Wireshark-dev: [Wireshark-dev] Lua postdissector not registering new field
From: "Martin Visser" <[email protected]>
Date: Fri, 14 Nov 2008 17:15:11 +1100

I am just playing with the chained postdissector example in http://wiki.wireshark.org/Lua/Dissectors

It correctly registers the "http_extra" protocol, and the chaining works in that I get the extra analysis being done and the spiffy new text at the bottom of the packet details. However the fields http.newfield1 and http.newfield2 do not seem to be registered. The comment in the example code indicates it should appear in the _expression_ list, but they don't , and I can't use the display filter "http.newfield1 ==42" - it stays red, hence I am confident it isn't being registered. The lua code doesn't bomb out (as the other stuff works), so I am wondering whether something has been broken since the supposed 0.99.7 that it has been tested on (i'm currently on 1.0.4 in Windows.

(BTW I changed the line "if f_set_cookie() then" to just "if 1 then" to exercise it on every http packet.)

Regards, Martin

[email protected]