This Part of the User Guide describes the Wireshark specific functions in the embedded Lua.
Creates a file to write packets. Dumper:new_for_current() will probably be a better choice.
The name of the capture file to be created
The type of the file to be created
The encapsulation to be used in the file to be created
Dumps an arbitrary packet. Note: Dumper:dump_current() will fit best in most cases.
Creates a capture file using the same encapsulation as the one of the cuurrent packet
A pseudoheader to be used to save captured frames.
Creates an ethernet pseudoheader
Creates an ATM pseudoheader
AAL number
VPI
VCI
Channel
Number of cells in the PDU
AAL5 User to User indicator
AAL5 Len
A Field extractor to to obtain field values.
Create a Field extractor
An extracted Field
checks whether lhs is within rhs
checks whether the end byte of rhs is before the beginning of rhs
Manages a text window.
Creates a new TextWindow.
Set the function that will be called when the window closes
Sets the text.
Appends text
Prepends text
Errases all text in the window.
Get the text of the window
Make this window editable
Checks whether the GUI facility is enabled.
Register a menu item in one of the main menus.
The name of the menu item. The submenus are to be separated by '/'s. (string)
The function to be called when the menu item is invoked. (function taking no arguments and returning nothing)
The menu group into which the menu item is to be inserted. If omitted, defaults to MENU_STAT_GENERIC. One of MENU_STAT (Statistics), MENU_STAT_GENERIC (Statistics, first section), MENU_STAT_CONVERSATION (Statistics/Conversation List), MENU_STAT_ENDPOINT (Statistics/Endpoint List), MENU_STAT_RESPONSE (Statistics/Service Response Time), MENU_STAT_TELEPHONY (Statistics, third section), MENU_ANALYZE (Analyze), MENU_ANALYZE_CONVERSATION (Analyze/Conversation Filter), MENU_TOOLS (Tools). (number)
Pops up a new dialog
Title of the dialog's window.
Action to be performed when OKd.
A series of strings to be used as labels of the dialog's fields
copy a string into the clipboard
open and display a capture file
A Listener, is called once for every packet that matches a certain filter or has a certain tap. It can read the tree, the packet's Tvb eventually the tapped data but it cannot add elements to the tree.
Creates a new Listener listener
the name of this tap
a filter that when matches the tap.packet function gets called (use nil to be called for every packet)
A function that will be called once every packet matches the Listener listener filter. function tap.packet(pinfo,tvb,userdata) ... end
A function that will be called once every few seconds to redraw the gui objects in tshark this funtion is called oly at the very end of the capture file. function tap.draw(userdata) ... end
Represents an address
Creates an Address Object representing an IP address.
A Column in the packet list
Sets the text of a Column
Appends text to a Column
The Columns of the packet list.
Packet information
A refererence to a dissector, used to call a dissector against a packet or a part of it.
* Obtains a dissector reference by name
A table of subdissectors of a particular protocol (e.g. TCP subdissectors like http, smtp, sip are added to table "tcp.port"). Useful to add more dissectors to a table so that they appear in the Decode As... dialog.
Creates a new DissectorTable for your dissector's use .
The short name of the table.
The name of the table in the User Interface (defaults to the name given).
either FT_UINT* or FT_STRING (defaults to FT_UINT32)
Obtain a reference to an existing dissector table.
Add a dissector to a table.
Remove a dissector from a table
Try to call a dissector from a table
A preference of a Protocol.
* Creates a boolean preference to be added to a Protocol's prefs table.
* Creates an (unsigned) integer preference to be added to a Protocol's prefs table.
* Creates a string preference to be added to a Protocol's prefs table.
* Creates an enum preference to be added to a Protocol's prefs table.
* Creates a range preference to be added to a Protocol's prefs table.
The table of preferences of a protocol
creates a new preference
The abbreviation of this preference
A valid but still unassigned Pref object
A new protocol in wireshark. Protocols have more uses, the main one is to dissect a protocol. But they can be just dummies used to register preferences for other purposes.
