11.10.  Functions for writing dissectors

11.10.1. Dissector

A refererence to a dissector, used to call a dissector against a packet or a part of it.

11.10.1.1. Dissector.get(name)

Obtains a dissector reference by name

11.10.1.1.1. Arguments
name

The name of the dissector

11.10.1.1.2. Returns

The Dissector reference

11.10.1.2. dissector:call(tvb, pinfo, tree)

Calls a dissector against a given packet (or part of it)

11.10.1.2.1. Arguments
tvb

The buffer to dissect

pinfo

The packet info

tree

The tree on which to add the protocol items

11.10.2. DissectorTable

A table of subdissectors of a particular protocol (e.g. TCP subdissectors like http, smtp, sip are added to table "tcp.port"). Useful to add more dissectors to a table so that they appear in the Decode As... dialog.

11.10.2.1. DissectorTable.new(tablename, [uiname], [type], [base])

Creates a new DissectorTable for your dissector's use.

11.10.2.1.1. Arguments
tablename

The short name of the table.

uiname (optional)

The name of the table in the User Interface (defaults to the name given).

type (optional)

Either FT_UINT* or FT_STRING (defaults to FT_UINT32)

base (optional)

Either BASE_NONE, BASE_DEC, BASE_HEX, BASE_OCT, BASE_DEC_HEX or BASE_HEX_DEC (defaults to BASE_DEC)

11.10.2.1.2. Returns

The newly created DissectorTable

11.10.2.2. DissectorTable.get(tablename)

Obtain a reference to an existing dissector table.

11.10.2.2.1. Arguments
tablename

The short name of the table.

11.10.2.2.2. Returns

The DissectorTable

11.10.2.3. dissectortable:add(pattern, dissector)

Add a dissector to a table.

11.10.2.3.1. Arguments
pattern

The pattern to match (either an integer or a string depending on the table's type).

dissector

The dissector to add (either an Proto or a Dissector).

11.10.2.4. dissectortable:remove(pattern, dissector)

Remove a dissector from a table

11.10.2.4.1. Arguments
pattern

The pattern to match (either an integer or a string depending on the table's type).

dissector

The dissector to add (either an Proto or a Dissector).

11.10.2.5. dissectortable:try(pattern, tvb, pinfo, tree)

Try to call a dissector from a table

11.10.2.5.1. Arguments
pattern

The pattern to be matched (either an integer or a string depending on the table's type).

tvb

The buffer to dissect

pinfo

The packet info

tree

The tree on which to add the protocol items

11.10.2.6. dissectortable:get_dissector(pattern)

Try to obtain a dissector from a table.

11.10.2.6.1. Arguments
pattern

The pattern to be matched (either an integer or a string depending on the table's type).

11.10.2.6.2. Returns

The dissector handle if found

nil if not found

11.10.3. Pref

A preference of a Protocol.

11.10.3.1. Pref.bool(label, default, descr)

Creates a boolean preference to be added to a Protocol's prefs table.

11.10.3.1.1. Arguments
label

The Label (text in the right side of the preference input) for this preference

default

The default value for this preference

descr

A description of what this preference is

11.10.3.2. Pref.uint(label, default, descr)

Creates an (unsigned) integer preference to be added to a Protocol's prefs table.

11.10.3.2.1. Arguments
label

The Label (text in the right side of the preference input) for this preference

default

The default value for this preference

descr

A description of what this preference is

11.10.3.3. Pref.string(label, default, descr)

Creates a string preference to be added to a Protocol's prefs table.

11.10.3.3.1. Arguments
label

The Label (text in the right side of the preference input) for this preference

default

The default value for this preference

descr

A description of what this preference is

11.10.3.4. Pref.enum(label, default, descr, enum, radio)

Creates an enum preference to be added to a Protocol's prefs table.

11.10.3.4.1. Arguments
label

The Label (text in the right side of the preference input) for this preference

default

The default value for this preference

descr

A description of what this preference is

enum

A enum table

radio

Radio button (true) or Combobox (false)

11.10.3.5. Pref.range(label, default, descr, max)

Creates a range preference to be added to a Protocol's prefs table.

11.10.3.5.1. Arguments
label

The Label (text in the right side of the preference input) for this preference

default

The default value for this preference

descr

A description of what this preference is

max

The maximum value

11.10.3.6. Pref.statictext(label, descr)

Creates a static text preference to be added to a Protocol's prefs table.

