This is a static archive of our old Q&A Site. Please post any new questions and answers at

How do .lua files get input from wireshark?


I have a .lua script that has GUI dependencies that I would like to remove. In other words, the .lua script makes calls to functions such as,, etc.

I want to either remove GUI altogether or automate the GUI in some way.

Are there non-GUI alternatives to passing in pcap files to a lua script and processing the file without using,, and

or is there a way I can have my .lua script open the gui and then execute on the newly opened gui?

Ideally I would never have to open wireshark to run my .lua script.

Thanks for the help

asked 16 Feb '16, 17:35

testname0110's gravatar image

accept rate: 75%

2 Answers:


I figured it out. To input a pcap file to a lua script you do the following:

"tshark -X lua_script:file.lua -r file.pcap -o rtp.heuristic_rtp -w out"

the -w out keeps the terminal from showing stdout, which speeds up the process from 10 minutes to 1ms.

answered 17 Feb '16, 14:20

testname0110's gravatar image

accept rate: 75%

1 and aren't GUI dependencies, it's a Shark dependencies - they should work in TShark as well. is a GUI dependency, and you eliminate it by producing your output in some other fashion, e.g. using Lua's input and output facilities.

answered 16 Feb '16, 18:08

Guy%20Harris's gravatar image

Guy Harris ♦♦
accept rate: 19%

Thanks, that's very helpful. But I still don't understand how, are getting inputs from my pcap file.

(17 Feb '16, 10:32) testname0110

They're getting the inputs because the file is being read by Wireshark or TShark and the Lua interpreter embedded inside Wireshark and TShark is given those objects from Wireshark or TShark.

If you want to be able to access them in a version of Lua that is NOT embedded inside Wireshark or TShark, such as the one in the lua command, that will NOT work.

(17 Feb '16, 10:42) Guy Harris ♦♦

Ok I got it. I was piping the input pcap file incorrectly, but thanks for the help!

(17 Feb '16, 14:22) testname0110