Lua wireshark dissector: comparing ethernet address

Question

I'm starting my first Lua dissector. Between two hard-coded ethernet addresses my payload protocol is running. How to do the correct comparison within the dissector?

Something like

if buf(0,6):ether() == ??? and buf(6,6):ether() == ??? then
...

thanks in advance Wolfgang R.

Answer 1

Calling ether() on a TvbRange (which is what you're doing) gives you back an Address object. Unfortunately Address objects aren't that useful by themselves - about the only thing you could do is to call tostring(addr) to get a string representation and then compare that to what you expect it to be. Like this:

if tostring(buf(0,6):ether()) == "00:12:34:56:78:9a" then
    -- do stuff
end

There is one thing to watch out for though: if your wireshark preference settings are set to enable name resolution, then the string you get back might have the OUI portion of the Ethernet MAC address replaced with the organization/company name it's assigned to. I.e., it might be something like "cisco:56:78:9a" or whatever.

In the latest (nightly) wireshark 1.11 builds, you can get the raw string of a buffer as a raw Lua string, and just compare that to your ethernet address (as a binary Lua string, not ASCII characters); and there're also functions to convert to/from hex so you can convert it to hex-ascii as well, etc.

Of course another thing you can do is get each byte or pair of bytes, like buf(0,2):uint() and buf(2,2):uint() and buf(4,2):uint() and just compare them as numbers.