Wireshark · Wireshark-dev: Re: [Wireshark-dev] Wireshark lua (wslua) and bit fields - how to do it?

[Daniel Lynes <dlynes@xxxxxxxxxxx>]

Thanks, Tamás,

Is this the best way of doing bitfields in wireshark, if you want to make them filterable?

On Fri, 2010-10-22 at 13:05 +0800, Tamás Regõs wrote:
>     Hi,
>      
>     Try ByteArray.tvb(hexba,"hex") instead of Tvb.new_real(hexba, "hex")
>     Tvb.new_real does not exists.
>      
>     Regards,
>     Tamas
>      
>

---

From: wireshark-dev-bounces@xxxxxxxxxxxxx [mailto:wireshark-dev-bounces@xxxxxxxxxxxxx] On Behalf Of Daniel Lynes
Sent: Friday, 22 October 2010 4:46 AM
To: wireshark-dev@xxxxxxxxxxxxx
Subject: [Wireshark-dev] Wireshark lua (wslua) and bit fields - how to do it?

>     
>     I'm trying to output some bit values in my wireshark dissector decode.  However, I want to be able to filter based on those bit values.
>     
>     I can't seem to use the LUA bitop library to do it, because lua complains that the result is not a uservalue.
>     
>     I've got the following code:
>     
>                             for shred = 1, num_shreds
>                             do
>                                     subtree:add("----- NV Storage Shred " .. shred .. " -----")
>                                     subtree:add(fields.shred_id, buffer(offset, 8))
>                                     subtree:add(fields.shred_flags, buffer(offset+8, 8))
>                                     local flags=tonumber(tostring(buffer(offset+8,8):uint64()))
>                                     local hex=tostring(bit.tohex(bit.band(flags,0x02)))
>                                     subtree:add("----- NV Storage hex flags: " .. hex)
>                                     local hexba=ByteArray.new(hex)
>                               -- The following line complains about a nil uservalue
>                                     local rdonly=Tvb.new_real(hexba, "hex")
>                               -- The following line complains about the value being a number instead of a uservalue
>                                     subtree:add(fields.shred_rd, bit.band(flags, 0x02))
>                                     offset=offset+inc
>                             end
>     
>     Does anyone happen to have any clues as to what I'm doing wrong?  Fwiw, I'm using 1.2.0 (1.3, 1.4, and 1.5 all have video corruption issues, and 1.0 has issues with 64-bit integers).
>     
>     Thanks.

Daniel Lynes
Software Engineer
PV Labs Intelligent Imaging
(905) 667-7308