Filtering packets in LUA

Have you looked at the Lua postdissectors?

In the "Trivial" example provided, if you try to use pinfo.curr_proto, you will get "Trivial", which isn't what you want I don't think, but you should be able to use frame.protocols to determine which protocols are present in the frame. If you add/replace these lines to the postdissector example given, you can see what I mean:

 7 frame_protocols_f = Field.new("frame.protocols")
13 protocols_F = ProtoField.string("trivial.protocols", "Protocols")
14 trivial_proto.fields = {src_F, dst_F, conv_F, protocols_F}
22     local protocols = frame_protocols_f()
30         subtree:add(protocols_F,tostring(protocols))

When I ran it, it displayed something like this:

Source: 192.168.1.1:12345
Destination: 192.168.1.2:45678
Conversation: 192.168.1.1:12345->192.168.1.2:45678
Protocols: eth:ethertype:ip:tcp

If you're only interested in the last protocol in the stack, tcp in this case, then you can write a function (or search for one) to trim all characters up to and including the ':' from the string.