A refererence to a dissector, used to call a dissector against a packet or a part of it.
11.10.1.1. Dissector.get(name)
Obtains a dissector reference by name
- name
The name of the dissector
11.10.1.2. dissector:call(tvb, pinfo, tree)
Calls a dissector against a given packet (or part of it)
- tvb
The buffer to dissect
- pinfo
The packet info
- tree
The tree on which to add the protocol items
A table of subdissectors of a particular protocol (e.g. TCP subdissectors like http, smtp, sip are added to table "tcp.port").
Useful to add more dissectors to a table so that they appear in the Decode As... dialog.
11.10.2.1. DissectorTable.new(tablename, [uiname], [type], [base])
Creates a new DissectorTable for your dissector's use.
- tablename
The short name of the table.
- uiname (optional)
The name of the table in the User Interface (defaults to the name given).
- type (optional)
Either FT_UINT* or FT_STRING (defaults to FT_UINT32)
- base (optional)
Either BASE_NONE, BASE_DEC, BASE_HEX, BASE_OCT, BASE_DEC_HEX or BASE_HEX_DEC (defaults to BASE_DEC)
The newly created DissectorTable
11.10.2.2. DissectorTable.get(tablename)
Obtain a reference to an existing dissector table.
- tablename
The short name of the table.
11.10.2.3. dissectortable:add(pattern, dissector)
Add a dissector to a table.
- pattern
The pattern to match (either an integer or a string depending on the table's type).
- dissector
The dissector to add (either an Proto or a Dissector).
11.10.2.4. dissectortable:remove(pattern, dissector)
Remove a dissector from a table
- pattern
The pattern to match (either an integer or a string depending on the table's type).
- dissector
The dissector to add (either an Proto or a Dissector).
11.10.2.5. dissectortable:try(pattern, tvb, pinfo, tree)
Try to call a dissector from a table
- pattern
The pattern to be matched (either an integer or a string depending on the table's type).
- tvb
The buffer to dissect
- pinfo
The packet info
- tree
The tree on which to add the protocol items
11.10.2.6. dissectortable:get_dissector(pattern)
Try to obtain a dissector from a table.
- pattern
The pattern to be matched (either an integer or a string depending on the table's type).
The dissector handle if found
nil if not found
A preference of a Protocol.
11.10.3.1. Pref.bool(label, default, descr)
Creates a boolean preference to be added to a Protocol's prefs table.
- label
The Label (text in the right side of the preference input) for this preference
- default
The default value for this preference
- descr
A description of what this preference is
11.10.3.2. Pref.uint(label, default, descr)
Creates an (unsigned) integer preference to be added to a Protocol's prefs table.
- label
The Label (text in the right side of the preference input) for this preference
- default
The default value for this preference
- descr
A description of what this preference is
11.10.3.3. Pref.string(label, default, descr)
Creates a string preference to be added to a Protocol's prefs table.
- label
The Label (text in the right side of the preference input) for this preference
- default
The default value for this preference
- descr
A description of what this preference is
11.10.3.4. Pref.enum(label, default, descr, enum, radio)
Creates an enum preference to be added to a Protocol's prefs table.
- label
The Label (text in the right side of the preference input) for this preference
- default
The default value for this preference
- descr
A description of what this preference is
- enum
A enum table
- radio
Radio button (true) or Combobox (false)
11.10.3.5. Pref.range(label, default, descr, max)
Creates a range preference to be added to a Protocol's prefs table.
- label
The Label (text in the right side of the preference input) for this preference
- default
The default value for this preference
- descr
A description of what this preference is
- max
The maximum value
11.10.3.6. Pref.statictext(label, descr)
Creates a static text preference to be added to a Protocol's prefs table.
- label
The static text
- descr
The static text description
A new protocol in wireshark. Protocols have more uses, the main one is to dissect
a protocol. But they can be just dummies used to register preferences for
other purposes.
11.10.5.1. Proto.new(name, desc)
- name
The name of the protocol
- desc
A Long Text description of the protocol (usually lowercase)
The newly created protocol
11.10.5.2. proto.dissector
The protocol's dissector, a function you define
The Fields Table of this dissector
The preferences of this dissector
The init routine of this dissector, a function you define
The name given to this dissector
A Protocol field (to be used when adding items to the dissection tree)
11.10.6.1. ProtoField.new(name, abbr, type, [voidstring], [base], [mask], [descr])
Creates a new field to be used in a protocol.
- name
Actual name of the field (the string that appears in the tree).
- abbr
Filter name of the field (the string that is used in filters).
- type
Field Type (FT_*).
- voidstring (optional)
A VoidString object.
- base (optional)
The representation BASE_*.
- mask (optional)
The bitmask to be used.
- descr (optional)
The description of the field.
