Wireshark-users: Re: [Wireshark-users] How to add an array to a subtree in a Wireshark Lua dissec
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 24 Jul 2018 10:09:56 -0700
("How do I do XXX in a Wireshark dissector?" is more of a wireshark-developers question than a wireshark-users question.)

On Jul 24, 2018, at 12:54 AM, David Aldrich <david.aldrich.ntml@xxxxxxxxx> wrote:

> I am writing a Wireshark dissector with Lua that dissects a complex payload of a TCP packet. The payload has well-defined octet and integer fields, which I can cope with, but includes a data section that contains an array of compressed IQ complex numbers. That array is complex to decode and I can probably get away with just displaying it as an octet array or bitstream. What options are available to me in Lua to do this? 

Define an FT_BYTES field and add the entire array in question as a single protocol tree item using that field.  The "Lua dissector" documentation should indicate how to do that.