This is our old Q&A Site. Please post any new questions and answers at

I'm trying to write a dissector in Lua, and I ran this code:

local asc = Proto("asc", "ASC Protocol") 
local f = asc.fields 
f.version = ProtoField.uint8("asc.version", "version", base.HEX, nil, 0xC)

but I receive the following error:

attempt to index global 'base' (a nil value)

How do I fix this?

asked 04 May '12, 05:03

Olga's gravatar image

accept rate: 0%

edited 23 May '12, 07:01

helloworld's gravatar image


For others stumbling on this: in Fedora (and possibly other distributions) you need to install the wireshark-devel package.

yum install wireshark-devel

permanent link

answered 11 Oct '12, 05:18

Jannes's gravatar image

accept rate: 0%

The base table (which includes base.HEX, base.DEC, etc.) is defined in init.lua, which Wireshark/Tshark automatically loads at startup. That error you're seeing is an indication that either:

1) init.lua was not loaded (e.g., because it could not be found)


2) base was accidentally overwritten somewhere in your script (e.g., base = nil) before base.HEX

These are the default installation locations for init.lua:

  • OS X packages: /Applications/
  • Ubuntu: /etc/wireshark/init.lua
  • Windows installer: C:\Program Files\Wireshark\init.lua
  • Builds from source on UN*X: /usr/local/share/wireshark/init.lua

Problem 1 above is typically seen in development builds of Wireshark. That is, you're building Wireshark in a sandbox, you've set the install prefix to a local build directory, yet when you start Wireshark (even with WIRESHARK_RUN_FROM_BUILD_DIRECTORY environment variable set to 1), it still cannot find init.lua. The workaround is to copy init.lua (and console.lua, which is a helpful tool loaded by init.lua) to your home directory, which is in the Lua initialization path, and restart Wireshark/Tshark.


In your init.lua, you've loaded your script at line 34 before any of the Wireshark variables are declared (the base table is defined at line 247). Any file loading should be done at the end of init.lua (when initialization is complete). However, I don't recommend modifying C:\Program Files\Wireshark\init.lua because any errors introduced there break initialization for all other scripts. Instead, you should:

  • Create/edit C:\Users\*username*\AppData\Roaming\Wireshark\init.lua


  • Delete your original init.lua changes, and move your Lua script into C:\Program Files\Wireshark\plugins\1.8.0\ (where 1.8.0 is the current version of Wireshark), where it would be loaded automatically without any other file modification.
permanent link

answered 10 May '12, 14:13

helloworld's gravatar image

accept rate: 28%

edited 29 Jun '12, 12:47

thank you for your reply, but i defined base as base={} and this works

(23 May '12, 05:26) Olga

I assume you define "works" as in "the interpreter no longer complains about your previous problem". If, on the other hand, you define "works" here as: "the bitfield is displayed in hexadecimal format", then your change does not "work" as intended.

If you set base = {}, then base.HEX is nil, which means you effectively have:

f.version = ProtoField.uint8("asc.version", "version", nil, nil, 0xC)
(23 May '12, 07:11) helloworld

Specifying nil there tells ProtoField to use the default, which is base.DEC. So, your protocol tree would show:

.... 01.. = version: 1

instead of:

.... 01.. = version: 0x01
(23 May '12, 07:11) helloworld

init.lua was not loaded (e.g., because it could not be found)

In init.lua, I defined the path to my dissector:

disable_lua = false

MYPROTO_SCRIPT_PATH="C:\\Program Files\\Wireshark\\"

...and Wireshark loads my dissector, so I suppose that Wireshark sees init.lua. init.lua and console.lua exist in C:\Program Files\Wireshark\.

(25 May '12, 04:06) Olga

What version of Wireshark are you running?

The base table is only defined in init.lua in any standard Wireshark installation. If you're indeed loading init.lua, then something in your script (or loaded by your script) is likely overwriting base. You can quickly test this by adding a couple debug-prints before and after loading your script:

debug('BEFORE: '..base.HEX)
debug('AFTER: '..base.HEX)
(25 May '12, 10:12) helloworld

Wireshark version: Version 1.6.7 OS Windows

i did debug print, restart wireshark and i recieved following error Lua: Error during loading: [string "C:\Program Files\Wireshark\init.lua"]:33: attempt to index global 'base' (a nil value)

(28 May '12, 08:12) Olga

Ok. This would be easier to troubleshoot if we could see the entire contents of your init.lua. Please copy and paste it into and link it here.

(05 Jun '12, 18:44) helloworld
(29 Jun '12, 05:51) Olga

You're loading your file way too early in init.lua. See updated answer.

(29 Jun '12, 12:48) helloworld
showing 5 of 9 show 4 more comments
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 04 May '12, 05:03

question was seen: 8,752 times

last updated: 11 Oct '12, 05:18

p​o​w​e​r​e​d by O​S​Q​A