Wireshark-dev: Re: [Wireshark-dev] New in Wireshark making a dissector
Date: Wed, 27 Apr 2016 12:36:39 +0200

First of all, thanks for your help!
I will not use C language. I am learning LUA (only) and for this, I am
doing a dissector for protocol over TCP.

I have one question:

I want add subtree , a HEX value with 16bytes, but  buf max is 8 bytes,
when I tried more not works. I tried defining Protofield  like a string
and it works but I want to show in HEX . Why can do it?

local f_marker = ProtoField.string("myproto.marker", "MARKER", base.HEX)

  subtree = root:add(p_myproto, buf(0))
  subtree:add(f_marker, buf(0,16))

Hi Javi,
There is a painfully simple dissector for logcat I commited some time ago.
It could help getting the basic ideas how to register the dissector etc.:


Wiretap part (I/O for data source):

The commit which added above to logcat, with registering it etc.:

On 5 April 2016 at 10:49, Paul Offord <[email protected]> wrote:

    Hi Javi,

    I wrote a dissector for the PCoIP protocol in the LUA language.  It's
OK but it would be far better written in C (as suggested by Alexis). 
You can find the LUA source code and some background information
regarding PCoIP at https://community.tribelab.com.  Full details of
the PCoIP header are not available - it's a proprietary protocol - but
it uses the ESP which is useful for tracking sequence numbers.  This
means that you could write a very simple dissector that dumped the hex
for the PCoIP Transport Header and then handed off to the existing
Wireshark ESP header.  It would be a great introduction to writing

    Best regards...Paul

    -----Original Message-----
    From: [email protected]
[/correo2/src/[email protected]] On
Behalf Of [email protected]
    Sent: 05 April 2016 09:32
    To: [email protected]
    Subject: [Wireshark-dev] New in Wireshark making a dissector


    I am a studient at a University (UPNA).
    My challenge is make a dissector for a another protocol that is not
now dissected. I´m a noob, so I´m reading Developer´s guide. If you
have any advice, suggestion of protocol... or whatever, please tell

    Javi Guembe.

    Sent via:    Wireshark-dev mailing list <[email protected]>
    Archives:    https://www.wireshark.org/lists/wireshark-dev
    Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
                 /correo2/src/[email protected]?subject=unsubscribe


    This message contains confidential information and is intended only
for the individual named. If you are not the named addressee you
should not disseminate, distribute or copy this e-mail. Please notify
the sender immediately by e-mail if you have received this e-mail by
mistake and delete this e-mail from your system.

    Any views or opinions expressed are solely those of the author and do
not necessarily represent those of Advance Seven Ltd. E-mail
transmission cannot be guaranteed to be secure or error-free as
information could be intercepted, corrupted, lost, destroyed, arrive
late or incomplete, or contain viruses. The sender therefore does not
accept liability for any errors or omissions in the contents of this
message, which arise as a result of e-mail transmission.

    Advance Seven Ltd. Registered in England & Wales numbered 2373877 at
Endeavour House, Coopers End Lane, Stansted, Essex CM24 1SJ

    This email has been scanned by the Symantec Email Security.cloud service.
    For more information please visit http://www.symanteccloud.com
    Sent via:    Wireshark-dev mailing list <[email protected]>
    Archives:    https://www.wireshark.org/lists/wireshark-dev
    Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
                 /correo2/src/[email protected]?subject=unsubscribe

Pozdrawiam / Best regards
Micha&#322; Orynicz, Software Engineer
Tieto Corporation

Product Development Services

http://www.tieto.com / http://www.tieto.pl
ASCII: Michal Orynicz
location: Swobodna 1 Street, 50-088 Wroc&#322;aw, Poland
room: 5.01 (desk next to 5.08)
Please note: The information contained in this message may be legally
privileged and confidential and protected from disclosure. If the
reader of this message is not the intended recipient, you are hereby
notified that any unauthorised use, distribution or copying of this
communication is strictly prohibited. If you have received this
communication in error, please notify us immediately by replying to
the message and deleting it from your computer. Thank You.
Please consider the environment before printing this e-mail.
Tieto Poland spó&#322;ka z ograniczon&#261; odpowiedzialno&#347;ci&#261; z
siedzib&#261; w
Szczecinie, ul. Malczewskiego 26. Zarejestrowana w S&#261;dzie Rejonowym
Szczecin-Centrum w Szczecinie, XIII Wydzia&#322; Gospodarczy Krajowego
Rejestru S&#261;dowego pod numerem 0000124858. NIP: 8542085557. REGON:
812023656. Kapita&#322; zak&#322;adowy: 4 271500 PLN

Sent via:    Wireshark-dev mailing list <[email protected]>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:[email protected]?subject=unsubscribe