Specifier reference¶
Primitive Field Types¶
Type | Description |
---|---|
u8() |
Unsigned 8-bit integer. |
u16() |
Unsigned 16-bit integer. |
u24() |
Unsigned 24-bit integer. |
u32() |
Unsigned 32-bit integer. |
u64() |
Unsigned 64-bit integer. |
i8() |
Signed 8-bit integer. |
i16() |
Signed 16-bit integer. |
i24() |
Signed 24-bit integer. |
i32() |
Signed 32-bit integer. |
i64() |
Signed 64-bit integer. |
int(N) |
Unsigned N -bit integer. If N isn’t specified, the size of
the field becomes the remaining payload size.
N cannot be larger than 64-bits. |
uint(N) |
Unsigned N -bit integer. If N isn’t specified, the size of
the field becomes the remaining payload size.
N cannot be larger than 64-bits. |
f32() |
32-bit floating-point value. |
f64() |
64-bit floating-point value. |
utf8(N) |
UTF8-encoded string w/ a length of N code units. If N
isn’t specified, the size of the field becomes the remaining
payload size.
If used, the field must be aligned on an octet boundary. |
utf8z() |
Null-terminated UTF8-encoded string. If used, the field must be aligned on an octet boundary. |
utf16(N) |
UTF16-encoded string w/ a length of N code units. If N
isn’t specified, the size of the field becomes the remaining
payload size.
If used, the field must be aligned on an octet boundary. |
utf16z() |
Null-terminated UTF16-encoded string. If used, the field must be aligned on an octet boundary. |
bytes(N) |
Byte buffer with a size of N octets. If N isn’t specified,
the size of the field becomes the remaining payload size.
If used, the field must be aligned on an octet boundary. |
bits(N) |
Bits buffer with a size of N bits.
N cannot be larger than 64-bits. |
bool(N) |
Boolean value with a size of N bits. If N isn’t specified
the size of this field is 1 bit.
A field value of zero means False, while non-zero means True. |
bit() |
A single bit. |
ipv4() |
IPv4 address. If used, the field must be aligned on an octet boundary. |
ipv6() |
IPv6 address. If used, the field must be aligned on an octet boundary. |
ether() |
Ethernet address. If used, the field must be aligned on an octet boundary. |
Special Field Types¶
User Types¶
Any variable declared with wssdl.packet
can be used as a field type.
Payload Type¶
payload(<criterion>, [size])
The special payload type is used for packets that contains data that needs to be subdissected by another registered dissector.
The <criterion>
parameter is either a field, or a 2-element table containing
a field and a key:
payload(<field>, [size])
payload({ <field>, <key> }, [size])
<field>
is the field that should be used as the value to lookup the
dissector table entry, <key>
is the dissector table identifier.
If <key>
is nil or unspecified, then the dissector table identifier becomes
<prototype name>.<field>
.
<size>
is an optional parameter representing the size of the field in octets.
If <size>
is nil or unspecified, then the size of the field becomes the
remaining packet size.
Other specifiers¶
Type | Description |
---|---|
le() |
Parse the field as little-endian. The following types support little-endian: u8, u16, u24, u32, u64, i8, i16, i24, i32, i64, int, uint, f32, f64, utf16, utf16z, ipv4. |
dec() |
Use a decimal format for the integer field (default) |
hex() |
Use a hexadecimal format for the integer field |
oct() |
Use an octal format for the integer field |
name(str) |
Set the display name of the field to str . |
description(str) |
Set the description of the field to str . |