This is a static archive of our old Q&A Site. Please post any new questions and answers at

Lua dissector organization


In the "Enabled Protocols" dialog some protocols have trees of sub-protocols. How is this organization defined, specifically when writing a protocol dissector in Lua?

For example, I have dissectors defined in this way in %APPDATA%\Wireshark\plugins:

  • myproto.lua: MyProto
  • myprotomsg1.lua: MyProtoMsg1
  • myprotomsg2.lua: MyProtoMsg2

MyProto adds itself in to wtap_encap in USER0 and creates a DissectorTable "myprotomsgs", and each subdissector adds itself to that table.

When I go to the Enabled Protocols dialog, I see:

  • MyProto
  • MyProtoMsg1
  • MyProtoMsg2

when I expect to see

  • MyProto
  •      MyProtoMsg1
  •      MyProtoMsg2

Is this possible using Lua?

asked 04 Feb '16, 13:34

mmaranski's gravatar image

accept rate: 0%

edited 05 Feb '16, 08:09