Wireshark · Wireshark-dev: Re: [Wireshark-dev] New in Wireshark making a dissector

[guembe.100649@xxxxxxxxxxxxx]

Hi!

First of all, thanks for your help!
I will not use C language. I am learning LUA (only) and for this, I am
doing a dissector for protocol over TCP.

I have one question:

I want add subtree , a HEX value with 16bytes, but  buf max is 8 bytes,
when I tried more not works. I tried defining Protofield  like a string
and it works but I want to show in HEX . Why can do it?

local f_marker = ProtoField.string("myproto.marker", "MARKER", base.HEX)

  subtree = root:add(p_myproto, buf(0))
  subtree:add(f_marker, buf(0,16))


THANKSSS!!!
____________________________--------------------------__________________________-
Hi Javi,
There is a painfully simple dissector for logcat I commited some time ago.
It could help getting the basic ideas how to register the dissector etc.:

Dissector:
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=blob;f=epan/dissectors/packet-logcat-text.c;h=5699e4d75b5707b5985c2c5abb3eb2807603986e;hb=735263e58e2a6a92389777d7baa2da2fa4d809a8

Wiretap part (I/O for data source):
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=blob;f=wiretap/logcat_text.h;h=90f88ec0f143d8d374eb7ec87605ba240ebf77d8;hb=735263e58e2a6a92389777d7baa2da2fa4d809a8
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=blob;f=wiretap/logcat_text.c;h=7d9cf4322f494265df37455093a12970d67cfba6;hb=735263e58e2a6a92389777d7baa2da2fa4d809a8

The commit which added above to logcat, with registering it etc.:
https://code.wireshark.org/review/#/c/1802/

On 5 April 2016 at 10:49, Paul Offord <Paul.Offord@xxxxxxxxxxxx> wrote:

    Hi Javi,

    I wrote a dissector for the PCoIP protocol in the LUA language.  It's
OK but it would be far better written in C (as suggested by Alexis). 
You can find the LUA source code and some background information
regarding PCoIP at https://community.tribelab.com.  Full details of
the PCoIP header are not available - it's a proprietary protocol - but
it uses the ESP which is useful for tracking sequence numbers.  This
means that you could write a very simple dissector that dumped the hex
for the PCoIP Transport Header and then handed off to the existing
Wireshark ESP header.  It would be a great introduction to writing
dissectors.

    Best regards...Paul

    -----Original Message-----
    From: wireshark-dev-bounces@xxxxxxxxxxxxx
[/correo2/src/compose.phpwireshark-dev-bounces@xxxxxxxxxxxxx] On
Behalf Of guembe.100649@xxxxxxxxxxxxx
    Sent: 05 April 2016 09:32
    To: wireshark-dev@xxxxxxxxxxxxx
    Subject: [Wireshark-dev] New in Wireshark making a dissector

    Hi!

    I am a studient at a University (UPNA).
    My challenge is make a dissector for a another protocol that is not
now dissected. I´m a noob, so I´m reading Developer´s guide. If you
have any advice, suggestion of protocol... or whatever, please tell
me!

    Thanks,
    Javi Guembe.

    ___________________________________________________________________________
    Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
    Archives:    https://www.wireshark.org/lists/wireshark-dev
    Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
                 /correo2/src/compose.phpwireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe

    ______________________________________________________________________

    This message contains confidential information and is intended only
for the individual named. If you are not the named addressee you
should not disseminate, distribute or copy this e-mail. Please notify
the sender immediately by e-mail if you have received this e-mail by
mistake and delete this e-mail from your system.

    Any views or opinions expressed are solely those of the author and do
not necessarily represent those of Advance Seven Ltd. E-mail
transmission cannot be guaranteed to be secure or error-free as
information could be intercepted, corrupted, lost, destroyed, arrive
late or incomplete, or contain viruses. The sender therefore does not
accept liability for any errors or omissions in the contents of this
message, which arise as a result of e-mail transmission.

    Advance Seven Ltd. Registered in England & Wales numbered 2373877 at
Endeavour House, Coopers End Lane, Stansted, Essex CM24 1SJ

    ______________________________________________________________________
    This email has been scanned by the Symantec Email Security.cloud service.
    For more information please visit http://www.symanteccloud.com
    ______________________________________________________________________
    ___________________________________________________________________________
    Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
    Archives:    https://www.wireshark.org/lists/wireshark-dev
    Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
                 /correo2/src/compose.phpwireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe




-- 
Pozdrawiam / Best regards
Micha&#322; Orynicz, Software Engineer
Tieto Corporation

Product Development Services

http://www.tieto.com / http://www.tieto.pl
---
ASCII: Michal Orynicz
location: Swobodna 1 Street, 50-088 Wroc&#322;aw, Poland
room: 5.01 (desk next to 5.08)
---
Please note: The information contained in this message may be legally
privileged and confidential and protected from disclosure. If the
reader of this message is not the intended recipient, you are hereby
notified that any unauthorised use, distribution or copying of this
communication is strictly prohibited. If you have received this
communication in error, please notify us immediately by replying to
the message and deleting it from your computer. Thank You.
---
Please consider the environment before printing this e-mail.
---
Tieto Poland spó&#322;ka z ograniczon&#261; odpowiedzialno&#347;ci&#261; z
siedzib&#261; w
Szczecinie, ul. Malczewskiego 26. Zarejestrowana w S&#261;dzie Rejonowym
Szczecin-Centrum w Szczecinie, XIII Wydzia&#322; Gospodarczy Krajowego
Rejestru S&#261;dowego pod numerem 0000124858. NIP: 8542085557. REGON:
812023656. Kapita&#322; zak&#322;adowy: 4 271500 PLN

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe