Revision history [back]

LUA: ProtoField as tag packet ?

Hello,

in my lua dissector most of the packet types do have IMSI information extracted and dissected using:

f.imsi = ProtoField.string ("s8hr.imsi", "IMSI")

There is one packet type where IMSI can only be extracted by string manipulation on the nested SIP header.

function extract_imsi(sip_user, sip_host)
  numbers = {}
  for num in string.gmatch(sip_host, "%d+") do
        numbers[#numbers + 1] = tostring(num)
  end
  local imsi = numbers[2] .. numbers[1] .. sip_user
  return imsi
end

Is it possible to bind such computed value to the ProtoField (aka tag) so that a "display filter" search "s8hr.imsi" would include such packets as well ?

Thx, A.