Skip to content

Commit

Permalink
Expand documentation and add packet type to the info column
Browse files Browse the repository at this point in the history
  • Loading branch information
daleglass committed Jul 18, 2024
1 parent c06a60e commit 56ab058
Show file tree
Hide file tree
Showing 2 changed files with 26 additions and 0 deletions.
3 changes: 3 additions & 0 deletions tools/dissectors/1-hfudt.lua
Original file line number Diff line number Diff line change
Expand Up @@ -259,6 +259,7 @@ function p_hfudt.dissector(buf, pinfo, tree)
type:append_text(" (".. control_types[shifted_type][1] .. ")")

subtree:add(f_control_type_text, control_types[shifted_type][1])
pinfo.cols.info:append(" [" .. control_types[shifted_type][1] .. "]")
end

if shifted_type == 0 then
Expand Down Expand Up @@ -337,10 +338,12 @@ function p_hfudt.dissector(buf, pinfo, tree)
local packet_type = buf(payload_offset, 1):le_uint()
local ptype = subtree:add_le(f_type, buf(payload_offset, 1))
local packet_type_text = packet_types[packet_type]

if packet_type_text ~= nil then
subtree:add(f_type_text, packet_type_text)
-- if we know this packet type then add the name
ptype:append_text(" (".. packet_type_text .. ")")
pinfo.cols.info:append(" [" .. packet_type_text .. "]")
end

-- read the version
Expand Down
23 changes: 23 additions & 0 deletions tools/dissectors/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -48,3 +48,26 @@ After a capture any detected Overte Packets should be easily identifiable by one
`[Expert Info (Error/Undecoded): Lua Error: /home/dale/.local/lib/wireshark/plugins/1-hfudt.lua:207: attempt to index global 'bit32' (a nil value)]`

See the installation requirements, you need to install the bit32 Lua module for the right Lua version.

## Development hints


* Symlink files from the development tree to `$HOME/.local/lib/wireshark/plugins`, to have Wireshark work on the latest dissector code.
* Capture packets for later analysis in a PCAPNG file.
* Only save needed packets in the dump

Decode on the commandline with:

tshark -r packets.pcapng.gz -V

Decode only the first packet:

tshark -r packets.pcapng.gz -V -c 1

### Useful tshark arguments

* `-x` hex dump
* `-c N` Only decode first N packets
* `-O hfudt,hf-domain,hf-entity,hf-avatar,hf-audio` Only dump Overte protocol data, skip dumping UDP/etc parts.
* `-V` decode protocols
*

0 comments on commit 56ab058

Please sign in to comment.