Quantcast
Channel: Ask Wireshark - RSS feed
Viewing all articles
Browse latest Browse all 6

Answer by JeffMorriss for I'm developing a custom Lua dissector that uses a custom DissectorTable against a payload type information contained in the header to dissect the payload data. It appears however that payload types can be grouped and a range of payload types can be dissected the same, with small differences.When adding a subdissector to a tcp.port, I can always check the pinfo.srcport or pinfo.dstport, but how could a subdissector find out or be informed about the custom value that was used to find it in the dissector table?Is there a way to add information to either the pinfo or tree from the parent dissector before the subdissector is called?

$
0
0
Actually the correct way to detect how/why a subdissector is being called is to use the `pinfo->match_uint` or `match_string` fields. These will tell you, to quote the comment in `packet_info.h`, the "matched uint for calling subdissector from table". I don't know the Lua API enough to know if that field is exposed to Lua dissectors but I would hope it is...

Viewing all articles
Browse latest Browse all 6

Trending Articles