[Date Prev][Date Next][Thread Prev][Thread Next]
- Subject: Re: problem in adding message in wireshark tree
- From: Doug Rogers <doug.rogers@...>
- Date: Mon, 26 Oct 2009 12:43:44 -0400
Awadhesh Kumar wrote:
But in second call of disectors, udp length is coming null. I don't
know for what packet this is being called?
Please help me in this regard.
I *think* the second call is a re-dissection of the packet, and I
*think* the whole set of properties gets cleared out when a packet is
re-dissected. Each packet is then freshly dissected. You can pick up
properties when you chain dissectors or register as a postdissector. You
might also be able to store some history in a global table, but I
haven't tried that.
The Wireshark Lua API documentation is not complete - it's on their
to-do list. You might be able to track down your problem by looking at
the Lua interface code in the Wireshark distribution under epan/wslua.
Also, try trimming down your dissector to the bare minimum that shows
the problem - including how it is registered with the UDP or TCP table -
then post the full code (to the Wireshark list). My Wireshark dissectors
are called whenever a new filter is applied and whenever a particular
packet is selected. When I initially load a pcap file, it does not run
twice. but only once.
I learned enough of the Wireshark Lua API to replace my binary C filter
with a much simpler Lua one so I can move it easily between Windows and
Linux. But I'm far from an expert.
As KHMan indicated, you'll have better luck contacting Wireshark Lua API
people. This isn't such a bad place to look initially, I suppose. You
might find a few here (I'm not one).
On a side note, I'd like to add some kind words of congratulations to
KHMan. In the past I have seen more severe admonishments from you. I'm
happy to see your patience has improved! :)
The information contained in this email transmission may contain proprietary and business
sensitive information. If you are not the intended recipient, you are hereby notified that
any review, dissemination, distribution or duplication of this communication is strictly
prohibited. Unauthorized interception of this e-mail is a violation of law. If you are not
the intended recipient, please contact the sender by reply email and immediately destroy all
copies of the original message.
Any technical data and/or information provided with or in this email may be subject to U.S.
export controls law. Export, diversion or disclosure contrary to U.S. law is prohibited.
Such technical data or information is not to be exported from the U.S. or given to any foreign
person in the U.S. without prior written authorization of Elbit Systems of America and the
appropriate U.S. Government agency.