Wireshark · Wireshark-dev: Re: [Wireshark-dev] Lua post-dissector not getting field values

[Beth <beth.tridium@xxxxxxxxx>]

Interesting results!  If I edit cf_select_packet (in file.c) and add a call to tap_queue_init(cf->edt) just before the call to epan_dissect_run, it fixes my problem.  

tap_queue_init calls epan_dissect_prime_dfilter on each item in the tap_listener_queue, which sets the ref_count for those fields to DIRECT.  This means that calls to proto_item_add_<whatever> will also add the field to the interesting_hfids hash table, where they are later found by my Lua postdissector via Field__call.

What I don't know is whether this is actually a reasonable strategy for solving the original problem (described in subject of post).  After only three days of digging through the source code, I definitely do not qualify as a Wireshark expert, just a lucky beachcomber who happened to find two shells that seem to fit together.

Can anyone comment on this? 

Thanks,
b.