case sensitive

Jul 2, 2010 at 10:44 AM
Hi, I'm writing a parser for a protocol we use in our company. The messages are identified by "triggers". 'li' = login, 'lr' = login response. I want to translate the triggers to readable text. So I made a look up table. So far so good. The protocol uses case-sensitive triggers. There's also an 'Li' trigger. When using a switch I get an error. The switch/case command seems to be case-insensitive. Li and li are the same for the switch/case command. Is there a workaround for this problem? Thanks, Robin
Jul 2, 2010 at 11:51 AM
Edited Jul 5, 2010 at 3:50 AM

Hi Robin,

Thanks for using Netmon and your interest in creating custome parsers.

You can workaround the case sensitive issue by using ContainsBin plugin. You can find more details in the help file of Netmon. Here is a code snippet,

Table TTable(value)
{
    switch
    {
        case value == "test" && value[4] == 's': "test";
        case value == "test" && value[4] == 'S': "teSt";
    }
}

Protocol YourProtocol
{
    [Property.T = "teSt"]
    struct report1 = TTable(Property.T) {};

    switch
    {
        case Property.T == "test": struct report2 = "String compare is NOT case sensitive" {};
    }

    switch
    {
        case !Property.T.ContainsBin(ASCII, "test"): struct report3 = "ContainsBin is case sensitive" {};
    }
}

Please note,

1. ContainsBin works good in structs/properties, but will not work in tables

2. The in-memory representation (the property T) strings are encoded as UTF16 little-endian, so I have to use 4 (2*2) to locate 'S'.

Thanks,

Luther

Jul 2, 2010 at 1:11 PM
Thanks for the information, My problem is solved :) Robin