Home/ Questions/Q 7544105
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-30T08:36:05+00:00

I am writing a dissector in Lua for a custom, binary protocol. I have

  • 0

I am writing a dissector in Lua for a custom, binary protocol. I have defined three field types:

f.field1= ProtoField.bytes("myproto.field1","Field 1",base.HEX)
f.field2= ProtoField.uint16("myproto.field2","Field 2",base.HEX)
f.field3= ProtoField.bytes("myproto.field3","Field 3",base.HEX)

These fields are added to tree like this:

subtree:add(f.field1,buf(offset,4))
offset = offset +4
val2=buf(offset,2):uint()
-- some logic around populating f2_description omitted
offset=offset+2
subtree:add(f.field2,val2):append_text(" (" ..f2_description ..")")
subtree:add(f.field3,buf(offset,2))

Now, when I open Wireshark and click on Field1 or Field3 in dissected packet’s tree, I see that the selected data is highlighted in the raw packet hex view (bottom most panel):
field selection is highlighted

, but it is not the case for Field2:
enter image description here

What am I doing wrong?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Wireshark dissectors do select the right fields if the second parameter to the tree:add(..,..) is (or at least, directly references) a UserData type value..

    On your example, buf() is UserData, but val2 is not.

    Give this a try:

    subtree:add(f.field2,buf(offset,2):uint()):append_text(" (" ..f2_description ..")")

    On the other hand, you wouldn’t be writing a dissector for ISO8583, would you?

    • 0