function ftfci_dissector(buffer, pinfo, tree, FTFCI_protocol, offset) -- Define ProtoFields for each of the fields in the structure -- Control Field 1 (1 byte) local f_session_id = ProtoField.uint8("FileTransfer.session_id", "File Transfer Session ID", base.DEC) local f_data_segment_exchange_info = ProtoField.string("FileTransfer.data_segment_exchange_info", "Data Segment Exchange Info") local f_data_segment_exchange_info1 = ProtoField.string("FileTransfer.data_segment_exchange_info", "Data Segment Exchange Info") local f_reserved_byte = ProtoField.uint8("FileTransfer.reserved_byte", "Reserved Byte", base.HEX) -- Reserved (3 bytes) local f_reserved_3bytes = ProtoField.bytes("FileTransfer.reserved_3bytes", "Reserved (3 bytes)") -- Suspend Waiting Time or SCT Database (4 bytes) local f_suspend_waiting_time = ProtoField.uint32("FileTransfer.suspend_waiting_time", "Suspend Waiting Time", base.DEC) -- Add fields to protocol FTFCI_protocol.fields = { f_session_id, f_data_segment_exchange_info, -- f_reserved_bit7, f_reserved_byte, f_reserved_3bytes, f_suspend_waiting_time } -- Add the new structure data as a subtree local subtree = tree:add(FTFCI_protocol, buffer(), "FTFCI") -- dissect CONTROL FIELD 1 (1 byte) local control_field1 = buffer(offset, 1):le_uint() local session_id = control_field1 & 0x07 -- Bits 0-2 local data_segment_exchange_info = (control_field1 >> 3) & 0x1F -- Bits 3-7 --logic if data_segment_exchange_info == 0 then f_data_segment_exchange_info1 ="ftfci_na" elseif data_segment_exchange_info == 1 then f_data_segment_exchange_info1 ="ftfci_cancelled_by_app" elseif data_segment_exchange_info == 2 then f_data_segment_exchange_info1 ="ftfci_cancelled_by_seqloss" elseif data_segment_exchange_info == 3 then f_data_segment_exchange_info1 ="ftfci_suspend" elseif data_segment_exchange_info == 4 then f_data_segment_exchange_info1 ="ftfci_resume" --elseif data_segment_exchange_info == 5 then --f_data_segment_exchange_info1 ="ftsr_stop_transfer" elseif data_segment_exchange_info == 6 then f_data_segment_exchange_info1 ="ftfci_suspend_savecontext" elseif data_segment_exchange_info == 7 then f_data_segment_exchange_info1 ="ftfci_resume_savecontext" elseif data_segment_exchange_info == 8 then f_data_segment_exchange_info1 ="ftfci_cancelled_by_susp_timeoout" elseif data_segment_exchange_info == 9 then f_data_segment_exchange_info1 ="ftfci_cancelled_by_txnode" elseif data_segment_exchange_info == 10 then f_data_segment_exchange_info1 ="ftfci_ack" elseif data_segment_exchange_info == 11 then f_data_segment_exchange_info1 ="ftfci_nak" elseif data_segment_exchange_info == 12 then f_data_segment_exchange_info1 ="ftfci_ping" end -- Add Control Field 1 data to subtree subtree:add(f_session_id, session_id) subtree:add(f_data_segment_exchange_info, f_data_segment_exchange_info1) offset = offset + 1 -- dissect Reserved Byte (1 byte) local reserved_byte = buffer(offset, 1):le_uint() subtree:add(f_reserved_byte, reserved_byte) offset = offset + 1 -- dissect Reserved 3 bytes (2 bytes) local reserved_3bytes = buffer(offset, 2) subtree:add(f_reserved_3bytes, reserved_3bytes) offset = offset + 2 -- dissect Suspend Waiting Time or SCT Database (4 bytes) local suspend_waiting_time = 0 -- If Data Segment Exchange Info is "Request FT Suspend" or "Suspend with savecontext" or "Resume with savecontext" -- if data_segment_exchange_info == 0x03 or data_segment_exchange_info == 0x05 or data_segment_exchange_info == 0x06 then suspend_waiting_time = buffer(offset, 4):le_uint() subtree:add(f_suspend_waiting_time, suspend_waiting_time) offset = offset + 4 --end end