11.10. Functions for writing dissectors
Prev | Chapter 11. Lua Support in Wireshark | Next

## 11.10. Functions for writing dissectors

### 11.10.1. Dissector

A refererence to a dissector, used to call a dissector against a packet or a part of it.

#### 11.10.1.1. Dissector.get(name)

Obtains a dissector reference by name

##### 11.10.1.1.1. Arguments

name

  The name of the dissector

##### 11.10.1.1.2. Returns

The Dissector reference

#### 11.10.1.2. dissector:call(tvb, pinfo, tree)

Calls a dissector against a given packet (or part of it)

##### 11.10.1.2.1. Arguments

tvb

  The buffer to dissect

pinfo

  The packet info

tree

  The tree on which to add the protocol items

### 11.10.2. DissectorTable

A table of subdissectors of a particular protocol (e.g. TCP subdissectors like http, smtp, sip are added to table "tcp.port"). Useful to add more dissectors to a table so that they appear in the Decode As... dialog.

#### 11.10.2.1. DissectorTable.new(tablename, [uiname], [type], [base])

Creates a new DissectorTable for your dissector's use.

##### 11.10.2.1.1. Arguments

tablename

  The short name of the table.

uiname (optional)

  The name of the table in the User Interface (defaults to the name given).

type (optional)

  Either ftypes.UINT{8,16,24,32} or ftypes.STRING (defaults to ftypes.UINT32)

base (optional)

  Either base.NONE, base.DEC, base.HEX, base.OCT, base.DEC_HEX or base.HEX_DEC (defaults to base.DEC)

##### 11.10.2.1.2. Returns

The newly created DissectorTable

#### 11.10.2.2. DissectorTable.get(tablename)

Obtain a reference to an existing dissector table.

##### 11.10.2.2.1. Arguments

tablename

  The short name of the table.

##### 11.10.2.2.2. Returns

The DissectorTable

#### 11.10.2.3. dissectortable:add(pattern, dissector)

Add a dissector to a table.

##### 11.10.2.3.1. Arguments

pattern

  The pattern to match (either an integer or a string depending on the table's type).

dissector

  The dissector to add (either an Proto or a Dissector).

#### 11.10.2.4. dissectortable:remove(pattern, dissector)

Remove a dissector from a table

##### 11.10.2.4.1. Arguments

pattern

  The pattern to match (either an integer or a string depending on the table's type).

dissector

  The dissector to add (either an Proto or a Dissector).

#### 11.10.2.5. dissectortable:try(pattern, tvb, pinfo, tree)

Try to call a dissector from a table

##### 11.10.2.5.1. Arguments

pattern

  The pattern to be matched (either an integer or a string depending on the table's type).

tvb

  The buffer to dissect

pinfo

  The packet info

tree

  The tree on which to add the protocol items

#### 11.10.2.6. dissectortable:get_dissector(pattern)

Try to obtain a dissector from a table.

##### 11.10.2.6.1. Arguments

pattern

  The pattern to be matched (either an integer or a string depending on the table's type).

##### 11.10.2.6.2. Returns

The dissector handle if found

nil if not found

### 11.10.3. Pref

A preference of a Protocol.

#### 11.10.3.1. Pref.bool(label, default, descr)

Creates a boolean preference to be added to a Protocol's prefs table.

##### 11.10.3.1.1. Arguments

label

  The Label (text in the right side of the preference input) for this preference

default

  The default value for this preference

descr

  A description of what this preference is

#### 11.10.3.2. Pref.uint(label, default, descr)

Creates an (unsigned) integer preference to be added to a Protocol's prefs table.

##### 11.10.3.2.1. Arguments

label

  The Label (text in the right side of the preference input) for this preference

default

  The default value for this preference

descr

  A description of what this preference is

#### 11.10.3.3. Pref.string(label, default, descr)

Creates a string preference to be added to a Protocol's prefs table.

