A boolean: true if it is enabled, false if it isn't.
10.4.3.3.2. register_menu(name, action, [group])
Register a menu item in one of the main menus.
10.4.3.3.2.1. Arguments
name
The name of the menu item. The submenus are to be separated by '/'s. (string)
action
The function to be called when the menu item is invoked. (function taking no arguments and returning nothing)
group (optional)
The menu group into which the menu item is to be inserted. If omitted, defaults to MENU_STAT_GENERIC. One of MENU_STAT_UNSORTED (Statistics), MENU_STAT_GENERIC (Statistics, first section), MENU_STAT_CONVERSATION (Statistics/Conversation List), MENU_STAT_ENDPOINT (Statistics/Endpoint List), MENU_STAT_RESPONSE (Statistics/Service Response Time), MENU_STAT_TELEPHONY (Telephony), MENU_ANALYZE (Analyze), MENU_ANALYZE_CONVERSATION (Analyze/Conversation Filter), MENU_TOOLS_UNSORTED (Tools). (number)
10.4.3.3.3. new_dialog(title, action, ...)
Pops up a new dialog
10.4.3.3.3.1. Arguments
title
Title of the dialog's window.
action
Action to be performed when OKd.
...
A series of strings to be used as labels of the dialog's fields
10.4.3.3.3.2. Errors
At least one field required
All fields must be strings
10.4.3.3.4. retap_packets()
Rescan all packets and just run taps - don't reconstruct the display.
10.4.3.3.5. copy_to_clipboard(text)
Copy a string into the clipboard
10.4.3.3.5.1. Arguments
text
The string to be copied into the clipboard.
10.4.3.3.6. open_capture_file(filename, filter)
Open and display a capture file
10.4.3.3.6.1. Arguments
filename
The name of the file to be opened.
filter
A filter to be applied as the file gets opened.
10.4.3.3.7. set_filter(text)
Set the main filter text
10.4.3.3.7.1. Arguments
text
The filter's text.
10.4.3.3.8. apply_filter()
Apply the filter in the main filter box
10.4.3.3.9. reload()
Reload the current capture file
10.4.3.3.10. browser_open_url(url)
Open an url in a browser
10.4.3.3.10.1. Arguments
url
The url.
10.4.3.3.11. browser_open_data_file(filename)
Open an file in a browser
10.4.3.3.11.1. Arguments
filename
The url.
10.4.4. Post-dissection packet analysis
10.4.4.1. Listener
A Listener, is called once for every packet that matches a certain filter or has a certain tap.
It can read the tree, the packet's Tvb eventually the tapped data but it cannot
add elements to the tree.
10.4.4.1.1. Listener.new([tap], [filter])
Creates a new Listener listener
10.4.4.1.1.1. Arguments
tap (optional)
The name of this tap
filter (optional)
A filter that when matches the tap.packet function gets called (use nil to be called for every packet)
10.4.4.1.1.2. Returns
The newly created Listener listener object
10.4.4.1.1.3. Errors
tap registration error
10.4.4.1.2. listener:remove()
Removes a tap listener
10.4.4.1.3. listener.packet
A function that will be called once every packet matches the Listener listener filter.
function tap.packet(pinfo,tvb,userdata) ... end
10.4.4.1.4. listener.draw
A function that will be called once every few seconds to redraw the gui objects
in tshark this funtion is called oly at the very end of the capture file.
function tap.draw(userdata) ... end
10.4.4.1.5. listener.reset
A function that will be called at the end of the capture run.
function tap.reset(userdata) ... end
10.4.5. Obtaining packet information
10.4.5.1. Address
Represents an address
10.4.5.1.1. Address.ip(hostname)
Creates an Address Object representing an IP address.
10.4.5.1.1.1. Arguments
hostname
The address or name of the IP host.
10.4.5.1.1.2. Returns
The Address object
10.4.5.1.2. address:__tostring()
10.4.5.1.2.1. Returns
The string representing the address.
10.4.5.1.3. address:__eq()
Compares two Addresses
10.4.5.1.4. address:__le()
Compares two Addresses
10.4.5.1.5. address:__lt()
Compares two Addresses
10.4.5.2. Column
A Column in the packet list
10.4.5.2.1. column:__tostring()
10.4.5.2.1.1. Returns
A string representing the column
10.4.5.2.2. column:clear()
Clears a Column
10.4.5.2.3. column:set(text)
Sets the text of a Column
10.4.5.2.3.1. Arguments
text
The text to which to set the Column
10.4.5.2.4. column:append(text)
Appends text to a Column
10.4.5.2.4.1. Arguments
text
The text to append to the Column
10.4.5.2.5. column:preppend(text)
Prepends text to a Column
10.4.5.2.5.1. Arguments
text
The text to prepend to the Column
10.4.5.3. Columns
The Columns of the packet list.
