Wireshark · Ethereal-users: Re: [Ethereal-users] Need to display color for "no standard" modbus function code

[Guy Harris <gharris@xxxxxxxxx>]

je 13 wrote:

> My question is :
> Is there a way to display into a modbus datagram specific color 
> depending (unknown) function code ? 

Yes, you could make the rows in the packet list that correspond to 
Modbus datagrams with unknown function codes be a particular color with 
a color filter.  Unfortunately, the filter expression would be a bit 
complicated, as the set of function codes known to the Modbus dissector 
is [1-24],40,[125-127], so you'd have to have an expression such as

	modbus_tcp.func_code == 0 || (modbus_tcp.func_code > 24 && 
modbus_tcp.func_code < 40) || (modbus_tcp.func_code > 40 && 
modbus_tcp.func_code < 125) || modbus_tcp.func_code > 127

> Is there a way to add specific function code into etheral in order to 
> increase modbus known request without going into source code ?

No.  You'd have to change the source code to

	1) change the "function_code_vals" tarble to list the new function codes

and possibly

	2) modify the switch statement in "dissect_mbtcp()" that switches on 
"mh.mdbs_hdr.function_code" to handle your new function codes.

> If there is no other way to go into the C where shall I find modbus 
> "description" in order to add my own request list

I assume by "description" you mean the source code to the Modbus/TCP 
dissector, rather than the Modbus spec.

If so, it's "epan/dissectors/packet-mbtcp.c", in the places indicated by 
my previous paragraph.