Why does accessing FieldInfo.value disable search in info column?
Hello,
I have the problem that the Wireshark-info-column-content of some of my Wireshark Lua PlugIns is not found by the Wireshark search field (Ctrl + f).
For example, if the info column contains "abcde" and I search for "abc" (without quotes) it is not found.
But with other PlugIns this works.
I created a minimal PlugIn which shows that the search does not find the string if I do access the value of a FieldInfo.
If I don't do access the value, the search works.
(I assume) You can reprodue that with some packet caputre and this Lua PlugIn. Just toggle the variable "makeSearchDoesntWork" to see the bad and the good case:
local myProto = Proto("myproto", "My Protocol") myProto.fields.Port = ProtoField.uint8("myproto.port", "Port", base.DEC) local myField = Field.new("myproto.port") function myProto.dissector(buffer, pinfo, tree) tree:add(myProto.fields.Port, buffer(0, 1)) local makeSearchDoesntWork = false local myFieldInstance = myField() if makeSearchDoesntWork then local myValue = myFieldInstance.value end pinfo.cols.info = "abcde" end register_postdissector(myProto)
So why does accessing FieldInfo.value disable search in info column? Is it my fault or is it a bug in Wireshark?
My Wireshark: Wireshark 4.4.1 (v4.4.1-0-g575b2bf4746e).
My OS: Windows 10
Best Regards, Christian
6.8. Finding Packets
What are your settings for the "Find"?
The defaults:
"Packet list",
"String",
Case sensitive yes,
"Narrow (UTF-8 / ASCII)" which is disabled: I can't set a different value
A quick scan of the wslua code and nothing jumps out.
The handling of
pinfo.cols
doesn't follow the WSDG - the column is appended to not set to new value.Please open an issue (ReportingBugs) on the Wireshark Gitlab Issues.
No, this part is fine. Confusingly,
col_add_str
is not an append, it replaces the value. (But copies the string, unlikecol_set_str
.@johnthacker
col_add_str
appends after a fence.There is also an issue where
_ws.col.info
does not contain the same data as theInformation
column.(I've reached my personal limit of open issues so was hoping @Christian would create a new one) :-)
I haven't look at the search code yet but it seems to look
_ws.col.info
.