Search code examples
luawireshark-dissector

How to translate "\r\n" string in Lua script with Wireshark


I have written a Lua script to analyze some protocols. I wanna split long strings, so I need to split them into lines.

But when I try to use "\r\n" , there shows "\r\n" in wireshark , not new line. For example , I write code like below, but there shows "value \12\r\r\n". This means that "\\" is translated to "\" successful , but 0x0d and "\r\n" it's not translated?

local normalized_value = '\\'.."12"..string.char(0x0d).."\r\n" 

How to make this work?


Solution

  • Finnaly , I found this in source code of Wireshark. Yes, wireshark ignored these symbols. You can find it in print.c

    static void
    print_escaped_csv(FILE *fh, const char *unescaped_string)
    {
        const char *p;
    
        if (fh == NULL || unescaped_string == NULL) {
            return;
        }
    
        for (p = unescaped_string; *p != '\0'; p++) {
            switch (*p) {
            case '\b':
                fputs("\\b", fh);
                break;
            case '\f':
                fputs("\\f", fh);
                break;
            case '\n':
                fputs("\\n", fh);
                break;
            case '\r':
                fputs("\\r", fh);
                break;
            case '\t':
                fputs("\\t", fh);
                break;
            default:
                fputc(*p, fh);
            }
        }
    }
    

    So I decided to build my own version