Ask Your Question

Which dissector table to be used for a zigbee cluster

asked 2018-10-19 12:55:02 +0000

Henk Stevens gravatar image

updated 2018-10-19 17:31:49 +0000

Guy Harris gravatar image

I have specific data in the payload of a ZCL message, for which I want the (decoded) data to be shown in the packet detail pane. It seems that i need to get the right dissector table for zigbee. In a tutorial I found an example for tcp; local tcp_port = DissectorTable.get("tcp.port"). I tried to figure out which table to use, but could get it found. I tried "zbee.zcl" and "zbee_zcL. Also tried on level higher in zigbee, with "zbee.nwk" and "zbee.aps". Which is the right table to be used in the lua script.

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2018-10-19 13:22:17 +0000

cmaynard gravatar image

updated 2018-10-19 14:14:12 +0000

grahamb gravatar image

You can find dissector tables using tshark, for example:

$ tshark -G dissector-tables | grep zcl
zbee.zcl.cluster        ZigBee ZCL Cluster ID   FT_UINT16       BASE_HEX       ZigBee ZCL       Decode As not supported

$ tshark -G heuristic-decodes | grep zcl
zbee_zcl_se.tun ip      T

You can also find dissector tables in Wireshark using: View -> Internals -> Dissector Tables. A search for zcl finds the same two as above, namely an integer table zbee.zcl.cluster, and also the heuristic table, zbee_zcl_se.tun.

And of course there's always the packet-zbee-zcl.c and packet-zbee-zcl-se.c source code itself.

edit flag offensive delete link more


Thanks, got it working now. The "zbee.zcl.cluster" is the right one. Regards, Henk

Henk Stevens gravatar imageHenk Stevens ( 2018-10-19 13:48:55 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools


Asked: 2018-10-19 12:55:02 +0000

Seen: 753 times

Last updated: Oct 19 '18