The name of the protocol
A Long Text description of the protocol (usually lowercase)
* A Protocol field (to be used when adding items to the dissection tree)
Creates a new field to be used in a protocol.
Actual name of the field (the string that appears in the tree).
Filter name of the field (the string that is used in filters).
Field Type (FT_*).
a ValueString object.
The representation BASE_*.
the bitmask to be used.
The description of the field.
abbreviated name of the field (the string used in filters)
Actual name of the field (the string that appears in the tree)
one of base.DEC, base.HEX or base.OCT
a table containing the text that corresponds to the values
integer mask of this field
description of the field
abbreviated name of the field (the string used in filters)
Actual name of the field (the string that appears in the tree)
one of base.DEC, base.HEX or base.OCT
a table containing the text that corresponds to the values
integer mask of this field
description of the field
abbreviated name of the field (the string used in filters)
Actual name of the field (the string that appears in the tree)
one of base.DEC, base.HEX or base.OCT
a table containing the text that corresponds to the values
integer mask of this field
description of the field
abbreviated name of the field (the string used in filters)
Actual name of the field (the string that appears in the tree)
one of base.DEC, base.HEX or base.OCT
a table containing the text that corresponds to the values
integer mask of this field
description of the field
abbreviated name of the field (the string used in filters)
Actual name of the field (the string that appears in the tree)
one of base.DEC, base.HEX or base.OCT
a table containing the text that corresponds to the values
integer mask of this field
description of the field
abbreviated name of the field (the string used in filters)
Actual name of the field (the string that appears in the tree)
one of base.DEC, base.HEX or base.OCT
a table containing the text that corresponds to the values
integer mask of this field
description of the field
abbreviated name of the field (the string used in filters)
Actual name of the field (the string that appears in the tree)
one of base.DEC, base.HEX or base.OCT
a table containing the text that corresponds to the values
integer mask of this field
description of the field
abbreviated name of the field (the string used in filters)
Actual name of the field (the string that appears in the tree)
one of base.DEC, base.HEX or base.OCT
a table containing the text that corresponds to the values
integer mask of this field
description of the field
abbreviated name of the field (the string used in filters)
Actual name of the field (the string that appears in the tree)
one of base.DEC, base.HEX or base.OCT
a table containing the text that corresponds to the values
integer mask of this field
description of the field
abbreviated name of the field (the string used in filters)
Actual name of the field (the string that appears in the tree)
one of base.DEC, base.HEX or base.OCT
a table containing the text that corresponds to the values
integer mask of this field
description of the field
a frame number (for hyperlinks between frames)
abbreviated name of the field (the string used in filters)
Actual name of the field (the string that appears in the tree)
one of base.DEC, base.HEX or base.OCT
a table containing the text that corresponds to the values
integer mask of this field
description of the field
abbreviated name of the field (the string used in filters)
Actual name of the field (the string that appears in the tree)
description of the field
abbreviated name of the field (the string used in filters)
Actual name of the field (the string that appears in the tree)
description of the field
abbreviated name of the field (the string used in filters)
Actual name of the field (the string that appears in the tree)
description of the field
abbreviated name of the field (the string used in filters)
Actual name of the field (the string that appears in the tree)
description of the field
abbreviated name of the field (the string used in filters)
Actual name of the field (the string that appears in the tree)
description of the field
abbreviated name of the field (the string used in filters)
Actual name of the field (the string that appears in the tree)
description of the field
abbreviated name of the field (the string used in filters)
Actual name of the field (the string that appears in the tree)
description of the field
abbreviated name of the field (the string used in filters)
Actual name of the field (the string that appears in the tree)
description of the field
abbreviated name of the field (the string used in filters)
Actual name of the field (the string that appears in the tree)
description of the field
abbreviated name of the field (the string used in filters)
Actual name of the field (the string that appears in the tree)
description of the field
abbreviated name of the field (the string used in filters)
Actual name of the field (the string that appears in the tree)
description of the field
abbreviated name of the field (the string used in filters)
Actual name of the field (the string that appears in the tree)
description of the field
TreeItems represent information in the packet-details pane. A root TreeItem is passed to dissectors as first argument.