The newly created ProtoField object
11.10.6.2. ProtoField.uint8(abbr, [name], [base], [valuestring], [mask], [desc])
- abbr
Abbreviated name of the field (the string used in filters)
- name (optional)
Actual name of the field (the string that appears in the tree)
- base (optional)
One of base.DEC, base.HEX or base.OCT
- valuestring (optional)
A table containing the text that corresponds to the values
- mask (optional)
Integer mask of this field
- desc (optional)
Description of the field
A protofield item to be added to a ProtoFieldArray
11.10.6.3. ProtoField.uint16(abbr, [name], [base], [valuestring], [mask], [desc])
- abbr
Abbreviated name of the field (the string used in filters)
- name (optional)
Actual name of the field (the string that appears in the tree)
- base (optional)
One of base.DEC, base.HEX or base.OCT
- valuestring (optional)
A table containing the text that corresponds to the values
- mask (optional)
Integer mask of this field
- desc (optional)
Description of the field
A protofield item to be added to a ProtoFieldArray
11.10.6.4. ProtoField.uint24(abbr, [name], [base], [valuestring], [mask], [desc])
- abbr
Abbreviated name of the field (the string used in filters)
- name (optional)
Actual name of the field (the string that appears in the tree)
- base (optional)
One of base.DEC, base.HEX or base.OCT
- valuestring (optional)
A table containing the text that corresponds to the values
- mask (optional)
Integer mask of this field
- desc (optional)
Description of the field
A protofield item to be added to a ProtoFieldArray
11.10.6.5. ProtoField.uint32(abbr, [name], [base], [valuestring], [mask], [desc])
- abbr
Abbreviated name of the field (the string used in filters)
- name (optional)
Actual name of the field (the string that appears in the tree)
- base (optional)
One of base.DEC, base.HEX or base.OCT
- valuestring (optional)
A table containing the text that corresponds to the values
- mask (optional)
Integer mask of this field
- desc (optional)
Description of the field
A protofield item to be added to a ProtoFieldArray
11.10.6.6. ProtoField.uint64(abbr, [name], [base], [valuestring], [mask], [desc])
- abbr
Abbreviated name of the field (the string used in filters)
- name (optional)
Actual name of the field (the string that appears in the tree)
- base (optional)
One of base.DEC, base.HEX or base.OCT
- valuestring (optional)
A table containing the text that corresponds to the values
- mask (optional)
Integer mask of this field
- desc (optional)
Description of the field
A protofield item to be added to a ProtoFieldArray
11.10.6.7. ProtoField.int8(abbr, [name], [base], [valuestring], [mask], [desc])
- abbr
Abbreviated name of the field (the string used in filters)
- name (optional)
Actual name of the field (the string that appears in the tree)
- base (optional)
One of base.DEC, base.HEX or base.OCT
- valuestring (optional)
A table containing the text that corresponds to the values
- mask (optional)
Integer mask of this field
- desc (optional)
Description of the field
A protofield item to be added to a ProtoFieldArray
11.10.6.8. ProtoField.int16(abbr, [name], [base], [valuestring], [mask], [desc])
- abbr
Abbreviated name of the field (the string used in filters)
- name (optional)
Actual name of the field (the string that appears in the tree)
- base (optional)
One of base.DEC, base.HEX or base.OCT
- valuestring (optional)
A table containing the text that corresponds to the values
- mask (optional)
Integer mask of this field
- desc (optional)
Description of the field
A protofield item to be added to a ProtoFieldArray
11.10.6.9. ProtoField.int24(abbr, [name], [base], [valuestring], [mask], [desc])
- abbr
Abbreviated name of the field (the string used in filters)
- name (optional)
Actual name of the field (the string that appears in the tree)
- base (optional)
One of base.DEC, base.HEX or base.OCT
- valuestring (optional)
A table containing the text that corresponds to the values
- mask (optional)
Integer mask of this field
- desc (optional)
Description of the field
A protofield item to be added to a ProtoFieldArray
11.10.6.10. ProtoField.int32(abbr, [name], [base], [valuestring], [mask], [desc])
- abbr
Abbreviated name of the field (the string used in filters)
- name (optional)
Actual name of the field (the string that appears in the tree)
- base (optional)
One of base.DEC, base.HEX or base.OCT
- valuestring (optional)
A table containing the text that corresponds to the values
- mask (optional)
Integer mask of this field
- desc (optional)
Description of the field
A protofield item to be added to a ProtoFieldArray
11.10.6.11. ProtoField.int64(abbr, [name], [base], [valuestring], [mask], [desc])
- abbr
Abbreviated name of the field (the string used in filters)
- name (optional)
Actual name of the field (the string that appears in the tree)
- base (optional)
One of base.DEC, base.HEX or base.OCT
- valuestring (optional)
A table containing the text that corresponds to the values
- mask (optional)
Integer mask of this field
- desc (optional)
Description of the field
A protofield item to be added to a ProtoFieldArray
11.10.6.12. ProtoField.framenum(abbr, [name], [base], [valuestring], [mask], [desc])
A frame number (for hyperlinks between frames)
- abbr
Abbreviated name of the field (the string used in filters)
- name (optional)
Actual name of the field (the string that appears in the tree)
- base (optional)
One of base.DEC, base.HEX or base.OCT
- valuestring (optional)
A table containing the text that corresponds to the values
- mask (optional)
Integer mask of this field
- desc (optional)
Description of the field
A protofield item to be added to a ProtoFieldArray
11.10.6.13. ProtoField.bool(abbr, [name], [display], [string], [mask], [desc])
- abbr
Abbreviated name of the field (the string used in filters)
- name (optional)
Actual name of the field (the string that appears in the tree)
- display (optional)
how wide the parent bitfield is (BASE_NONE is used for NULL-value)
- string (optional)
A table containing the text that corresponds to the values
- mask (optional)
Integer mask of this field
- desc (optional)
Description of the field
A protofield item to be added to a ProtoFieldArray
11.10.6.14. ProtoField.ipv4(abbr, [name], [desc])
- abbr
Abbreviated name of the field (the string used in filters)
- name (optional)
Actual name of the field (the string that appears in the tree)
- desc (optional)
Description of the field
A protofield item to be added to a ProtoFieldArray
11.10.6.15. ProtoField.ipv6(abbr, [name], [desc])
- abbr
Abbreviated name of the field (the string used in filters)
- name (optional)
Actual name of the field (the string that appears in the tree)
- desc (optional)
Description of the field
A protofield item to be added to a ProtoFieldArray
11.10.6.16. ProtoField.ether(abbr, [name], [desc])
- abbr
Abbreviated name of the field (the string used in filters)
- name (optional)
Actual name of the field (the string that appears in the tree)
- desc (optional)
Description of the field
A protofield item to be added to a ProtoFieldArray
11.10.6.17. ProtoField.float(abbr, [name], [desc])
- abbr
Abbreviated name of the field (the string used in filters)
- name (optional)
Actual name of the field (the string that appears in the tree)
- desc (optional)
Description of the field
A protofield item to be added to a ProtoFieldArray
11.10.6.18. ProtoField.double(abbr, [name], [desc])
- abbr
Abbreviated name of the field (the string used in filters)
- name (optional)
Actual name of the field (the string that appears in the tree)
- desc (optional)
Description of the field
A protofield item to be added to a ProtoFieldArray
11.10.6.19. ProtoField.string(abbr, [name], [desc])
- abbr
Abbreviated name of the field (the string used in filters)
- name (optional)
Actual name of the field (the string that appears in the tree)
- desc (optional)
Description of the field
A protofield item to be added to a ProtoFieldArray
11.10.6.20. ProtoField.stringz(abbr, [name], [desc])
- abbr
Abbreviated name of the field (the string used in filters)
- name (optional)
Actual name of the field (the string that appears in the tree)
- desc (optional)
Description of the field
A protofield item to be added to a ProtoFieldArray
11.10.6.21. ProtoField.bytes(abbr, [name], [desc])
- abbr
Abbreviated name of the field (the string used in filters)
- name (optional)
Actual name of the field (the string that appears in the tree)
- desc (optional)
Description of the field
A protofield item to be added to a ProtoFieldArray
11.10.6.22. ProtoField.ubytes(abbr, [name], [desc])
- abbr
Abbreviated name of the field (the string used in filters)
- name (optional)
Actual name of the field (the string that appears in the tree)
- desc (optional)
Description of the field
A protofield item to be added to a ProtoFieldArray
11.10.6.23. ProtoField.guid(abbr, [name], [desc])
- abbr
Abbreviated name of the field (the string used in filters)
- name (optional)
Actual name of the field (the string that appears in the tree)
- desc (optional)
Description of the field
A protofield item to be added to a ProtoFieldArray
11.10.6.24. ProtoField.oid(abbr, [name], [desc])
- abbr
Abbreviated name of the field (the string used in filters)
- name (optional)
Actual name of the field (the string that appears in the tree)
- desc (optional)
Description of the field
A protofield item to be added to a ProtoFieldArray
11.10.6.25. ProtoField.bool(abbr, [name], [desc])
- abbr
Abbreviated name of the field (the string used in filters)
- name (optional)
Actual name of the field (the string that appears in the tree)
- desc (optional)
Description of the field
A protofield item to be added to a ProtoFieldArray
11.10.6.26. protofield:__tostring()
Returns a string with info about a protofield (for debugging purposes)