View difference between Paste ID: Ladd847i and ZjTDB2XY

 -- ###########################################################################
 -- # proto_foo.lua
 --
 -- Consider the Foo Protocol, which consists of only the Foo Packet defined as:
 --
 --  Byte Offset		Len	Desc
 --  0			4	32-bit unsigned integer
 --  4			8	ASCII string (zero-padded)
 --  12			5	byte array
 --  17			4	IPv4 address
 --
 -- Foo operates on UDP port 3456, but this port is configurable from Foo's preferences.
 -- This Wireshark Lua script implements this example protocol.
 -- ###########################################################################
 local _curport = nil		-- current port under which this protocol is registered
 local MIN_LEN = 21		-- min buffer length (21 = 4+8+5+4)
 local DEFAULT_PORT = 3456
 
 -- 1. Declare the protocol with the Proto() function.
 local proto_foo = Proto("foo", "Foo Protocol")
 
 -- 2. Declare the protocol's fields with the ProtoField.XXX() functions.
 proto_foo.fields.num 	= ProtoField.uint32("foo.num", "Unsigned integer (32-bit)")
 proto_foo.fields.str 	= ProtoField.stringz("foo.str", "Null-terminated string")
 proto_foo.fields.bytes 	= ProtoField.bytes("foo.bytes", "Byte array")
 proto_foo.fields.ip 	= ProtoField.ipv4("foo.ip", "IPv4 address")
 
 -- 3. (OPTIONAL) Declare the protocol's preferences with the Pref.XXX() functions.
 proto_foo.prefs.port = Pref.uint("Port", DEFAULT_PORT, "UDP port number")
 
 -- 4. Declare the protocol's dissector function
 function proto_foo.dissector(buf, pinfo, tree)
 
 	if buf:len() >= MIN_LEN then
 		pinfo.cols.protocol = "FOO"
 		local offset = 0
 		local f = proto_foo.fields
 		local subtree = tree:add(proto_foo, buf())
 		subtree:add(f.num	, buf(offset, 4)); offset = offset + 4
 		subtree:add(f.str	, buf(offset, 8)); offset = offset + 8
 		subtree:add(f.bytes	, buf(offset, 5)); offset = offset + 5
 		subtree:add(f.ip	, buf(offset, 4)); offset = offset + 4
 	end
 end
 
 -- 5. (OPTIONAL) Declare the protocol's init function. If this function is omitted,
 -- perform the protocol registration outside of it.
 function proto_foo.init()
 
 	-- 6. Register the protocol with a DissectorTable (TCP port in this case)
 	local dt = DissectorTable.get("tcp.port")
 	if _curport then dt:remove(_curport, proto_foo) end
 	dt:add(proto_foo.prefs.port, proto_foo)
 	_curport = proto_foo.prefs.port
 end
 
 -- XXX: do init here if proto_foo.init() does not exist. This file can
 -- only ever be loaded once (no way to undeclare a Proto), so no need
 -- to remove this dissector from a previously registered dissector table.
 --DissectorTable.get("udp.port"):add(proto_foo.prefs.port, proto_foo)