##### 11.10.3.3.1. Arguments

label

  The Label (text in the right side of the preference input) for this preference

default

  The default value for this preference

descr

  A description of what this preference is

#### 11.10.3.4. Pref.enum(label, default, descr, enum, radio)

Creates an enum preference to be added to a Protocol's prefs table.

##### 11.10.3.4.1. Arguments

label

  The Label (text in the right side of the preference input) for this preference

default

  The default value for this preference

descr

  A description of what this preference is

enum

  A enum table

radio

  Radio button (true) or Combobox (false)

#### 11.10.3.5. Pref.range(label, default, descr, max)

Creates a range preference to be added to a Protocol's prefs table.

##### 11.10.3.5.1. Arguments

label

  The Label (text in the right side of the preference input) for this preference

default

  The default value for this preference, e.g., "53", "10-30", or "10-30,53,55,100-120"

descr

  A description of what this preference is

max

  The maximum value

#### 11.10.3.6. Pref.statictext(label, descr)

Creates a static text preference to be added to a Protocol's prefs table.

##### 11.10.3.6.1. Arguments

label

  The static text

descr

  The static text description

### 11.10.4. Prefs

The table of preferences of a protocol

#### 11.10.4.1. prefs:__newindex(name, pref)

Creates a new preference

##### 11.10.4.1.1. Arguments

name

  The abbreviation of this preference

pref

  A valid but still unassigned Pref object

##### 11.10.4.1.2. Errors

- Unknow Pref type

#### 11.10.4.2. prefs:__index(name)

Get the value of a preference setting

##### 11.10.4.2.1. Arguments

name

  The abbreviation of this preference

##### 11.10.4.2.2. Returns

The current value of the preference

##### 11.10.4.2.3. Errors

- Unknow Pref type

### 11.10.5. Proto

A new protocol in wireshark. Protocols have more uses, the main one is to dissect a protocol. But they can be just dummies used to register preferences for other purposes.

#### 11.10.5.1. Proto.new(name, desc)

##### 11.10.5.1.1. Arguments

name

  The name of the protocol

desc

  A Long Text description of the protocol (usually lowercase)

##### 11.10.5.1.2. Returns

The newly created protocol

#### 11.10.5.2. proto.dissector

The protocol's dissector, a function you define

#### 11.10.5.3. proto.fields

The Fields Table of this dissector

#### 11.10.5.4. proto.prefs

The preferences of this dissector

#### 11.10.5.5. proto.init

The init routine of this dissector, a function you define

#### 11.10.5.6. proto.name

The name given to this dissector

#### 11.10.5.7. proto.description

The description given to this dissector

### 11.10.6. ProtoField

A Protocol field (to be used when adding items to the dissection tree)

#### 11.10.6.1. ProtoField.new(name, abbr, type, [voidstring], [base], [mask], [descr])

Creates a new field to be used in a protocol.

##### 11.10.6.1.1. Arguments

name

  Actual name of the field (the string that appears in the tree).

abbr

  Filter name of the field (the string that is used in filters).

type

  Field Type: one of ftypes.NONE, ftypes.PROTOCOL, ftypes.BOOLEAN, ftypes.UINT8, ftypes.UINT16, ftypes.UINT24, ftypes.UINT32, ftypes.UINT64, ftypes.INT8, ftypes.INT16 ftypes.INT24, ftypes.INT32, ftypes.INT64, ftypes.FLOAT, ftypes.DOUBLE, ftypes.ABSOLUTE_TIME ftypes.RELATIVE_TIME, ftypes.STRING, ftypes.STRINGZ, ftypes.UINT_STRING, ftypes.ETHER, ftypes.BYTES ftypes.UINT_BYTES, ftypes.IPv4, ftypes.IPv6, ftypes.IPXNET, ftypes.FRAMENUM, ftypes.PCRE, ftypes.GUID ftypes.OID, ftypes.EUI64

voidstring (optional)

  A VoidString object.

base (optional)

  The representation: one of base.NONE, base.DEC, base.HEX, base.OCT, base.DEC_HEX, base.HEX_DEC

mask (optional)

  The bitmask to be used.

descr (optional)

  The description of the field.

