Search code examples
luawiresharkwireshark-dissectorethercat

Chained Dissector in Lua


I'm writing a chained dissector in Lua for the Ethercat protocol. I named my chained dissector littlecat.

For what I have so far, littlecat correctly dissects the fields I want it to. However, instead of executing after the built in ecat dissector, littlecat takes it over completely.

This is what the registration at the end of my Lua code looks like.

-- Initialize Protocol
function littlecat.init()
end

-- Register Chained Dissector Ethercat Port
local ethercat_dissector_table = DissectorTable.get("ecatf.type")
dissector = ethercat_dissector_table:get_dissector(1)

 -- Dissector can be called from littlecat.dissector
 -- So the previous dissector gets called      
 ethercat_dissector_table:add(1, littlecat)

How can I have my dissector execute after ecat has been executed?


Solution

  • I found a solution.

    To ensure that the default dissector is called, and then the custom dissector:

    1. Define the dissector table and original dissector before the dissection function.
    2. Call original dissector within the dissection function.

    Example

    -- Initialize Protocol 
    -- Initialize Protocol Fields
    
    -- Define dissector table and default dissector here
    -- so they can be called within the dissection func.
    
    local dissector_table = DissectorTable.get("shortname")
    dissector = dissector_table:get_dissector(PORT)
    
     -- Dissection Function
     function dissectorname.dissector (tvbuf, pktinfo, root)
    
        -- Call default dissector.
        dissector(tvbuf, pktinfo, root)
    
        -- Continue dissection....
    
    end
    
    -- Initialize Protocol
    function dissectorname.init()
    end
    
    -- Dissector can be called from dissectorname.dissector
    -- So the previous dissector gets called      
    dissector_table:add(PORT, dissectorname)