Which dissector table to be used for a zigbee cluster

I have specific data in the payload of a ZCL message, for which I want the (decoded) data to be shown in the packet detail pane. It seems that i need to get the right dissector table for zigbee. In a tutorial I found an example for tcp; local tcp_port = DissectorTable.get("tcp.port"). I tried to figure out which table to use, but could get it found. I tried "zbee.zcl" and "zbee_zcL. Also tried on level higher in zigbee, with "zbee.nwk" and "zbee.aps". Which is the right table to be used in the lua script.

You can find dissector tables using tshark, for example:

$ tshark -G dissector-tables | grep zcl
zbee.zcl.cluster        ZigBee ZCL Cluster ID   FT_UINT16       BASE_HEX       ZigBee ZCL       Decode As not supported

$ tshark -G heuristic-decodes | grep zcl
zbee_zcl_se.tun ip      T

You can also find dissector tables in Wireshark using: View -> Internals -> Dissector Tables. A search for zcl finds the same two as above, namely an integer table zbee.zcl.cluster, and also the heuristic table, zbee_zcl_se.tun.

And of course there's always the packet-zbee-zcl.c and packet-zbee-zcl-se.c source code itself.

11.1k

cmaynard

answered 2018-10-19 13:22:17 +0000

23.8k

grahamb

updated 2018-10-19 14:14:12 +0000

edit flag offensive 0 remove flag delete link

Comments

Thanks, got it working now. The "zbee.zcl.cluster" is the right one. Regards, Henk

Henk Stevens (2018-10-19 13:48:55 +0000) edit

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Which dissector table to be used for a zigbee cluster edit

Comments

1 Answer

Comments