This is our old Q&A Site. Please post any new questions and answers at

Hi, I wrote a simple postdissector in lua but it seems to be executed twice when wireshark is opened and then every time for a packet I click on, or move to another packet with arrow keys.

I've also noticed that if I restrict the execution by tracking how many times it was run for a given packet the new tree item will be removed. As if the display with new tree item was constructed on a click or move.

Is that behavior expected ?

asked 11 Oct '12, 09:28

izopizo's gravatar image

accept rate: 0%

Yes, this is expected behavior. The protocol tree is rebuilt each time you click on the item so that Wireshark does not have to keep (all!) the protocol trees in memory. IOW, the only protocol tree Wireshark keeps in memory is that of the currently-displayed frame. To do that, it must rebuild the tree each time you select the frame.

permanent link

answered 11 Oct '12, 10:39

JeffMorriss's gravatar image

JeffMorriss ♦
accept rate: 27%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 11 Oct '12, 09:28

question was seen: 2,248 times

last updated: 11 Oct '12, 10:39

p​o​w​e​r​e​d by O​S​Q​A