Search code examples
luawireshark-dissector

lua wireshark dissector: Protofield specifiers


I have this protocol fields descriptor in LUA:

local atcs_hdr = {
   region = Protofield.uint16("atcs.rrp.region","Region",base.HEX)
}

which produces this tree item:

Region: 0x9AA1

what I really need is a string representation from a function that converts this hex value to "6817.1":

Region: 6817.1

I have a local function that does this conversion:

local function HexToRegion(val)
    -- input: 0xA70F
    -- output: 9999.1 
    local region = bit.band(val,0x7FFF)
    local dir = 0
    if (bit.band(val,0x8000) == 0x8000) then
        dir = 1
    end
    return string.format("%d.%d",region,dir)
end

but how do I link it to the Protofield specifier?

EDIT: The dissector adds this 'region' to the tree here:

local region_tvbr = tvbuf:range(0,2)
tree:add("atcs.rrp.region",region_tvbr )       
-- Region: 0x9AA1

I can get ALMOST what I want by adding the string function:

local region_tvbr = tvbuf:range(0,2)
local region_val = region_tvbr:uint()
local subtree = tree:add("atcs.rrp.region",region_tvbr)
subtree:append_text("("..HexToRegion(region_val)..")")         
-- Region: 0x9AA1 (6817.1)

But that's not what I'm looking for.


Solution

  • I think you should be able to use set_text to achieve what you want. For example:

    local region_item = tree:add(atcs_hdr.region, tvbuf:range(0, 2))
    region_item:set_text("Region: " .. HexToRegion(tvbuf:range(0, 2):uint()))
    

    Refer to Section 11.7. Adding information to the dissection tree in the Wireshark Developer's Guide for more information, or to the Wireshark LuaAPI/TreeItem wiki page.