Ask Your Question

sezb51's profile - activity

2022-10-19 14:22:14 +0000 received badge  Popular Question (source)
2022-07-26 19:35:25 +0000 received badge  Popular Question (source)
2021-10-13 06:35:10 +0000 edited answer LUA: ProtoField as tag packet ?

Hello, I just realize that I can do "s8hr_tree:add (f.imsi, imsi)" and that allows to fully search for s8hr.imsi == "xx

2021-10-13 06:34:38 +0000 received badge  Rapid Responder (source)
2021-10-13 06:34:38 +0000 answered a question LUA: ProtoField as tag packet ?

Hello, I just realize that I can do "s8hr_tree:add (f.imsi, imsi)" and that allows to fully search for s8hr.imsi == "xx

2021-10-11 19:55:28 +0000 asked a question LUA: ProtoField as tag packet ?

LUA: ProtoField as tag packet ? Hello, in my lua dissector most of the packet types do have IMSI information extracted

2021-10-10 11:44:55 +0000 received badge  Rapid Responder (source)
2021-10-10 11:44:55 +0000 answered a question LUA & search in the nested packet...

Hello, I just realized that it is simple as adding the Field.new just after the Proto(...) definition: version = "v1.0

2021-10-10 09:15:52 +0000 edited question LUA & search in the nested packet...

LUA & search in the nested packet... Hello, in my LUA protocol dissector there could be a specific packet type that

2021-10-10 07:31:31 +0000 edited question LUA & search in the nested packet...

LUA & search in the nested packet... Hello, in my LUA protocol dissector there could be a specific packet type that

2021-10-08 21:06:01 +0000 asked a question LUA & search in the nested packet...

LUA & search in the nested packet... Hello, in my LUA protocol dissector there could be a specific packet type that

2021-09-26 12:31:45 +0000 commented question TCP retransmission - false positive

incident reported: https://gitlab.com/wireshark/wireshark/-/issues/17616

2021-09-25 16:24:58 +0000 edited question TCP retransmission - false positive

false TCP retransmission Hello, sometime during initial TCP three way-handshake we receive a SYN/ACK with a wrong "ackn

2021-09-25 16:24:27 +0000 asked a question TCP retransmission - false positive

false TCP retransmission Hello, sometime during initial TCP three way-handshake we receive a SYN/ACK with a wrong "ackn

2021-09-18 15:08:50 +0000 edited answer LUA: pinfo affected by NSTime ?

Fixed the issue... I had to wrap the below ti.text into a tostring() So the NSTIme was not part of the problem. functi

2021-09-18 12:28:44 +0000 edited answer LUA: pinfo affected by NSTime ?

Fixed the issue... I had to wrap the below ti.text into a tostring() So the NSTIme was not part of the problem. functio

2021-09-18 08:44:51 +0000 received badge  Rapid Responder (source)
2021-09-18 08:44:51 +0000 answered a question LUA: pinfo affected by NSTime ?

Fixed the issue... I had to wrap the below ti.text into a tostring() So the NSTIme was not parte of the problem. functi

2021-09-17 20:56:58 +0000 asked a question LUA: pinfo affected by NSTime ?

LUA: pinfo affected by NSTime ? Hello, I finally narrow down the issue I'm facing with the pinfo... my LUA protocol di

2021-09-17 20:36:03 +0000 edited question LUA: pinfo altered by NSTime

LUA: pinfo altered by NSTime Hello, I rewrite my request since I've finally narrow down the issue... my protocol has a

2021-09-17 20:26:50 +0000 edited question LUA: pinfo altered by NSTime

LUA: pinfo vs NSTime.new Hello, my protocol has a common header followed by multiple TLV options. The LUA script does

2021-09-17 20:26:33 +0000 received badge  Editor (source)
2021-09-17 20:26:33 +0000 edited question LUA: pinfo altered by NSTime

LUA and pinfo scope Hello, my protocol has a common header followed by multiple TLV options. The LUA script does itera

2021-09-16 16:12:52 +0000 asked a question LUA: pinfo altered by NSTime

LUA and pinfo scope Hello, my protocol has a common header followed by multiple TLV options. The LUA script does itera

2021-09-16 12:33:15 +0000 commented answer Dissector doesn't see retransmission packets

For some reason wireshark was mistakenly identifying port 9001 traffic as retransmission without showing the original pa

2021-09-16 05:11:44 +0000 asked a question Dissector doesn't see retransmission packets

LUA and retransmission packets Hello, my dissector is registered to decode a bunch of ports: tcp_table = DissectorTabl

2021-09-11 06:45:54 +0000 marked best answer LUA and bignum

Hello,

is it possible for LUA dissector to convert 8x bytes to its decimal/string equivalence ?

local input="00007048860ddf75"
local output = tostring(tonumber(input,16))

expected: 123456789012341
but got: 1.2345678901234e+14

I understand this is normally overcome with some bignum library (ie: bc.dll) but not sure it can work within dissector sandbox.