10.4.5.3.1. columns:__tostring()
10.4.5.3.1.1. Returns
The string "Columns", no real use, just for debugging purposes.
10.4.5.3.2. columns:__newindex(column, text)
Sets the text of a specific column
10.4.5.3.2.1. Arguments
column
The name of the column to set
text
The text for the column
10.4.5.4. Pinfo
Packet information
10.4.5.4.1. pinfo.number
The number of this packet in the current file
10.4.5.4.2. pinfo.len
The length of the frame
10.4.5.4.3. pinfo.caplen
The captured length of the frame
10.4.5.4.4. pinfo.abs_ts
When the packet was captured
10.4.5.4.5. pinfo.rel_ts
Number of seconds passed since beginning of capture
10.4.5.4.6. pinfo.delta_ts
Number of seconds passed since the last captured packet
10.4.5.4.7. pinfo.delta_dis_ts
Number of seconds passed since the last displayed packet
10.4.5.4.8. pinfo.visited
Whether this packet hass been already visited
10.4.5.4.9. pinfo.src
Source Address of this Packet
10.4.5.4.10. pinfo.dst
Destination Address of this Packet
10.4.5.4.11. pinfo.lo
lower Address of this Packet
10.4.5.4.12. pinfo.hi
higher Address of this Packet
10.4.5.4.13. pinfo.dl_src
Data Link Source Address of this Packet
10.4.5.4.14. pinfo.dl_dst
Data Link Destination Address of this Packet
10.4.5.4.15. pinfo.net_src
Network Layer Source Address of this Packet
10.4.5.4.16. pinfo.net_dst
Network Layer Destination Address of this Packet
10.4.5.4.17. pinfo.ptype
Type of Port of .src_port and .dst_port
10.4.5.4.18. pinfo.src_port
Source Port of this Packet
10.4.5.4.19. pinfo.dst_port
Source Address of this Packet
10.4.5.4.20. pinfo.ipproto
IP Protocol id
10.4.5.4.21. pinfo.circuit_id
For circuit based protocols
10.4.5.4.22. pinfo.match
Port/Data we are matching
10.4.5.4.23. pinfo.curr_proto
Which Protocol are we dissecting
10.4.5.4.24. pinfo.columns
Accesss to the packet list columns
10.4.5.4.25. pinfo.cols
Accesss to the packet list columns (equivalent to pinfo.columns)
10.4.5.4.26. pinfo.desegment_len
Estimated number of additional bytes required for completing the PDU
10.4.5.4.27. pinfo.desegment_offset
Offset in the tvbuff at which the dissector will continue processing when next called
10.4.5.4.28. pinfo.private_data
Access to private data
10.4.6. Functions for writing dissectors
10.4.6.1. Dissector
A refererence to a dissector, used to call a dissector against a packet or a part of it.
10.4.6.1.1. Dissector.get(name)
Obtains a dissector reference by name
10.4.6.1.1.1. Arguments
name
The name of the dissector
10.4.6.1.1.2. Returns
The Dissector reference
10.4.6.1.2. dissector:call(tvb, pinfo, tree)
Calls a dissector against a given packet (or part of it)
10.4.6.1.2.1. Arguments
tvb
The buffer to dissect
pinfo
The packet info
tree
The tree on which to add the protocol items
10.4.6.2. DissectorTable
A table of subdissectors of a particular protocol (e.g. TCP subdissectors like http, smtp, sip are added to table "tcp.port").
Useful to add more dissectors to a table so that they appear in the Decode As... dialog.
Creates a range preference to be added to a Protocol's prefs table.
10.4.6.3.5.1. Arguments
label
The Label (text in the right side of the preference input) for this preference
default
The default value for this preference
descr
A description of what this preference is
range
The range
max
The maximum value
10.4.6.3.6. Pref.statictext(label, descr)
Creates a static text preference to be added to a Protocol's prefs table.