##### 11.10.6.1.2. Returns

The newly created ProtoField object

#### 11.10.6.2. ProtoField.uint8(abbr, [name], [base], [valuestring], [mask], [desc])

##### 11.10.6.2.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

base (optional)

  One of base.DEC, base.HEX or base.OCT

valuestring (optional)

  A table containing the text that corresponds to the values

mask (optional)

  Integer mask of this field

desc (optional)

  Description of the field

##### 11.10.6.2.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.3. ProtoField.uint16(abbr, [name], [base], [valuestring], [mask], [desc])

##### 11.10.6.3.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

base (optional)

  One of base.DEC, base.HEX or base.OCT

valuestring (optional)

  A table containing the text that corresponds to the values

mask (optional)

  Integer mask of this field

desc (optional)

  Description of the field

##### 11.10.6.3.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.4. ProtoField.uint24(abbr, [name], [base], [valuestring], [mask], [desc])

##### 11.10.6.4.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

base (optional)

  One of base.DEC, base.HEX or base.OCT

valuestring (optional)

  A table containing the text that corresponds to the values

mask (optional)

  Integer mask of this field

desc (optional)

  Description of the field

##### 11.10.6.4.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.5. ProtoField.uint32(abbr, [name], [base], [valuestring], [mask], [desc])

##### 11.10.6.5.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

base (optional)

  One of base.DEC, base.HEX or base.OCT

valuestring (optional)

  A table containing the text that corresponds to the values

mask (optional)

  Integer mask of this field

desc (optional)

  Description of the field

##### 11.10.6.5.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.6. ProtoField.uint64(abbr, [name], [base], [valuestring], [mask], [desc])

##### 11.10.6.6.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

base (optional)

  One of base.DEC, base.HEX or base.OCT

valuestring (optional)

  A table containing the text that corresponds to the values

mask (optional)

  Integer mask of this field

desc (optional)

  Description of the field

##### 11.10.6.6.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.7. ProtoField.int8(abbr, [name], [base], [valuestring], [mask], [desc])

##### 11.10.6.7.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

base (optional)

  One of base.DEC, base.HEX or base.OCT

valuestring (optional)

  A table containing the text that corresponds to the values

mask (optional)

  Integer mask of this field

desc (optional)

  Description of the field

##### 11.10.6.7.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.8. ProtoField.int16(abbr, [name], [base], [valuestring], [mask], [desc])

##### 11.10.6.8.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

base (optional)

  One of base.DEC, base.HEX or base.OCT

valuestring (optional)

  A table containing the text that corresponds to the values

mask (optional)

  Integer mask of this field

desc (optional)

  Description of the field

##### 11.10.6.8.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.9. ProtoField.int24(abbr, [name], [base], [valuestring], [mask], [desc])

##### 11.10.6.9.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

base (optional)

  One of base.DEC, base.HEX or base.OCT

valuestring (optional)

  A table containing the text that corresponds to the values

mask (optional)

  Integer mask of this field

desc (optional)

  Description of the field

##### 11.10.6.9.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.10. ProtoField.int32(abbr, [name], [base], [valuestring], [mask], [desc])

##### 11.10.6.10.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

base (optional)

  One of base.DEC, base.HEX or base.OCT

valuestring (optional)

  A table containing the text that corresponds to the values

mask (optional)

  Integer mask of this field

desc (optional)

  Description of the field

##### 11.10.6.10.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.11. ProtoField.int64(abbr, [name], [base], [valuestring], [mask], [desc])

##### 11.10.6.11.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

base (optional)

  One of base.DEC, base.HEX or base.OCT

valuestring (optional)

  A table containing the text that corresponds to the values

mask (optional)