Any idea ?

Thx, A.

2021-09-11 06:45:51 +0000 received badge  Commentator
2021-09-11 06:45:51 +0000 commented answer LUA and bignum

Works like a charm! local input="00007048860ddf75" local output = Int64.fromhex(input) it does produces now: 123456789

2021-09-10 20:30:35 +0000 asked a question LUA and bignum

LUA and bignum Hello, is it possible for LUA dissector to convert 8x bytes to its decimal/string equivalence ? local i

2021-09-08 06:35:22 +0000 commented answer LUA: byte to nibbles (low/high)

this looks indeed promising: function userdata2bcd(buffer, offset, len) local bytearr = {} for i = 1, len do nu

2021-09-07 18:53:22 +0000 marked best answer LUA: byte to nibbles (low/high)

Hello,

I need to convert raw hex data: "10 55 55 59 93 09 22 f0" into string: "0f22903995555501" but how to extract high/low nibbles from individual byte ?

function userdata2bcd(buffer, offset, len)
  local bytearr = {}
  for i = 1, len do
    num = userdata2dec(buffer, offset+len-i, 1)
    highByte = ...
    lowByte  = ...
    bytearr[i] = tostring(lowByte) .. tostring(highByte)
  end
  return table.concat(bytearr)
end

Any suggestion is appreciated...

Thx, A!

2021-09-07 17:28:16 +0000 commented answer LUA: byte to nibbles (low/high)

this looks indeed promising: function userdata2bcd(buffer, offset, len) local bytearr = {} for i = 1, len do nu

2021-09-07 13:49:21 +0000 asked a question LUA: byte to nibbles (low/high)

LUA: byte to nibbles (low/high) Hello, I need to convert raw hex data: "10 55 55 59 93 09 22 f0" into string: "0f229039

2021-08-05 19:28:38 +0000 commented answer LUA: avoid auto-expand sub-tree

so a table with tlv type as index that contains ProtoField variable ? I need to try up some code :)

2021-08-05 19:11:28 +0000 commented answer LUA: avoid auto-expand sub-tree

You making a good point when you mention possible display filter clash for specific tlv. Currently we have around twent

2021-08-05 18:10:27 +0000 commented answer LUA: avoid auto-expand sub-tree

I agree there is a collapse all menu but that requires user action each time and I do prefer to avoid it if possible. I

2021-08-05 18:09:42 +0000 commented answer LUA: avoid auto-expand sub-tree

I agree there is a collapse all menu but that requires user action each time and I do prefer to avoid it if possible. I

2021-08-05 16:56:55 +0000 asked a question LUA: avoid auto-expand sub-tree

LUA: avoid auto-expand sub-tree Hello, my LUA dissector has a general header followed by an arbitrary number of tlv sec

2021-08-04 16:15:28 +0000 marked best answer LUA: tlv_tree:add "hex data sequence"

Hello,

One TLV has length 18... If I try to add to the display tree using:

f.tlvvalue_hex = ProtoField.uint32 ("myproto.tlvvalue_hex", "TLV Value", base.HEX)
tlv_tree:add (f.tlvvalue_hex, buffer(offset, tlvlen))

I get following [(Warning/Malformed) Trying to fetch an unsigned integer with length 18]

How can I just have an hex data sequence displayed instead ? Maybe leveraging on ByteArray ?

Thx!

2021-07-31 13:06:45 +0000 received badge  Rapid Responder (source)
2021-07-31 13:06:45 +0000 answered a question LUA: tlv_tree:add "hex data sequence"

Final code. I'm happy with that :) function hex2string(buffer, offset, len) local bytearr = {} for i = 1, len do

2021-07-31 09:47:39 +0000 received badge  Rapid Responder (source)
2021-07-31 09:47:39 +0000 answered a question LUA: tlv_tree:add "hex data sequence"

Hello, here how I solved my issue: [1] collect the arbitrary bytes into array [2] add a tree with custom length (if s

2021-07-30 19:05:36 +0000 commented question LUA: tlv_tree:add "hex data sequence"

What I'm really looking after is to implement a kinda of payload concept like this: payload_example There the amount o

2021-07-30 18:55:43 +0000 commented question LUA: tlv_tree:add "hex data sequence"

this seems to do the trick... local bytearr = {} for i = 1, tlvlen do bytearr[i] = string.format("%X", buffer(o

2021-07-30 05:51:25 +0000 received badge  Rapid Responder (source)
2021-07-30 05:51:25 +0000 answered a question LUA: tlv_tree:add "hex data sequence"

this seems to do the trick... local bytearr = {} for i = 1, tlvlen do bytearr[i] = string.format("%X", buffer(o

2021-07-29 21:21:03 +0000 asked a question LUA: tlv_tree:add "hex data sequence"

LUA: tlv_tree:add "hex data sequence" Hello, One TLV has length 18... If I try to add to the display tree using: f.tlv