11.10.3.6.1. Arguments
label

The static text

descr

The static text description

11.10.4. Prefs

The table of preferences of a protocol

11.10.4.1. prefs:__newindex(name, pref)

Creates a new preference

11.10.4.1.1. Arguments
name

The abbreviation of this preference

pref

A valid but still unassigned Pref object

11.10.4.1.2. Errors
  • Unknow Pref type

11.10.4.2. prefs:__index(name)

Get the value of a preference setting

11.10.4.2.1. Arguments
name

The abbreviation of this preference

11.10.4.2.2. Returns

The current value of the preference

11.10.4.2.3. Errors
  • Unknow Pref type

11.10.5. Proto

A new protocol in wireshark. Protocols have more uses, the main one is to dissect a protocol. But they can be just dummies used to register preferences for other purposes.

11.10.5.1. Proto.new(name, desc)

11.10.5.1.1. Arguments
name

The name of the protocol

desc

A Long Text description of the protocol (usually lowercase)

11.10.5.1.2. Returns

The newly created protocol

11.10.5.2. proto.dissector

The protocol's dissector, a function you define

11.10.5.3. proto.fields

The Fields Table of this dissector

11.10.5.4. proto.prefs

The preferences of this dissector

11.10.5.5. proto.init

The init routine of this dissector, a function you define

11.10.5.6. proto.name

The name given to this dissector

11.10.6. ProtoField

A Protocol field (to be used when adding items to the dissection tree)

11.10.6.1. ProtoField.new(name, abbr, type, [voidstring], [base], [mask], [descr])

Creates a new field to be used in a protocol.

11.10.6.1.1. Arguments
name

Actual name of the field (the string that appears in the tree).

abbr

Filter name of the field (the string that is used in filters).

type

Field Type (FT_*).

voidstring (optional)

A VoidString object.

base (optional)

The representation BASE_*.

mask (optional)

The bitmask to be used.

descr (optional)

The description of the field.

11.10.6.1.2. Returns

The newly created ProtoField object

11.10.6.2. ProtoField.uint8(abbr, [name], [base], [valuestring], [mask], [desc])

11.10.6.2.1. Arguments
abbr

Abbreviated name of the field (the string used in filters)

name (optional)

Actual name of the field (the string that appears in the tree)

base (optional)

One of base.DEC, base.HEX or base.OCT

valuestring (optional)

A table containing the text that corresponds to the values

mask (optional)

Integer mask of this field

desc (optional)

Description of the field

11.10.6.2.2. Returns

A protofield item to be added to a ProtoFieldArray

11.10.6.3. ProtoField.uint16(abbr, [name], [base], [valuestring], [mask], [desc])

11.10.6.3.1. Arguments
abbr

Abbreviated name of the field (the string used in filters)

name (optional)

Actual name of the field (the string that appears in the tree)

base (optional)

One of base.DEC, base.HEX or base.OCT

valuestring (optional)

A table containing the text that corresponds to the values

mask (optional)

Integer mask of this field

desc (optional)

Description of the field

11.10.6.3.2. Returns

A protofield item to be added to a ProtoFieldArray

11.10.6.4. ProtoField.uint24(abbr, [name], [base], [valuestring], [mask], [desc])

11.10.6.4.1. Arguments
abbr

Abbreviated name of the field (the string used in filters)

name (optional)

Actual name of the field (the string that appears in the tree)

base (optional)

One of base.DEC, base.HEX or base.OCT

valuestring (optional)

A table containing the text that corresponds to the values

mask (optional)

Integer mask of this field

desc (optional)

Description of the field

11.10.6.4.2. Returns

A protofield item to be added to a ProtoFieldArray

11.10.6.5. ProtoField.uint32(abbr, [name], [base], [valuestring], [mask], [desc])

11.10.6.5.1. Arguments
abbr

Abbreviated name of the field (the string used in filters)

name (optional)

Actual name of the field (the string that appears in the tree)

base (optional)

One of base.DEC, base.HEX or base.OCT

valuestring (optional)

A table containing the text that corresponds to the values

mask (optional)

Integer mask of this field

desc (optional)

Description of the field

11.10.6.5.2. Returns

A protofield item to be added to a ProtoFieldArray

11.10.6.6. ProtoField.uint64(abbr, [name], [base], [valuestring], [mask], [desc])

11.10.6.6.1. Arguments
abbr

Abbreviated name of the field (the string used in filters)

name (optional)

