This is our old Q&A Site. Please post any new questions and answers at

I've been writing a lua dissector and would like to display the time interval between the arrival of two different packets.

I have created some NSTime variables like so:

first_nstime = NSTime(pinfo.abs_ts)

I then put all of these values (from all of the packets in the capture) into a table which gets referenced later when I want to get the interval between the last packet and the current packet.

However, I am having some issues when calculating the difference.

I have seen many dissectors in C that use the function:


However, I cannot seem to call that directly in a LUA dissector.

I also noticed the following LUA function from a doc here:

That is defined as follows: nstime:__sub()
Calculates the diff of two NSTimes

But whenever I attempt to call __sub() on an NSTime object like this:


Or like this:

NSTime(pinfo.abs_ts):__sub(current_nstime, first_nstime)

Or even with no arguments (like the doc states):


I get an error that looks like this:

A protocol doesn't have a `__sub' nstime

Is this function even meant to be used? Is it locally defined or something?

If this isn't the right way of getting the difference between two NSTime objects, what would that be?

I have noticed that I do have access to the nstime.secs and nstime.nsecs values of my NSTime objects, so I guess I could grab the seconds and nanoseconds of the two NSTime objects, perform some arithmetic on the regular lua numbers to get the result then use the result in the creation of a new NSTime object? That seems like a bit of a roundabout way of doing it if there are already functions defined for getting the difference.

asked 22 May '13, 20:54

Ballistic%20Buddha's gravatar image

Ballistic Bu...
accept rate: 0%

I'm not very clueful about Lua, but based on other scripting languages (Python), the double underscore prefix usually means the method is internal to the type, aka operator overloading. I suspect the method implements the subtraction operation for the nstime type, so given two values of type nstime you should be able to simply use the subtract operator, e.g. current_nstime - first_nstime

permanent link

answered 23 May '13, 02:44

grahamb's gravatar image

grahamb ♦
accept rate: 22%

Wow, now I feel ridiculous. I can't believe I didn't just try using the - operator on the two objects.

I had a feeling that the function was defined as local given that it was prefixed with two underscores. The underscores don't always do anything in lua, but you are correct that it is usually an indication of a function used for internal use only (like a local function). However It didn't occur to me for some reason that they used the local method in the subtract operation that gets called when you use the arithmetic operators on the object.

In fact, I also learned from here today that a lua function with the name of


defined for an object will always override the metamethod to implement the subtraction operation between itself and another object. Same goes for

__add(), __mul(), __div(), __tostring(), etc.

Cool stuff!

Thanks for the help.

(23 May '13, 10:51) Ballistic Bu...
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 22 May '13, 20:54

question was seen: 3,458 times

last updated: 23 May '13, 10:55

p​o​w​e​r​e​d by O​S​Q​A