Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] Lua post-dissector not getting field values

Date: Thu, 17 Sep 2009 09:42:35 -0400
What am I missing?  The field extractor always returns nil, so the seq value is always -1.  The frame number is correct, however, so I know the code is being executed.  In my listener code I used the same field extractor for the 802.15.4 seq number and it worked fine there.

-- I define my "protocol":
  local post154_proto = Proto("post802154", "Extra analysis of 802.15.4 fields", "Post802514");

-- I define 2 fields:
  local F_frmNum = ProtoField.framenum("post802154.frmNum", "Wireshark frame number", base.DEC)
  local F_seqNum = ProtoField.int8("post802154.seqNum", "802.15.4 seq number", base.DEC)

-- I add the field to my protocol:
  post154_proto.fields = { F_frmNum, F_seqNum }

-- I declare a field extractor:
  local seq_no = Field.new("ieee802.15.4.seq_no")

-- I register my postdissector:
  register_postdissector(post154_proto)                

-- And I create a dissector function that uses the field extractor to add an item to the display tree:

  function post154_proto.dissector(tvbuffer, pinfo, treeitem)

    -- Get frame number from pinfo
    local fnum   = pinfo.number

    -- Get value from field extractor (-1 if field is nil)
    local seq = -1
    if seq_no() then seq=seq_no().value end

    -- Add our extra protocol subtree
    local subtreeitem = treeitem:add(post154_proto, tvbuffer)

    -- Display the field value
    subtreeitem:add(F_frmNum, tvbuffer(0,0), fnum)
    subtreeitem:add(F_seqNum, tvbuffer(0,0), seq)

  end