使用我的自定义解析器单击时，wireshark 中的数据包数据未突出显示
我正在 Lua 中为自定义二进制协议编写一个解析器。我定义了三种字段类型：
f.field1= ProtoField.bytes("myproto.field1","Field 1",base.HEX)
f.field2= ProtoField.uint16("myproto.field2","Field 2",base.HEX)
f.field3= ProtoField.bytes("myproto.field3","Field 3",base.HEX)
这些字段像这样添加到树中：
subtree:add(f.field1,buf(offset,4))
offset = offset +4
val2=buf(offset,2):uint()
-- some logic around populating f2_description omitted
offset=offset+2
subtree:add(f.field2,val2):append_text(" (" ..f2_description ..")")
subtree:add(f.field3,buf(offset,2))
现在，当我打开 Wireshark 并单击剖析数据包树中的 Field1 或 Field3 时，我看到所选数据在原始数据包十六进制视图中突出显示（最底部）控制板）： 
，但 Field2 的情况并非如此： 
我做错了什么？
I am writing a dissector in Lua for a custom, binary protocol. I have defined three field types:
f.field1= ProtoField.bytes("myproto.field1","Field 1",base.HEX)
f.field2= ProtoField.uint16("myproto.field2","Field 2",base.HEX)
f.field3= ProtoField.bytes("myproto.field3","Field 3",base.HEX)
These fields are added to tree like this:
subtree:add(f.field1,buf(offset,4))
offset = offset +4
val2=buf(offset,2):uint()
-- some logic around populating f2_description omitted
offset=offset+2
subtree:add(f.field2,val2):append_text(" (" ..f2_description ..")")
subtree:add(f.field3,buf(offset,2))
Now, when I open Wireshark and click on Field1 or Field3 in dissected packet's tree, I see that the selected data is highlighted in the raw packet hex view (bottom most panel):
, but it is not the case for Field2:
What am I doing wrong?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
如果树的第二个参数：add(..,..) 是（或至少直接引用）UserData 类型值，则 Wireshark 解析器会选择正确的字段。
在您的示例中， buf () 是 UserData，但 val2 不是。
尝试一下：
另一方面，您不会为 ISO8583 编写解析器，对吗？
Wireshark dissectors do select the right fields if the second parameter to the tree:add(..,..) is (or at least, directly references) a UserData type value..
On your example, buf() is UserData, but val2 is not.
Give this a try:
On the other hand, you wouldn't be writing a dissector for ISO8583, would you?