Wireshark · Wireshark-dev: [Wireshark-dev] Wireshark lua dissector unable to load for media_type=application/octet-stream

[Cong Ling <cong.ling@xxxxxxxxxxxxxxxxx>]

Hi all,
	I'm trying to write a lua Proto to parse our private protocol on http. But Wireshark didn't enter my dissector function when the media_type to "application/octet-stream". When the media_type is set to "text/html", everything looks fine. 
	Is there special handling for application/octet-stream? 
	I was working on it for almost a day, Could you help me out? 
	Thx a lot

My wireshark version is 1.10.2 on mac osx 10.8.5

Here's my code

do
    local myproto= Proto("myprotoProtocol","myproto Protocol")
    local f_version= ProtoField.uint32("Version","Version",base.DEC)
    myproto.fields = {f_version}
    local data_dis = Dissector.get("data")
    local function myproto_dissector(tvb,pkt,root)
            print("enter myproto_dissector, tvb.len:"..tostring(tvb:len()))
            if tvb:len() < 17 then return false end
            pkt.cols.protocol = "myproto"
            local t =root:add(myproto,tvb)
            t:add(f_version,tvb(0,2))
            local version = tvb(0,2).uint()
            print("version:"..tostring(version))
            return true
    end

    function myproto.dissector(tvb,pkt,root)
            print("enter myproto.dissector")
            if not myproto_dissector(tvb,pkt,root) then
                    data_dis:call(tvb,pkt,root)
            end
    end

    local tbl= DissectorTable.get("media_type")
    tbl:add("application/octet-stream",myproto)
    --tbl:add("text/html",myproto) --text/html looks fine
    print("adding myproto into DissectorTable")
 end

I use tshark to debugging for application/octet-stream

$tshark  -r test.pcapng   |grep application/octet-stream
108 40.536817000    10.8.0.14 -> 10.130.142.72 HTTP 418 POST /protocol?uid=101225&uid=101225&_t=1382115502 HTTP/1.1  (application/octet-stream)
111 40.596037000 10.130.142.72 -> 10.8.0.14    HTTP 63 HTTP/1.1 200 OK  (application/octet-stream)
120 40.657143000    10.8.0.14 -> 10.130.142.72 HTTP 445 POST /protocol?uid=101225&uid=101225&_t=1382115502    HTTP/1.1  (application/octet-stream)
124 40.729645000 10.130.142.72 -> 10.8.0.14    HTTP 63 HTTP/1.1 200 OK  (application/octet-stream)
219 41.810493000    10.8.0.14 -> 10.130.142.72 HTTP 488 POST /protocol?uid=101225&uid=101225&_t=1382115503 HTTP/1.1  (application/octet-stream)
226 41.919401000 10.130.142.72 -> 10.8.0.14    HTTP 63 HTTP/1.1 200 OK  (application/octet-stream)

$tshark  -r test.pcapng   -X lua_script:canon.lua | grep myproto
adding myproto into DissectorTable

for text/html

 $tshark  -r test.pcapng   -X lua_script:canon.lua | grep myproto
 adding myproto into DissectorTable
 enter myproto.dissector
 enter myproto_dissector, tvb.len:2
 enter myproto.dissector
 enter myproto_dissector, tvb.len:6
 enter myproto.dissector
 enter myproto_dissector, tvb.len:6



Regards,
Cong Ling