-- declare some Fields to be read usb_hl_f = Field.new("usb.usbpcap_header_len") usb_tt_f = Field.new("usb.transfer_type") usb_dl_f = Field.new("usb.data_len") -- declare our (pseudo) protocol dispenser_proto = Proto("dispenser","NCR S1 Dispenser") u1_vals = { [ 1 ] = "Command (?)", [ 2 ] = "Upload (?)", } -- create the fields for our "protocol" u00_00_F = ProtoField.uint8("dispenser.u01", "Unknown 00", base.HEX, u1_vals) u01_07_F = ProtoField.bytes("dispenser.u02", "Unknown 01-07") magic_F = ProtoField.uint16("dispenser.magic", "Magic Cookie", base.HEX) u0a_0f_F = ProtoField.bytes("dispenser.u0a", "Unknown 0a-0f", base.HEX) u10_17_F = ProtoField.bytes("dispenser.u10", "Unknown 10-17", base.HEX) u18_1f_F = ProtoField.bytes("dispenser.u18", "Unknown 18-1f", base.HEX) -- add the field to the protocol dispenser_proto.fields = { u00_00_F, u01_07_F, magic_F, u0a_0f_F, u10_17_F, u18_1f_F, } -- create a function to "postdissect" each frame function dispenser_proto.dissector(buffer,pinfo,tree) -- obtain the current values the protocol fields local usb_hl = usb_hl_f() local usb_tt = usb_tt_f() local usb_dl = usb_dl_f() if usb_tt.value == 0x01 and usb_dl.value >= 63 then local off = 64 if usb_hl then off = usb_hl.value end local magic = buffer(off + 8,2) if magic:le_uint() == 0xbeef then local subtree = tree:add(dispenser_proto, "NCR S1 Dispenser") subtree:add(u00_00_F, buffer(off + 0x00,1)) subtree:add(u01_07_F, buffer(off + 0x01,7)) subtree:add_le(magic_F, magic) subtree:add(u0a_0f_F, buffer(off + 0x0a,6)) subtree:add(u10_17_F, buffer(off + 0x10,8)) subtree:add(u18_1f_F, buffer(off + 0x18,8)) end end end -- register our protocol as a postdissector register_postdissector(dispenser_proto)