10.4.6.3.6.1. Arguments
label
The static text
descr
The static text description
10.4.6.4. Prefs
The table of preferences of a protocol
10.4.6.4.1. prefs:__newindex(name, pref)
Creates a new preference
10.4.6.4.1.1. Arguments
name
The abbreviation of this preference
pref
A valid but still unassigned Pref object
10.4.6.4.1.2. Errors
Unknow Pref type
10.4.6.4.2. prefs:__index(name)
Get the value of a preference setting
10.4.6.4.2.1. Arguments
name
The abbreviation of this preference
10.4.6.4.2.2. Returns
The current value of the preference
10.4.6.4.2.3. Errors
Unknow Pref type
10.4.6.5. Proto
A new protocol in wireshark. Protocols have more uses, the main one is to dissect
a protocol. But they can be just dummies used to register preferences for
other purposes.
10.4.6.5.1. Proto.new(name, desc)
10.4.6.5.1.1. Arguments
name
The name of the protocol
desc
A Long Text description of the protocol (usually lowercase)
10.4.6.5.1.2. Returns
The newly created protocol
10.4.6.5.2. proto.dissector
The protocol's dissector, a function you define
10.4.6.5.3. proto.fields
The Fields Table of this dissector
10.4.6.5.4. proto.prefs
The preferences of this dissector
10.4.6.5.5. proto.init
The init routine of this dissector, a function you define
10.4.6.5.6. proto.name
The name given to this dissector
10.4.6.6. ProtoField
A Protocol field (to be used when adding items to the dissection tree)
Abbreviated name of the field (the string used in filters)
name (optional)
Actual name of the field (the string that appears in the tree)
desc (optional)
Description of the field
10.4.6.6.24.2. Returns
A protofield item to be added to a ProtoFieldArray
10.4.6.7. Non Method Functions
10.4.6.7.1. register_postdissector(proto)
Make a protocol (with a dissector) a postdissector. It will be called for every frame after dissection
10.4.6.7.1.1. Arguments
proto
the protocol to be used as postdissector
10.4.7. Adding information to the dissection tree
10.4.7.1. TreeItem
TreeItems represent information in the packet-details pane.
A root TreeItem is passed to dissectors as first argument.
10.4.7.1.1. treeitem:add()
Adds an child item to a given item, returning the child.
tree_item:add([proto_field | proto], [tvbrange], [label], ...)
if the proto_field represents a numeric value (int, uint or float) is to be treated as a Big Endian (network order) Value.
10.4.7.1.1.1. Returns
The child item
10.4.7.1.2. treeitem:add_le()
Adds (and returns) an child item to a given item, returning the child.
tree_item:add([proto_field | proto], [tvbrange], [label], ...)
if the proto_field represents a numeric value (int, uint or float) is to be treated as a Little Endian Value.
Sets the expert flags of the item and adds expert info to the packet.
10.4.7.1.6.1. Arguments
group (optional)
One of PI_CHECKSUM, PI_SEQUENCE, PI_RESPONSE_CODE, PI_REQUEST_CODE, PI_UNDECODED, PI_REASSEMBLE, PI_MALFORMED or PI_DEBUG
severity (optional)
One of PI_CHAT, PI_NOTE, PI_WARN, PI_ERROR
text (optional)
The text for the expert info
10.4.7.1.7. treeitem:set_generated()
Marks the TreeItem as a generated field (with data infered but not contained in the packet).
10.4.7.1.8. treeitem:set_hidden()
Should not be used
10.4.7.1.9. treeitem:set_len(len)
Set TreeItem's length inside tvb, after it has already been created.
10.4.7.1.9.1. Arguments
len
The length to be used.
10.4.8. Functions for handling packet data
10.4.8.1. ByteArray
10.4.8.1.1. ByteArray.new([hexbytes])
Creates a ByteArray Object
10.4.8.1.1.1. Arguments
hexbytes (optional)
A string consisting of hexadecimal bytes like "00 B1 A2" or "1a2b3c4d"
10.4.8.1.1.2. Returns
The new ByteArray object.
10.4.8.1.2. bytearray:__concat(first, second)
Concatenate two ByteArrays
10.4.8.1.2.1. Arguments
first
First array
second
Second array
10.4.8.1.2.2. Returns
The new composite ByteArray.
10.4.8.1.2.3. Errors
Both arguments must be ByteArrays
10.4.8.1.3. bytearray:prepend(prepended)
Prepend a ByteArray to this ByteArray
10.4.8.1.3.1. Arguments
prepended
Array to be prepended
10.4.8.1.3.2. Errors
Both arguments must be ByteArrays
10.4.8.1.4. bytearray:append(appended)
Append a ByteArray to this ByteArray
10.4.8.1.4.1. Arguments
appended
Array to be appended
10.4.8.1.4.2. Errors
Both arguments must be ByteArrays
10.4.8.1.5. bytearray:set_size(size)
Sets the size of a ByteArray, either truncating it or filling it with zeros.
