First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
0

how to set 'destination' column to a string with lua plugin?

I want to set 'destination' column to a string. I tried following but it did not help.

pinfo.cols.dst = "Hello"

Can it be done?

It works for 'info' column as follows:

pinfo.cols.info = "Hello"
ranjeetsih's avatar
1
ranjeetsih
asked 2021-03-13 10:40:27 +0000, updated 2021-03-13 10:42:21 +0000
edit flag offensive 0 remove flag close merge delete

Comments

It should work -- I have a Lua plugin that does it successfully using exactly the code you posted.

Could you try to put together a smallest possible example of what doesn't work?

dd4235's avatar dd4235 (2021-04-02 16:09:42 +0000) edit
add a comment see more comments

1 Answer

0

I think this is a bug. You could open a Gitlab Issue asking that it be looked into. (please add a link back to this question if you do)

For testing, opening a non-IP file (small-system-misc-ping.etl (MS ETL) Various events, ping and browser packets.) from Wiki samples with etwdump allows the field to be set.

For an IP capture, disable the ethernet protocol and see Destination column updated by Lua.

Chuckc's avatar
3k
Chuckc
answered 2022-07-01 18:12:43 +0000
edit flag offensive 0 remove flag delete link

Comments

I think this is caused by epan_dissect_fill_in_columns() which calls col_fill_in().
The Destination column is populated with pinfo.dst which contains the value set by the last dissector to touch it. The column then shows the highest level "destination" address in the protocol stack.

You can test in the Lua script by printing pinfo.cols.dst after changing it:

        pinfo.cols.dst:append("Hello")
        print("dst2=","(",pinfo.cols.dst,")")

It then gets walloped later by epan_dissect_fill_in_columns().

pinfo.dst is an Address object in Lua and there isn't a way to clear it or set it to a string.

Chuckc's avatar Chuckc (2022-07-01 19:59:52 +0000) edit
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer