The classes and functions in this chapter allow Lua scripts to create new protocols for Wireshark. Proto protocol objects can have Pref preferences, ProtoField fields for filterable values that can be displayed in a details view tree, functions for dissecting the new protocol, and so on.
The dissection function can be hooked into existing protocol tables through DissectorTables so that the new protocol dissector function gets called by that protocol, and the new dissector can itself call on other, already existing protocol dissectors by retrieving and calling the Dissector object. A Proto dissector can also be used as a post-dissector, at the end of every frame's dissection, or as a heuristic dissector.
A refererence to a dissector, used to call a dissector against a packet or a part of it.
Obtains a dissector reference by name.
Gets a Lua array table of all registered Dissector names.
![]() | Note |
---|---|
this is an expensive operation, and should only be used for troubleshooting. |
Since: 1.11.3
Calls a dissector against a given packet (or part of it).
Calls a dissector against a given packet (or part of it).
A table of subdissectors of a particular protocol (e.g. TCP subdissectors like http, smtp, sip are added to table "tcp.port").
Useful to add more dissectors to a table so that they appear in the Decode As... dialog.
Creates a new DissectorTable for your dissector's use.
The short name of the table.
The name of the table in the User Interface (defaults to the name given).
Either ftypes.UINT8, ftypes.UINT16, ftypes.UINT24, ftypes.UINT32, or ftypes.STRING (defaults to ftypes.UINT32).
Either base.NONE, base.DEC, base.HEX, base.OCT, base.DEC_HEX or base.HEX_DEC (defaults to base.DEC).
Gets a Lua array table of all DissectorTable names - i.e., the string names you can use for the first argument to DissectorTable.get().
![]() | Note |
---|---|
this is an expensive operation, and should only be used for troubleshooting. |
Since: 1.11.3
Gets a Lua array table of all heuristic list names - i.e., the string names you can use for the first argument in Proto:register_heuristic().
![]() | Note |
---|---|
this is an expensive operation, and should only be used for troubleshooting. |
Since: 1.11.3
Obtain a reference to an existing dissector table.
Add a Proto with a dissector function, or a Dissector object, to the dissector table.
Remove existing dissectors from a table and add a new or a range of new dissectors.
Since: 1.11.3
Remove a dissector or a range of dissectors from a table
Remove all dissectors from a table.
Since: 1.11.3
Try to call a dissector from a table
Try to obtain a dissector from a table.
The pattern to be matched (either an integer or a string depending on the table's type).
A preference of a Protocol.
Creates a boolean preference to be added to a Proto.prefs Lua table.
Creates an (unsigned) integer preference to be added to a Proto.prefs Lua table.
Creates a string preference to be added to a Proto.prefs Lua table.
Creates an enum preference to be added to a Proto.prefs Lua table.
Creates a range preference to be added to a Proto.prefs Lua table.
The table of preferences of a protocol.
Creates a new preference.
The abbreviation of this preference.
A valid but still unassigned Pref object.
A new protocol in Wireshark. Protocols have more uses, the main one is to dissect a protocol. But they can also be just dummies used to register preferences for other purposes.
The name of the protocol.
A Long Text description of the protocol (usually lowercase).
Creates a Proto object.
The name of the protocol.
A Long Text description of the protocol (usually lowercase).
Registers a heuristic dissector function for this Proto protocol, for the given heuristic list name.
When later called, the passed-in function will be given:
A Tvb object
A Pinfo object
A TreeItem object
The function must return true if the payload is for it, else false.
The function should perform as much verification as possible to ensure the payload is for it, and dissect the packet (including setting TreeItem info and such) only if the payload is for it, before returning true or false.
Since: 1.11.3
Mode: Retrieve or assign.
The protocol's dissector, a function you define.
When later called, the function will be given:
A Tvb object
A Pinfo object
A TreeItem object
Mode: Assign only.
The preferences changed routine of this dissector, a Lua function you define.
Mode: Assign only.
The init routine of this dissector, a function you define.
The called init function is passed no arguments.
A Protocol expert info field, to be used when adding items to the dissection tree.
Since: 1.11.3
Creates a new ProtoExpert object to be used for a protocol's expert information notices.
Since: 1.11.3
Filter name of the expert info field (the string that is used in filters).
The default text of the expert field.
Expert group type: one of: expert.group.CHECKSUM, expert.group.SEQUENCE, expert.group.RESPONSE_CODE, expert.group.REQUEST_CODE, expert.group.UNDECODED, expert.group.REASSEMBLE, expert.group.MALFORMED, expert.group.DEBUG, expert.group.PROTOCOL, expert.group.SECURITY, or expert.group.COMMENTS_GROUP.
Expert severity type: one of: expert.severity.COMMENT, expert.severity.CHAT, expert.severity.NOTE, expert.severity.WARN, or expert.severity.ERROR.
A Protocol field (to be used when adding items to the dissection tree).
Creates a new ProtoField object to be used for a protocol field.
Actual name of the field (the string that appears in the tree).
Filter name of the field (the string that is used in filters).
Field Type: one of: ftypes.BOOLEAN, ftypes.UINT8, ftypes.UINT16, ftypes.UINT24, ftypes.UINT32, ftypes.UINT64, ftypes.INT8, ftypes.INT16, ftypes.INT24, ftypes.INT32, ftypes.INT64, ftypes.FLOAT, ftypes.DOUBLE , ftypes.ABSOLUTE_TIME, ftypes.RELATIVE_TIME, ftypes.STRING, ftypes.STRINGZ, ftypes.UINT_STRING, ftypes.ETHER, ftypes.BYTES, ftypes.UINT_BYTES, ftypes.IPv4, ftypes.IPv6, ftypes.IPXNET, ftypes.FRAMENUM, ftypes.PCRE, ftypes.GUID, ftypes.OID, or ftypes.EUI64.
A table containing the text that corresponds to the values.
The representation, one of: base.NONE, base.DEC, base.HEX, base.OCT, base.DEC_HEX, or base.HEX_DEC.
The bitmask to be used.
The description of the field.
Creates a ProtoField of an unsigned 8-bit integer (i.e., a byte).
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
One of base.DEC, base.HEX or base.OCT.
A table containing the text that corresponds to the values.
Integer mask of this field.
Description of the field.
Creates a ProtoField of an unsigned 16-bit integer.
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
One of base.DEC, base.HEX or base.OCT.
A table containing the text that corresponds to the values.
Integer mask of this field.
Description of the field.
Creates a ProtoField of an unsigned 24-bit integer.
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
One of base.DEC, base.HEX or base.OCT.
A table containing the text that corresponds to the values.
Integer mask of this field.
Description of the field.
Creates a ProtoField of an unsigned 32-bit integer.
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
One of base.DEC, base.HEX or base.OCT.
A table containing the text that corresponds to the values.
Integer mask of this field.
Description of the field.
Creates a ProtoField of an unsigned 64-bit integer.
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
One of base.DEC, base.HEX or base.OCT.
A table containing the text that corresponds to the values.
Integer mask of this field.
Description of the field.
Creates a ProtoField of a signed 8-bit integer (i.e., a byte).
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
One of base.DEC, base.HEX or base.OCT.
A table containing the text that corresponds to the values.
Integer mask of this field.
Description of the field.
Creates a ProtoField of a signed 16-bit integer.
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
One of base.DEC, base.HEX or base.OCT.
A table containing the text that corresponds to the values.
Integer mask of this field.
Description of the field.
Creates a ProtoField of a signed 24-bit integer.
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
One of base.DEC, base.HEX or base.OCT.
A table containing the text that corresponds to the values.
Integer mask of this field.
Description of the field.
Creates a ProtoField of a signed 32-bit integer.
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
One of base.DEC, base.HEX or base.OCT.
A table containing the text that corresponds to the values.
Integer mask of this field.
Description of the field.
Creates a ProtoField of a signed 64-bit integer.
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
One of base.DEC, base.HEX or base.OCT.
A table containing the text that corresponds to the values.
Integer mask of this field.
Description of the field.
Creates a ProtoField for a frame number (for hyperlinks between frames).
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
One of base.DEC, base.HEX or base.OCT.
A table containing the text that corresponds to the values.
Integer mask of this field.
Description of the field.
Creates a ProtoField for a boolean true/false value.
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
How wide the parent bitfield is (base.NONE is used for NULL-value).
A table containing the text that corresponds to the values.
Integer mask of this field.
Description of the field.
Creates a ProtoField of a time_t structure value.
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
One of base.LOCAL, base.UTC or base.DOY_UTC.
Description of the field.
Creates a ProtoField of a time_t structure value.
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
Description of the field.
Creates a ProtoField of an IPv4 address (4 bytes).
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
Description of the field.
Creates a ProtoField of an IPv6 address (16 bytes).
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
Description of the field.
Creates a ProtoField of an Ethernet address (6 bytes).
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
Description of the field.
Creates a ProtoField of a floating point number (4 bytes).
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
Description of the field.
Creates a ProtoField of a double-precision floating point (8 bytes).
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
Description of the field.
Creates a ProtoField of a string value.
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
Description of the field.
Creates a ProtoField of a zero-terminated string value.
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
Description of the field.
Creates a ProtoField for an arbitrary number of bytes.
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
Description of the field.
Creates a ProtoField for an arbitrary number of unsigned bytes.
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
Description of the field.
Creates a ProtoField for a Globally Unique IDentifier (GUID).
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
Description of the field.
Creates a ProtoField for an ASN.1 Organizational IDentified (OID).
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
Description of the field.
Creates a ProtoField for an ASN.1 Relative-OID.
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
Description of the field.
Creates a ProtoField for an OSI System ID.
Abbreviated name of the field (the string used in filters).
Actual name of the field (the string that appears in the tree).
Description of the field.
Make a Proto protocol (with a dissector function) a post-dissector. It will be called for every frame after dissection.