the request and response, and information in the request needed to dissect the response (such as the request code) is stored in a table with the request ID as the key.

Guy Harris gravatar imageGuy Harris ( 2023-10-09 08:32:49 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2023-10-09 01:38:49 +0000

Seen: 133 times

Last updated: Oct 09 '23