Ask Your Question
0

Wireshark Lua dissector not showing tree

asked 2019-04-01 11:29:30 +0000

yaroni gravatar image

updated 2019-04-01 18:48:26 +0000

Jaap gravatar image

I have packet with trailer data after the packet as in ixia timestamp trailer. I am trying to write a dissector for Wireshark that is quite the same as ixia-packet_trailer plugin. https://raw.githubusercontent.com/bou...

But i wanted to write in Lua, so it is easiest to change.

I did the lua as heuristic with the function is_my_trailer, it now stop to show the trailer in ethernet tree so i believe it recognize the pattern 0xae12, but it doesn't show my "my trailer" tree

-- Header fields
local timestamp  = ProtoField.uint64 ("my_trailer_proto.timestamp", "timestamp", base.HEX)
local proto_flag  = ProtoField.uint8 ("my_trailer_proto.proto_flag", "protoFlag", base.HEX)
local msg_id     = ProtoField.uint16("my_trailer_proto.msg_id"    , "msdId"    , base.HEX)

my_trailer_proto.fields = { timestamp, proto_flag, msg_id }

-- does this packet contains a trailer 
local function is_my_trailer(buffer,pinfo,tree)
    local length = buffer:len()
    if length < 12 then return 1 end
    local type = buffer(length-12, 2):uint()

    if type == 0xae12 then  return true end
    return false
end

function my_trailer_proto.dissector(buffer, pinfo, tree)
    length = buffer:len()
    if length == 0 then return end

    local subtree = tree:add(my_trailer_proto, buffer(), "my trailer")

    -- Header
    subtree:add(timestamp, buffer(length-10,8))
    subtree:add(proto_flag, buffer(length-3,1))
    subtree:add(msg_id, buffer(length-2,2))

    pinfo.cols.protocol = my_trailer_proto.name
    pinfo.cols.protocol:set("proto_flag")
    pinfo.cols.info:set("proto_flag: " .. proto_flag)
end 

my_trailer_proto:register_heuristic("eth.trailer", is_my_trailer)

Here is a pcap file example with the trailer https://transfernow.net/87kwt2k0dne7

PacketWithTrailer.pcap

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2019-04-01 14:54:26 +0000

cmaynard gravatar image

You forgot a critical line of code:

if type == 0xae12 then  return true end
return false

Should be:

if type == 0xae12 then
    my_trailer_proto.dissector(buffer, pinfo, tree)
    return true
end
return false

You also have another bug. This line is an error:

pinfo.cols.info:set("proto_flag: " .. proto_flag)

It should be something like:

pinfo.cols.info:set("proto_flag: " .. buffer(length-3,1):uint())
edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2019-04-01 11:29:30 +0000

Seen: 557 times

Last updated: Apr 01 '19