I thought I had better follow up on this. After privately consulting with Luis, I have worked out what has gone wrong. I took the sample code and tried to run it outside of init.lua using a function that was registered with the menu (using register_menu() ).
It turns out the fields must be created before init.lua finishes. You can register new protocols and dissectors at run time (as I did with the menu function), but not fields.
Regards, Martin
MartinVisser99@xxxxxxxxx
On Fri, Nov 14, 2008 at 5:15 PM, Martin Visser
<martinvisser99@xxxxxxxxx> wrote:
Hi,
I am just playing with the chained postdissector example in http://wiki.wireshark.org/Lua/Dissectors
It correctly registers the "http_extra" protocol, and the chaining works in that I get the extra analysis being done and the spiffy new text at the bottom of the packet details. However the fields http.newfield1 and http.newfield2 do not seem to be registered. The comment in the example code indicates it should appear in the _expression_ list, but they don't , and I can't use the display filter "http.newfield1 ==42" - it stays red, hence I am confident it isn't being registered. The lua code doesn't bomb out (as the other stuff works), so I am wondering whether something has been broken since the supposed 0.99.7 that it has been tested on (i'm currently on 1.0.4 in Windows.
(BTW I changed the line "if f_set_cookie() then" to just "if 1 then" to exercise it on every http packet.)
--
Regards, Martin
MartinVisser99@xxxxxxxxx