10.4.8.1.5.1. Arguments
size
New size of the array
10.4.8.1.5.2. Errors
ByteArray size must be non-negative
10.4.8.1.6. bytearray:set_index(index, value)
Sets the value of an index of a ByteArray.
10.4.8.1.6.1. Arguments
index
The position of the byte to be set
value
The char value to set [0-255]
10.4.8.1.7. bytearray:get_index(index)
Get the value of a byte in a ByteArray
10.4.8.1.7.1. Arguments
index
The position of the byte to get
10.4.8.1.7.2. Returns
The value [0-255] of the byte.
10.4.8.1.8. bytearray:len()
Obtain the length of a ByteArray
10.4.8.1.8.1. Returns
The length of the ByteArray.
10.4.8.1.9. bytearray:subset(offset, length)
Obtain a segment of a ByteArray
10.4.8.1.9.1. Arguments
offset
The position of the first byte
length
The length of the segment
10.4.8.1.9.2. Returns
A ByteArray contaning the requested segment.
A string contaning a representaion of the ByteArray.
10.4.8.2. Int
Int64 represents a 64 bit integer.
Lua uses one single number representation which can be chosen at compile time and since
it is often set to IEEE 754 double precision floating point, we cannot store a 64 bit integer
with full precision.
For details, see: https://lua-users.org/wiki/FloatingPoint
10.4.8.3. Tvb
A Tvb represents the packet's buffer. It is passed as an argument to listeners and dissectors,
and can be used to extract information (via TvbRange) from the packet's data. Beware that Tvbs are usable only by the current
listener or dissector call and are destroyed as soon as the listener/dissector returns, so references
to them are unusable once the function has returned.
To create a tvbrange the tvb must be called with offset and length as optional arguments ( the offset defaults to 0 and the length to tvb:len() )
10.4.8.3.1. Tvb.new_real(bytearray, name)
Creates a new Tvb from a bytearray (it gets added to the current frame too)
10.4.8.3.1.1. Arguments
bytearray
The data source for this Tvb.
name
The name to be given to the new data-source.
10.4.8.3.1.2. Returns
The created Tvb.
10.4.8.3.2. Tvb.tvb(range)
Creates a (sub)Tvb from using a TvbRange
10.4.8.3.2.1. Arguments
range
The TvbRange from which to create the new Tvb.
10.4.8.3.3. tvb:__tostring()
Convert the bytes of a Tvb into a string, to be used for debugging purposes as '...' will be appended in case the string is too long.
10.4.8.3.3.1. Returns
The string.
10.4.8.3.4. tvb:len()
Obtain the length of a TVB
10.4.8.3.4.1. Returns
The length of the Tvb.
10.4.8.3.5. tvb:offset()
Returns the raw offset (from the beginning of the source Tvb) of a sub Tvb.
10.4.8.3.5.1. Returns
The raw offset of the Tvb.
10.4.8.3.6. tvb:__call()
Equivalent to tvb:range(...)
10.4.8.4. TvbRange
A TvbRange represents an usable range of a Tvb and is used to extract data from the Tvb that generated it
TvbRanges are created by calling a tvb (e.g. tvb(offset,length)). If the TvbRange span is outside the Tvb's range the creation will cause a runtime error.
10.4.8.4.1. tvb:range([offset], [length])
Creates a tvbr from this Tvb. This is used also as the Tvb:__call() metamethod.
10.4.8.4.1.1. Arguments
offset (optional)
The offset (in octets) from the begining of the Tvb. Defaults to 0.
length (optional)
The length (in octets) of the range. Defaults to until the end of the Tvb.
10.4.8.4.1.2. Returns
The TvbRange
10.4.8.4.2. tvbrange:uint()
Get a Big Endian (network order) unsigned integer from a TvbRange. The range must be 1, 2, 3 or 4 octets long.
10.4.8.4.2.1. Returns
The unsigned integer value
10.4.8.4.3. tvbrange:le_uint()
Get a Little Endian unsigned integer from a TvbRange. The range must be 1, 2, 3 or 4 octets long.
10.4.8.4.3.1. Returns
The unsigned integer value
10.4.8.4.4. tvbrange:uint64()
Get a Big Endian (network order) unsigned 64 bit integer from a TvbRange. The range must be 1-8 octets long.
10.4.8.4.5. tvbrange:le_uint64()
Get a Little Endian unsigned 64 bit integer from a TvbRange. The range must be 1-8 octets long.