Actual name of the field (the string that appears in the tree)

base (optional)

One of base.DEC, base.HEX or base.OCT

valuestring (optional)

A table containing the text that corresponds to the values

mask (optional)

Integer mask of this field

desc (optional)

Description of the field

11.10.6.6.2. Returns

A protofield item to be added to a ProtoFieldArray

11.10.6.7. ProtoField.int8(abbr, [name], [base], [valuestring], [mask], [desc])

11.10.6.7.1. Arguments
abbr

Abbreviated name of the field (the string used in filters)

name (optional)

Actual name of the field (the string that appears in the tree)

base (optional)

One of base.DEC, base.HEX or base.OCT

valuestring (optional)

A table containing the text that corresponds to the values

mask (optional)

Integer mask of this field

desc (optional)

Description of the field

11.10.6.7.2. Returns

A protofield item to be added to a ProtoFieldArray

11.10.6.8. ProtoField.int16(abbr, [name], [base], [valuestring], [mask], [desc])

11.10.6.8.1. Arguments
abbr

Abbreviated name of the field (the string used in filters)

name (optional)

Actual name of the field (the string that appears in the tree)

base (optional)

One of base.DEC, base.HEX or base.OCT

valuestring (optional)

A table containing the text that corresponds to the values

mask (optional)

Integer mask of this field

desc (optional)

Description of the field

11.10.6.8.2. Returns

A protofield item to be added to a ProtoFieldArray

11.10.6.9. ProtoField.int24(abbr, [name], [base], [valuestring], [mask], [desc])

11.10.6.9.1. Arguments
abbr

Abbreviated name of the field (the string used in filters)

name (optional)

Actual name of the field (the string that appears in the tree)

base (optional)

One of base.DEC, base.HEX or base.OCT

valuestring (optional)

A table containing the text that corresponds to the values

mask (optional)

Integer mask of this field

desc (optional)

Description of the field

11.10.6.9.2. Returns

A protofield item to be added to a ProtoFieldArray

11.10.6.10. ProtoField.int32(abbr, [name], [base], [valuestring], [mask], [desc])

11.10.6.10.1. Arguments
abbr

Abbreviated name of the field (the string used in filters)

name (optional)

Actual name of the field (the string that appears in the tree)

base (optional)

One of base.DEC, base.HEX or base.OCT

valuestring (optional)

A table containing the text that corresponds to the values

mask (optional)

Integer mask of this field

desc (optional)

Description of the field

11.10.6.10.2. Returns

A protofield item to be added to a ProtoFieldArray

11.10.6.11. ProtoField.int64(abbr, [name], [base], [valuestring], [mask], [desc])

11.10.6.11.1. Arguments
abbr

Abbreviated name of the field (the string used in filters)

name (optional)

Actual name of the field (the string that appears in the tree)

base (optional)

One of base.DEC, base.HEX or base.OCT

valuestring (optional)

A table containing the text that corresponds to the values

mask (optional)

Integer mask of this field

desc (optional)

Description of the field

11.10.6.11.2. Returns

A protofield item to be added to a ProtoFieldArray

11.10.6.12. ProtoField.framenum(abbr, [name], [base], [valuestring], [mask], [desc])

A frame number (for hyperlinks between frames)

11.10.6.12.1. Arguments
abbr

Abbreviated name of the field (the string used in filters)

name (optional)

Actual name of the field (the string that appears in the tree)

base (optional)

One of base.DEC, base.HEX or base.OCT

valuestring (optional)

A table containing the text that corresponds to the values

mask (optional)

Integer mask of this field

desc (optional)

Description of the field

11.10.6.12.2. Returns

A protofield item to be added to a ProtoFieldArray

11.10.6.13. ProtoField.bool(abbr, [name], [display], [string], [mask], [desc])

11.10.6.13.1. Arguments
abbr

Abbreviated name of the field (the string used in filters)

name (optional)

Actual name of the field (the string that appears in the tree)

display (optional)

how wide the parent bitfield is (BASE_NONE is used for NULL-value)

string (optional)

A table containing the text that corresponds to the values

mask (optional)

Integer mask of this field

desc (optional)

Description of the field

11.10.6.13.2. Returns

A protofield item to be added to a ProtoFieldArray

11.10.6.14. ProtoField.ipv4(abbr, [name], [desc])

11.10.6.14.1. Arguments
abbr

Abbreviated name of the field (the string used in filters)

name (optional)

