This is our old Q&A Site. Please post any new questions and answers at


I'm writing a dissector for Wireshark with lua. (not the first).

But I have the following problem. Analyzing the data that I want to be split among the TCP level is already to some extent by an ISO 8075.(COPT Protocol) And I just want to be among the Datadump. Use for my dissector.

Currently I use: tcp_encap_table DissectorTable.get = ("tcp.port) tcp_encap_table: add (102, matze_proto) Here I get data data I do not want to use.

Is there any way the possibility of something similar as tcp_encap_table DissectorTable.get = ("ISO-8073") tcp_encap_table: add (***, matze_proto) to get to run? I think I need the name of the dissectortable copt(ISO-8073). But I donĀ“t know where i can find it.

Im greatly appreciate for any help or suggestions.

Greeting Matze

asked 07 Apr '11, 23:32

MatzeB's gravatar image

accept rate: 0%

retagged 29 Apr '11, 22:03

helloworld's gravatar image


Sorry for my bad english:-)

(07 Apr '11, 23:33) MatzeB

ISO 8073 is actually COTP (Connection Oriented Transport Protocol), not "COPT". here is an example of using dissector chaining to get to the COTP data:

        local cotp_wrapper_proto = Proto("cotp_wrapper", "COTP Wrapper");
        local original_cotp_dissector = nil

        -- Declare a field extractor to check for the
        -- presence of COTP in the current packet.
        local f_cotp ="cotp")

        function cotp_wrapper_proto.dissector(tvbuffer, pinfo, treeitem)

                -- let the actual dissector parse the data at TCP port 102
                -- (it might not be COTP but we'll find out soon below)
                if original_cotp_dissector then
                    original_cotp_dissector:call(tvbuffer, pinfo, treeitem)

                -- if the "cotp" field exists, the packet has COTP and
                -- tvbuffer is the COTP data
                if f_cotp() then
                    debug("COTP: " .. tostring(tvbuffer))

        local tcp_dissector_table = DissectorTable.get("tcp.port")
        original_cotp_dissector = tcp_dissector_table:get_dissector(102) -- save the original dissector so we can still get to it
        tcp_dissector_table:add(102, cotp_wrapper_proto)                 -- and take its place in the dissector table
permanent link

answered 28 Apr '11, 14:05

bstn's gravatar image

accept rate: 14%

edited 28 Apr '11, 14:06

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 07 Apr '11, 23:32

question was seen: 3,330 times

last updated: 29 Apr '11, 22:03

p​o​w​e​r​e​d by O​S​Q​A