10.4.8.4.6. tvbrange:float()
Get a Big Endian (network order) floating point number from a TvbRange. The range must be 4 or 8 octets long.
10.4.8.4.6.1. Returns
The flaoting point value
10.4.8.4.7. tvbrange:le_float()
Get a Little Endian floating point number from a TvbRange. The range must be 4 or 8 octets long.
10.4.8.4.7.1. Returns
The flaoting point value
10.4.8.4.8. tvbrange:ipv4()
Get an IPv4 Address from a TvbRange.
10.4.8.4.8.1. Returns
The IPv4 Address
10.4.8.4.9. tvbrange:le_ipv4()
Get an Little Endian IPv4 Address from a TvbRange.
The bit offset from the begining of the TvbRange. Defaults to 0.
length (optional)
The length (in bits) of the field. Defaults to 1.
10.4.8.4.13.2. Returns
The bitfield value
10.4.8.4.14. tvbrange:range([offset], [length])
Creates a sub-TvbRange from this TvbRange. This is used also as the TvbRange:__call() metamethod.
10.4.8.4.14.1. Arguments
offset (optional)
The offset (in octets) from the begining of the TvbRange. Defaults to 0.
length (optional)
The length (in octets) of the range. Defaults to until the end of the TvbRange.
10.4.8.4.14.2. Returns
The TvbRange
10.4.8.4.15. tvbrange:len()
Obtain the length of a TvbRange
10.4.8.4.16. tvbrange:offset()
Obtain the offset in a TvbRange
10.4.8.4.17. tvbrange:__tostring()
Converts the TvbRange into a string. As the string gets truncated
you should use this only for debugging purposes
or if what you want is to have a truncated string in the format 67:89:AB:...
10.4.8.5. UInt
UInt64 represents a 64 bit unsigned integer.
10.4.9. Utility Functions
10.4.9.1. Dir
A Directory
10.4.9.1.1. Dir.open(pathname, [extension])
Usage: for filename in Dir.open(path) do ... end
10.4.9.1.1.1. Arguments
pathname
The pathname of the directory
extension (optional)
If given, only file with this extension will be returned
10.4.9.1.1.2. Returns
the Dir object
10.4.9.1.2. dir:__call()
At every invocation will return one file (nil when done)
10.4.9.1.3. dir:close()
Closes the directory
10.4.9.2. Non Method Functions
10.4.9.2.1. format_date(timestamp)
Formats an absolute timestamp into a human readable date
10.4.9.2.1.1. Arguments
timestamp
A timestamp value to convert.
10.4.9.2.1.2. Returns
A string with the formated date
10.4.9.2.2. format_time(timestamp)
Formats a relative timestamp in a human readable form
10.4.9.2.2.1. Arguments
timestamp
A timestamp value to convert
10.4.9.2.2.2. Returns
A string with the formated time
10.4.9.2.3. report_failure(text)
Reports a failure to the user
10.4.9.2.3.1. Arguments
text
Message
10.4.9.2.4. critical(...)
Will add a log entry with critical severity
10.4.9.2.4.1. Arguments
...
objects to be printed
10.4.9.2.5. warn(...)
Will add a log entry with warn severity
10.4.9.2.5.1. Arguments
...
objects to be printed
10.4.9.2.6. message(...)
Will add a log entry with message severity
10.4.9.2.6.1. Arguments
...
objects to be printed
10.4.9.2.7. info(...)
Will add a log entry with info severity
10.4.9.2.7.1. Arguments
...
objects to be printed
10.4.9.2.8. debug(...)
Will add a log entry with debug severity
10.4.9.2.8.1. Arguments
...
objects to be printed
10.4.9.2.9. loadfile(filename)
Lua's loadfile() has been modified so that if a file does not exist
in the current directory it will look for it in wireshark's user and system directories
10.4.9.2.9.1. Arguments
filename
Name of the file to be loaded
10.4.9.2.10. dofile(filename)
Lua's dofile() has been modified so that if a file does not exist
in the current directory it will look for it in wireshark's user and system directories
10.4.9.2.10.1. Arguments
filename
Name of the file to be run
10.4.9.2.11. persconffile_path([filename])
10.4.9.2.11.1. Arguments
filename (optional)
A filename
10.4.9.2.11.2. Returns
The full pathname for a file in the personal configuration directory
10.4.9.2.12. datafile_path([filename])
10.4.9.2.12.1. Arguments
filename (optional)
A filename
10.4.9.2.12.2. Returns
The full pathname for a file in wireshark's configuration directory
