Search code examples
c++luawiresharkkali-linux

Wireshark Dissector VoidString type


I am working on a Wireshark Dissector Generator for a senior project. I have done some reading but had a question about the VoidString object in the ProtoField Object. The documentation wasn't too clear on this particular value or what its used for.

Our generator uses C++ so that our client can modify it after the project is complete. I was reading in another thread here that it could be passed a table of key, value pairs. Are there other structures or information this parameter is used for? We're trying to make a data structure to contain the parse of a file passed by the user and we're trying to determine how to best make this object. Would it be better to allow a template object to be passed here instead or is the table sufficient?


Solution

  • I'm not sure to understand your needs but according to the wireshark source code (wslua_proto_fields.c), the definition of the VoidString parameter is :

    #define WSLUA_OPTARG_ProtoField_new_VALUESTRING 4 /* A table containing the text that
        corresponds to the values, or a table containing unit name for the values if base is
        `base.UNIT_STRING`, or one of `frametype.NONE`, `frametype.REQUEST`, `frametype.RESPONSE`,
        `frametype.ACK` or `frametype.DUP_ACK` if field type is ftypes.FRAMENUM. */
    

    So the table will be "cast" following the type and print in base representation.