Ordinary LUA dissector.

[Eliot Blennerhassett <eblennerhassett () audioscience com>]

Getting started writing a dissector plugin in lua, I found the examples
on the wiki to be rather esoteric.  Only having previously written a
plugin in C gave me any idea where to start.

Is there any interest in including a more "ordinary" dissector example
on the wiki, or with the wireshark install for that matter?

Here is a working example, however I've no idea if it is best-practice
implementation...

-- Wireshark dissector for CobraNet protocol (ethertype == 0x8819)
do
        -- Create a new dissector
        COBRANET = Proto ("cobranet", "CobraNet")
        local cobranet_ethertype = 0x8819

        -- Create the protocol fields
        local pdus= {[0]="Beat", [1]="Reservation", [0x10]="Audio"}


        local f = COBRANET.fields
        f.pdu = ProtoField.uint8 ("cobranet.pdu",  "PDU Type", nil, pdus)
        f.version = ProtoField.uint8 ("cobranet.version",  "Version")

        f.res_ip = ProtoField.ipv4 ("cobranet.res_ip",  "IP address")
        f.tx_bundles = ProtoField.string("cobranet.tx_bundles")
        f.tx_bundle = ProtoField.bytes ("cobranet.tx_bundle",  "Tx Bundle")
        f.tx_bundle_num = ProtoField.uint16 ("cobranet.tx_bundle_num",  "Tx
Bundle Num")

        f.rx_bundles = ProtoField.string("cobranet.rx_bundles")
        f.rx_bundle = ProtoField.bytes ("cobranet.rx_bundle",  "Rx Bundle")
        f.rx_bundle_num = ProtoField.uint16 ("cobranet.rx_bundle_num",  "Rx
Bundle Num")

        f.unknown = ProtoField.bytes ("cobranet.unknown",  "Unknown")

        f.the_rest = ProtoField.bytes ("cobranet.the_rest", "The Rest")

        function tx_bundle(buffer, subtree, n)
                local tx = subtree:add_le(f.tx_bundle_num, buffer(16 + 2 + n * 6, 2))
                tx:add(f.tx_bundle, buffer(16 + n * 6, 6))
        end

        function tx_bundles(buffer, subtree)
                local n
                local tx_tree = subtree:add(f.tx_bundles)
                tx_tree:set_text("Tx Bundles")
                for n = 0, 3, 1 do
                        tx_bundle(buffer, tx_tree, n)
                end
        end

        function rx_bundle(buffer, subtree, n)
                local rx = subtree:add_le(f.rx_bundle_num, buffer(42 + 2 + n * 10, 2))
                rx:add(f.rx_bundle, buffer(42 + n * 10, 10))
        end

        function rx_bundles(buffer, subtree)
                local n
                local rx_tree = subtree:add(f.rx_bundles)
                rx_tree:set_text("Rx Bundles")
                for n = 0, 7, 1 do
                        rx_bundle(buffer, rx_tree, n)
                end
        end

        -- The dissector function
        function COBRANET.dissector (buffer, packet, tree)
                -- Adding fields to the tree
                local subtree = tree:add (COBRANET, buffer())
                local offset = 0
                local n
                local pdu_buf= buffer (0, 1)
                local pdu = pdu_buf:uint()

                packet.cols.protocol:set("CobraNet")
                packet.cols.info:set(pdus[pdu])

                subtree:add (f.pdu, pdu_buf)

                subtree:add (f.version, buffer (1, 1))

                offset =  2

                if pdu == 1 then
                        subtree:add(f.unknown, buffer(2, 8))
                        subtree:add(f.res_ip, buffer(10, 4))
                        subtree:add(f.unknown, buffer(14, 2))
                        tx_bundles(buffer, subtree)
                        subtree:add(f.unknown, buffer(40, 2))
                        rx_bundles(buffer, subtree)
                        offset = 122
                end

                subtree:add (f.the_rest, buffer(offset))
        end

        ether_table = DissectorTable.get ("ethertype")
        ether_table:add (cobranet_ethertype, COBRANET)
end


-- 
Eliot Blennerhassett
AudioScience Inc.

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe