Jan 13, 2011 at 4:40 AM
Edited Jan 14, 2011 at 11:29 AM
Thanks for using Netmon and the interest for creating parsers. Please find my answers to your questions below:
Unfortunately the hint that .Net 2.0 is needed is missing!
[Luther] As far as I know, Netmon is created with completely native code, so there should be no dependency to .NET.
I'm missing to just note down something, just like in C a variable 'int i = 5;' would be. But if I got it right, here this would read the next item from the protocol...?
[Luther] The members are automatically assigned values from the real capture data, so you cannot change the value. The global/conversation/frame 'property' (which is mentioned in your next question) should be the one you are looking for.
I haven't found an understandable explanation of 'Properties' or 'Properties.T'
[Luther] Property.T declares a variable T with its life cycle inside the same frame parsing.
What's the use of the square bracket?
[Luther]  is used to hold statements which do not consume data from the capture, including properties (variables) operations, plugins (built-in method invocation), and type casting (look-ahead).
UINT8 MyDummy; always generates output 'MyDummy: 0 (0x0)' Can I suppress it completely? (It might be an useless field containing dummy-data)
[Luther] Netmon will display every field it parsed. However, there is a workaround, using dynamicswitch. But this approach is not recommended, only use it if it's very important to you. You can find examples in xmlelement.npl. To consume and hide whitespaces,
while [ String(FrameData, FrameOffset, Property.XMLEncoding, 1) == Property.XMLSpace ]
DynamicSwitch String(Property.XMLEncoding, 1)
Any multi-dimensional arrays or tables? (The switch statement in a table could contain nested switch statements using a 2nd parameter ;-)
[Luther] Unfortunately there is no multi-demensional arrays in NPL. But you can still simulate by using nested structs, e.g.
My protocol contains a string containing a hexadecimal number, that I want to print out decimal?
[Luther] You can use StringToNumber plugin to convert the value to an integer, and then print it as you want. FormatString("%u", StringToNumber("0x" + this))