Wireshark · Wireshark-users: Re: [Wireshark-users] LUA set value for treeitem

["Pawlowsky, Marc" <mpawlowsky@xxxxxxxx>]

Setting the text changes the display but does not appear to allow for the item to be filtered on.

 

 

Date: Wed, 19 Sep 2018 18:05:28 +0000
From: "Maynard, Chris" <Christopher.Maynard@xxxxxxx>
To: Community support list for Wireshark
<wireshark-users@xxxxxxxxxxxxx>
Subject: Re: [Wireshark-users] LUA set value for treeitem
Message-ID:
<67a8dad7ac044e7989c93f106d68ee07@xxxxxxxxxxxxxxxxxxxxxxxxx>
Content-Type: text/plain; charset="utf-8"

Yes, you can set the value using myproperty_tree:set_text(somestring)

For example: myproperty_tree:set_text(string.format("myproperty: 0x%02X", someval))

See Section 11.7.1.4 of the Wireshark Developer's Guide[1].
- Chris
[1]: https://www.wireshark.org/docs/wsdg_html_chunked/lua_module_Tree.html#lua_class_TreeItem


From: Wireshark-users [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Pawlowsky, Marc
Sent: Wednesday, September 19, 2018 9:46 AM
To: wireshark-users@xxxxxxxxxxxxx<mailto:wireshark-users@xxxxxxxxxxxxx>
Subject: [Wireshark-users] LUA set value for treeitem

Is there a way to set the value for a treeitem after the tree item has been created?

The problem:

I am writing a X.409 based decoder (similar ASN.1).

I have a property stored as an integer to decode.
I come up with a tree like:

n Myproperty
o X.409 Integer
? Tag
? Length
? Value


The length of the value field is variable.

I have a protofield for all treeitems.
For my property I am currently using
pf_myproperty = ProtoField.uint8("myprop.myproperty ", "myproperty", base.HEX)

I create the myproperty treeitem first, then drill down and create the treeitems underneath it.
To prevent the protofield from decoding nonsense I am setting the value explicitly
local myproperty_tree = tree:add(pf_myproperty, buffer(offset), 0)

After all the tree items are created I can set the length using myproperty_tree::set_len(len)

Is there a way I can set the value after creation?

I want to be able to filter on myproperty.
Something like myprop.myproperty==0xFF

I cannot find anything in
https://www.wireshark.org/docs/wsdg_html_chunked/lua_module_Tree.html


Thanks
Marc