decode as feature set up before start a cap

Question

Hi all, is it possible to set up a capture filter in wireshark for the decode as feature just like tshark -d option i.e. -d udp.port==8000,rudp, before to start capture ?

Answer 1

You could do that using lua

In your c:program filesWireshark directory find init.lua file.

Comment out disable_lua line and at the end of the file add dofile("decodes.lua"). Then create a file in the same directory called decodes.lua

Edit it to have contents like below

do
    local rudp_dissector=Dissector.get("rudp")
    local udp_table=DissectorTable.get("udp.port")
    udp_table:add(8000, rudp_dissector)
end

Now each time you start wireshark traffic on 8000 port will be decoded as rudp

Instead of having it as permanent solution you can use command line option -Xlua_script:./decodes.lua when starting wireshark.

Answer 2

Currently this is not possible, but there has been interest in having this feature available. See bugs 2931 and 5143 in particular. Perhaps someone will implement this one day.