CrabeDeFrance / rtshark

Rust interface to tshark application
Other
33 stars 10 forks source link

Feature Request: Parse fields with child data #12

Closed DennisNemec closed 1 year ago

DennisNemec commented 1 year ago

Hello there,

first of all thanks for this amazing crate which makes my life easier with parsing PCAPs! In the context of my Bachelor's Thesis I use this crate for analyzing Bluetooth LE data. I noticed that only "fields" are parsed that don't have any child data. In terms of XML it means that fields need to have following representation: <field ... />. In my case I could not get a specific field because it had some child data (<field ...>...</field>).

For example:


<field name="btcommon.eir_ad.entry.data" showname="Data: <data>" size="8" pos="39" show="<some data>" value="<some data>">
          <field name="_ws.expert" showname="Expert Info (Note/Undecoded): Undecoded" size="0" pos="39">
            <field name="btcommon.eir_ad.undecoded" showname="Undecoded" size="0" pos="0" show="" value=""/>
            <field name="_ws.expert.message" showname="Message: Undecoded" hide="yes" size="0" pos="0" show="Undecoded"/>
            <field name="_ws.expert.severity" showname="Severity level: Note" size="0" pos="0" show="4194304"/>
            <field name="_ws.expert.group" showname="Group: Undecoded" size="0" pos="0" show="83886080"/>
          </field>
  </field>

I was not able to retrieve the field with the name btcommon.eir_ad.entry.data.

I propose to add the functionality to parse fields that have child data.

Best regards, Dennis

CrabeDeFrance commented 1 year ago

Thanks for fixing this !