  Integer mask of this field

desc (optional)

  Description of the field

##### 11.10.6.11.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.12. ProtoField.framenum(abbr, [name], [base], [valuestring], [mask], [desc])

A frame number (for hyperlinks between frames)

##### 11.10.6.12.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

base (optional)

  One of base.DEC, base.HEX or base.OCT

valuestring (optional)

  A table containing the text that corresponds to the values

mask (optional)

  Integer mask of this field

desc (optional)

  Description of the field

##### 11.10.6.12.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.13. ProtoField.bool(abbr, [name], [display], [string], [mask], [desc])

##### 11.10.6.13.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

display (optional)

  how wide the parent bitfield is (base.NONE is used for NULL-value)

string (optional)

  A table containing the text that corresponds to the values

mask (optional)

  Integer mask of this field

desc (optional)

  Description of the field

##### 11.10.6.13.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.14. ProtoField.absolute_time(abbr, [name], [base], [desc])

##### 11.10.6.14.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

base (optional)

  One of base.LOCAL, base.UTC or base.DOY_UTC

desc (optional)

  Description of the field

##### 11.10.6.14.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.15. ProtoField.relative_time(abbr, [name], [desc])

##### 11.10.6.15.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

desc (optional)

  Description of the field

##### 11.10.6.15.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.16. ProtoField.ipv4(abbr, [name], [desc])

##### 11.10.6.16.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

desc (optional)

  Description of the field

##### 11.10.6.16.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.17. ProtoField.ipv6(abbr, [name], [desc])

##### 11.10.6.17.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

desc (optional)

  Description of the field

##### 11.10.6.17.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.18. ProtoField.ether(abbr, [name], [desc])

##### 11.10.6.18.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

desc (optional)

  Description of the field

##### 11.10.6.18.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.19. ProtoField.float(abbr, [name], [desc])

##### 11.10.6.19.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

desc (optional)

  Description of the field

##### 11.10.6.19.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.20. ProtoField.double(abbr, [name], [desc])

##### 11.10.6.20.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

desc (optional)

  Description of the field

##### 11.10.6.20.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.21. ProtoField.string(abbr, [name], [desc])

##### 11.10.6.21.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

desc (optional)

  Description of the field

##### 11.10.6.21.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.22. ProtoField.stringz(abbr, [name], [desc])

##### 11.10.6.22.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

desc (optional)

  Description of the field

##### 11.10.6.22.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.23. ProtoField.bytes(abbr, [name], [desc])

##### 11.10.6.23.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

desc (optional)

  Description of the field

##### 11.10.6.23.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.24. ProtoField.ubytes(abbr, [name], [desc])

##### 11.10.6.24.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

desc (optional)

  Description of the field

##### 11.10.6.24.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.25. ProtoField.guid(abbr, [name], [desc])

##### 11.10.6.25.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

desc (optional)

  Description of the field

##### 11.10.6.25.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.26. ProtoField.oid(abbr, [name], [desc])

##### 11.10.6.26.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

desc (optional)

  Description of the field

##### 11.10.6.26.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.27. ProtoField.bool(abbr, [name], [desc])

##### 11.10.6.27.1. Arguments

abbr

  Abbreviated name of the field (the string used in filters)

name (optional)

  Actual name of the field (the string that appears in the tree)

desc (optional)

  Description of the field

##### 11.10.6.27.2. Returns

A protofield item to be added to a ProtoFieldArray

#### 11.10.6.28. protofield:__tostring()

Returns a string with info about a protofield (for debugging purposes)

### 11.10.7. Non Method Functions

#### 11.10.7.1. register_postdissector(proto)

Make a protocol (with a dissector) a postdissector. It will be called for every frame after dissection

##### 11.10.7.1.1. Arguments

proto

  the protocol to be used as postdissector

Prev | Up | Next
11.9. Obtaining packet information | Home | 11.11. Adding information to the dissection tree