1

I just started with lua plugins in wireshark. I wanted to know if it is possible to create like a global object that can be called by dissector in one packet and used by dissector called by another packet.

2
  • @ HighNESS this looks like script configuration for an application. app config q's should be on superuser site
    – DRP
    Feb 4 '18 at 14:28
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Feb 21 '18 at 18:09
1

Certainly lua has globals which are accessible from different dissectors of a different packet.

Following is a trivial dissector based on that in https://wiki.wireshark.org/Lua/Dissectors, with the addition of a variable counter, which is local to the file and global to the dissector:

-- test with tshark -r CAP1 -n -X lua_script:filename.lua -V

local counter = 0;

triviala_proto = Proto("triviala", "Trivial Protocol A")
function triviala_proto.dissector(buffer, pinfo, tree)
    pinfo.cols.protocol = "TRIVIALA"
    local subtree = tree:add(triviala_proto, buffer(), "Trivial")
    subtree:add(buffer(0, 2), "++" .. counter .. "/" .. buffer(0, 2):uint())
    counter = counter + 1;
end
udp_table = DissectorTable.get("udp.port")
udp_table:add(7777, triviala_proto)

The global is available to other dissectors in the same file (easily tested: just make a matching "trivialb_proto" on port 8888).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.