Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: [Wireshark-users] lua dissector

From: "BAVOUX Jean-Baptiste" <Jean-Baptiste.BAVOUX@xxxxxxxxxxxxxxxx>
Date: Wed, 20 Oct 2010 13:04:24 +0200
Hi every body !

I'm trying to write a (very simple) dissector:

Here is my code:
-- trivial protocol example
-- declare our protocol
Myproto_proto = Proto("Myproto","Myproto Protocol")
-- create a function to dissect it
function Myproto_proto.dissector(buffer,pinfo,tree)
    pinfo.cols.protocol = "Myproto"
    local subtree = tree:add(Myproto_proto,buffer(),"Myproto Protocol Data")
	
	subtree:add(buffer(0,1),"The first character: " .. buffer(0,1)) -- this works very fine
	subtree:add(buffer(-1,1),"The last character: " .. buffer(-1,1)) -- this doesn't work
	
end
-- load the udp.port table
tcp_table = DissectorTable.get("tcp.port")
-- register our protocol to handle tcp port 8001 & 8002
tcp_table:add(8001,Myproto_proto)
tcp_table:add(8002,Myproto_proto)

For the last character, the value displayed is correct, but the data highlighted is not the good one.
It shows the character before the first one instead of the last character of the frame !!

How do I get the lenght of buffer? ( I tried pinfo.len but it doesn't work) ?
Is buffer(-1,1) correct to get last character?
How do I know what function I can call on buffer? ( the type seems to be 'userdata' ) ?

Thank you,

JB