Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 11413] RTP Lua reassemble does not work for more than two packages if offset i

[bugzilla-daemon@xxxxxxxxxxxxx]

Comment # 3 on bug 11413 from Hadriel Kaplan

(In reply to Jeff Morriss from comment #2)
> Question: there is a way to tell Wireshark that a particular field is "of
> interest" and thus must not be faked (proto_tree_prime_hfid()?).  If a
> script is using a field (as it clearly is here) should Lua be marking those
> fields as interesting (not to be faked)?

It does do that, but only if the tree is not NULL, which it will be during the
initial read of a file.

I didn't create that part of the Lua-API code, but the comments for it in
wslua_field.c say:

/* We use a fake dfilter for Lua field extractors, so that
 * epan_dissect_run() will populate the fields.  This won't happen
 * if the passed-in edt->tree is NULL, which it will be if the
 * proto_tree isn't created by epan_dissect_init().  But that's by
 * design - if shark doesn't pass in a proto_tree, it's probably for
 * a good reason and we shouldn't override that. (right?)
 */


I don't know if there's some down-side to changing that.(?)

---

      You are receiving this mail because:

• You are watching all bug changes.