Adds an child item to a given item, returning the child. tree_item:add([proto_field | proto], [tvbrange], [label], ...) if the proto_field represents a numeric value (int, uint or float) is to be treated as a Big Endian (network order) Value.
Adds (and returns) an child item to a given item, returning the child. tree_item:add([proto_field | proto], [tvbrange], [label], ...) if the proto_field represents a numeric value (int, uint or float) is to be treated as a Little Endian Value.
sets the text of the label
appends text to the label
Sets the expert flags of the item.
Sets the expert flags of the item and adds expert info to the packet.
marks the TreeItem as a generated field (with data infered but not contained in the packet).
creates a ByteArray Object
A string consisting of hexadecimal bytes like "00 B1 A2" or "1a2b3c4d"
concatenate two ByteArrays
prepend a ByteArray to this ByteArray
append a ByteArray to this ByteArray
Sets the size of a ByteArray, either truncating it or filling it with zeros.
sets the value of an index of a ByteArray.
get the value of a byte in a ByteArray
obtain the length of a ByteArray
a Tvb represents the packet's buffer. It is passed as an argument to listeners and dissectors, and can be used to extract information (via TvbRange) from the packet's data. Beware that Tvbs are usable only by the current listener or dissector call and are destroyed as soon as the listener/dissector returns, so references to them are unusable once the function has returned. To create a tvbrange the tvb must be called with offset and length as optional arguments ( the offset defaults to 0 and the length to tvb:len() )
Creates a new Tvb from a bytearray (it gets added to the current frame too)
The data source for this Tvb.
The name to be given to the new data-source.
creates a (sub)Tvb from using a TvbRange
convert the bytes of a Tvb into a string, to be used for debugging purposes as '...' will be appended in case the string is too long.
returns the raw offset (from the beginning of the source Tvb) of a sub Tvb.
* a TvbRange represents an usable range of a Tvb and is used to extract data from the Tvb that generated it * TvbRanges are created by calling a tvb (e.g. tvb(offset,length)). If the TvbRange span is outside the Tvb's range the creation will cause a runtime error.
creates a tvbr from this Tvb. This is used also as the Tvb:__call() metamethod.
The offset (in octets) from the begining of the Tvb. Defaults to 0.
The length (in octets) of the range. Defaults to until the end of the Tvb.
get a Big Endian (network order) unsigned integer from a TvbRange. The range must be 1, 2, 3 or 4 octets long. There's no support yet for 64 bit integers
get a Little Endian unsigned integer from a TvbRange. The range must be 1, 2, 3 or 4 octets long. There's no support yet for 64 bit integers
get a Big Endian (network order) floating point number from a TvbRange. The range must be 4 or 8 octets long.
get a Little Endian floating point number from a TvbRange. The range must be 4 or 8 octets long.
get an IPv4 Address from a TvbRange.
get an Little Endian IPv4 Address from a TvbRange.
get an Ethernet Address from a TvbRange.
converts the TvbRange into a string. As the string gets truncated you should use this only for debugging purposes or if what you want is to have a truncated string in the format 67:89:AB:...
A Directory
usage: for filename in Dir.open(path) do ... end
the pathname of the directory
if given, only file with this extension will be returned
Formats an absolute timestamp into a human readable date
Formats a relative timestamp in a human readable form
Will add a log entry with critical severity
Will add a log entry with warn severity
Will add a log entry with message severity
Will add a log entry with info severity
Will add a log entry with debug severity
Lua's loadfile() has been modified so that if a file does not exist in the current directory it will look for it in wireshark's user and system directories
Lua's dofile() has been modified so that if a file does not exist in the current directory it will look for it in wireshark's user and system directories