Actual name of the field (the string that appears in the tree)

desc (optional)

Description of the field

11.10.6.14.2. Returns

A protofield item to be added to a ProtoFieldArray

11.10.6.15. ProtoField.ipv6(abbr, [name], [desc])

11.10.6.15.1. Arguments
abbr

Abbreviated name of the field (the string used in filters)

name (optional)

Actual name of the field (the string that appears in the tree)

desc (optional)

Description of the field

11.10.6.15.2. Returns

A protofield item to be added to a ProtoFieldArray

11.10.6.16. ProtoField.ether(abbr, [name], [desc])

11.10.6.16.1. Arguments
abbr

Abbreviated name of the field (the string used in filters)

name (optional)

Actual name of the field (the string that appears in the tree)

desc (optional)

Description of the field

11.10.6.16.2. Returns

A protofield item to be added to a ProtoFieldArray

11.10.6.17. ProtoField.float(abbr, [name], [desc])

11.10.6.17.1. Arguments
abbr

Abbreviated name of the field (the string used in filters)

name (optional)

Actual name of the field (the string that appears in the tree)

desc (optional)

Description of the field

11.10.6.17.2. Returns

A protofield item to be added to a ProtoFieldArray

11.10.6.18. ProtoField.double(abbr, [name], [desc])

11.10.6.18.1. Arguments
abbr

Abbreviated name of the field (the string used in filters)

name (optional)

Actual name of the field (the string that appears in the tree)

desc (optional)

Description of the field

11.10.6.18.2. Returns

A protofield item to be added to a ProtoFieldArray

11.10.6.19. ProtoField.string(abbr, [name], [desc])

11.10.6.19.1. Arguments
abbr

Abbreviated name of the field (the string used in filters)

name (optional)

Actual name of the field (the string that appears in the tree)

desc (optional)

Description of the field

11.10.6.19.2. Returns

A protofield item to be added to a ProtoFieldArray

11.10.6.20. ProtoField.stringz(abbr, [name], [desc])

11.10.6.20.1. Arguments
abbr

Abbreviated name of the field (the string used in filters)

name (optional)

Actual name of the field (the string that appears in the tree)

desc (optional)

Description of the field

11.10.6.20.2. Returns

A protofield item to be added to a ProtoFieldArray

11.10.6.21. ProtoField.bytes(abbr, [name], [desc])

11.10.6.21.1. Arguments
abbr

Abbreviated name of the field (the string used in filters)

name (optional)

Actual name of the field (the string that appears in the tree)

desc (optional)

Description of the field

11.10.6.21.2. Returns

A protofield item to be added to a ProtoFieldArray

11.10.6.22. ProtoField.ubytes(abbr, [name], [desc])

11.10.6.22.1. Arguments
abbr

Abbreviated name of the field (the string used in filters)

name (optional)

Actual name of the field (the string that appears in the tree)

desc (optional)

Description of the field

11.10.6.22.2. Returns

A protofield item to be added to a ProtoFieldArray

11.10.6.23. ProtoField.guid(abbr, [name], [desc])

11.10.6.23.1. Arguments
abbr

Abbreviated name of the field (the string used in filters)

name (optional)

Actual name of the field (the string that appears in the tree)

desc (optional)

Description of the field

11.10.6.23.2. Returns

A protofield item to be added to a ProtoFieldArray

11.10.6.24. ProtoField.oid(abbr, [name], [desc])

11.10.6.24.1. Arguments
abbr

Abbreviated name of the field (the string used in filters)

name (optional)

Actual name of the field (the string that appears in the tree)

desc (optional)

Description of the field

11.10.6.24.2. Returns

A protofield item to be added to a ProtoFieldArray

11.10.6.25. ProtoField.bool(abbr, [name], [desc])

11.10.6.25.1. Arguments
abbr

Abbreviated name of the field (the string used in filters)

name (optional)

Actual name of the field (the string that appears in the tree)

desc (optional)

Description of the field

11.10.6.25.2. Returns

A protofield item to be added to a ProtoFieldArray

11.10.6.26. protofield:__tostring()

Returns a string with info about a protofield (for debugging purposes)

11.10.7. Non Method Functions

11.10.7.1. register_postdissector(proto)

Make a protocol (with a dissector) a postdissector. It will be called for every frame after dissection

11.10.7.1.1. Arguments
proto

the protocol to be used as postdissector