Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

[Dissector] How to have a number of fields depending of the buffer?

Hello everyone,

It's been days that I try to solve this "simple" problem, but I can't find any solution by my own :(

So here's the thing: the protocol I dissect can have a variable number of data fields, and I am trying to properly display all these data fields in ProtoFields in a sub-tree. Moreover, the name of each ProtoField should change depending on what's in the buffer.

The number of fields and the name of each of these fields is determined by reading the first characters contained in the buffer.

I tried the following solution to create a variable number of ProtoFields. It works, except that the displayed name of the ProtoFields can't be changed.

The concept of this script was to create plenty of ProtoFields and to use only the ones I need. But as I said just above, I can not change the name of the ProtoField, as it is declared before knowing its real name.

ExampleDecoder = Proto("exampledecoder", "Example decoder")

-- Create a table of ProtoFields, the protocol can contain a maximum of 74 fields
DataFieldsProto = {}
for i = 1, 74, 1 do
    DataFieldsProto[i] = ProtoField.string("exampledecoder.field" .. i, "Field number " .. i)
    table.insert(NmeaDecoder.fields, DataFieldsProto[i])
end

function ExampleDecoder.dissector(buffer, pinfo, tree)
    local subtree = tree:add(ExampleDecoder, buffer(), "Example decoder")

    -- These are my own functions. They do the job.
    local nbOfFields = GetNbOfFields(buffer())            -- integer value
    local namesOfFields = GetNamesOfFileds(buffer())      -- table of integers, but where to put these names???
    local valuesOfFields = GetValuesOfFields(buffer())    -- table of integers

    -- Dynamically displays the ProtoFields in the subtree
    for i = 1, nbOfFields, 1 do
        subtree:add(DataFieldsProto[i], valuesOfFields[i]))
    end
end

local udp_table = DissectorTable.get("udp.port")
udp_table:add(8202, ExampleDecoder)

Would any of you have a solution? Even an idea would really be useful.

Thanks in advance!

ameu00