Revision history [back]

Hello,
I have the problem that the Wireshark-info-column-content of some of my Wireshark Lua PlugIns is not found by the Wireshark search field (Ctrl + f).
For example, if the info column contains "abcde" and I search for "abc" (without quotes) it is not found. But with other PlugIns this works.
I created a minimal PlugIn which shows that the search does not find the string if I do access the value of a FieldInfo.
If I don't do access the value, the search works.
(I assume) You can reprodue that with some packet caputre and this Lua PlugIn. Just toggle the variable "makeSearchDoesntWork" to see the bad and the good case:

local myProto = Proto("myproto", "My Protocol")
myProto.fields.Port = ProtoField.uint8("myproto.port", "Port", base.DEC)
local myField = Field.new("myproto.port")

function myProto.dissector(buffer, pinfo, tree)
    tree:add(myProto.fields.Port, buffer(0, 1))
    local makeSearchDoesntWork = false
    local myFieldInstance = myField()
    if makeSearchDoesntWork then
        local myValue = myFieldInstance.value
    end
    pinfo.cols.info = "abcde"
end

register_postdissector(myProto)

So why does accessing FieldInfo.value disable search in info column? Is it my fault or is it a bug in Wireshark?

My Wireshark: Wireshark 4.4.1 (v4.4.1-0-g575b2bf4746e).
My OS: Windows 10

Best Regards, Christian