Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Repeating field value enhancement #1

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

kancowitz
Copy link

I've made an enhancement to sharktools so that repeating protocol
fields return to Python as a List. I store the values as GPtrArray
"tree_values", which replace the need for field_values_native and
field_values_native.

[
{ "frame.number": 1, "proto.field", "string"},
{ "frame.number": 2, "proto.field", ["string1","string2"]},
] //End List of Packets

I was also interested in returning summarized data from FT_NONE value
fields, so I included the fi->rep->representation when the value is
empty.

Finally, I fixed a few bugs in the "configure" script to make the
"enable-debug" option work.

Keith Ancowitz added 2 commits March 27, 2012 18:05
…eating field value from being overwritten while processing a packet.

2. Return a list of values to Python
3. When FT_NONE field value, return fi->rep->representation when its not empty
@armenb
Copy link
Owner

armenb commented Mar 4, 2013

Thanks Keith! I added these to the repo a long time ago, but finally pushed them to github, though not your exact commits. Let me know if you have any issues...

@mchccc
Copy link

mchccc commented May 21, 2013

Thanks for the great work!
Do you think it'd be possible to have a list of dictionaries (instead of lists within a dictionary) when multiple protocols are encountered inside a packet? For example, I'm looking at multiple SCTP/S1AP instances inside the same IP packet in Wireshark, but pyshark gives me back a single dictionary with multiple lists inside, each containing every value read in the same frame, but that might not be really useful as each instance may be carrying a different message and matching the values could get messy.
Please let me know if I can help or if you're willing to share some tips about how I might achieve this goal.
Thanks again.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants