This is a static archive of our old Q&A Site. Please post any new questions and answers at

dissector with several ppi



I have lua script which decode pcap files. This script uses dissector table "sctp.ppi". But now I understand that I should decode more then one type of ppi (not only M3UA (sctp.ppi=3) but at the same time M2PA (sctp.ppi=5)). Here is the part of the code:

local sctp_tbl = DissectorTable.get("sctp.ppi")
sctp_dissector = sctp_tbl:get_dissector(3) (variable is defined previously)
sctp_tbl:set (3,proxy) --proxy - it is my own protocol by which I will replace the original protocol "M3UA"

Could you please give an advise how can i do it. I tryed the following:

local sctp_tbl = DissectorTable.get("sctp.ppi")
sctp_dissector = sctp_tbl:get_dissector(3)
sctp_dissector = sctp_tbl:get_dissector(5)
sctp_tbl:set (3,proxy)
sctp_tbl:set (5,proxy)

But it does not work correctly. this part of code works for sctp.ppi=5 and does not work for sctp.ppi=3.

Any help is appreciated

asked 12 Aug '16, 05:41

domeno's gravatar image

accept rate: 0%

One Answer:

  1. it is not sctp_tbl:set but sctp_tbl:add (see the Lua API Wiki). The name is slightly misleading as if a row with the same index value already exists in the dissector table, it is replaced by the "added" one.
  2. I'm not sure what do you want to achieve by overwriting the contents of sctp_dissector by the second sctp_tbl:get. If you want to store the handle to the original dissector, you have to use two distinct variables as theoretically, different original dissectors may be used for PPI == 5 and PPI == 3.

answered 12 Aug '16, 06:08

sindy's gravatar image

accept rate: 24%

edited 12 Aug '16, 06:10

Thanks for your answer. But I would like to have one dissector for two PPIs (for sctp.ppi==3 and sctp.ppi==5). I think that I create one dissector and add two PPIs by the following commands:

local sctp_tbl = DissectorTable.get("sctp.ppi")
sctp_dissector = sctp_tbl:get_dissector(3)
sctp_tbl:add (5,sctp_dissector)

As with GSM_MAP. In GSM_MAP I do the following:

local sccp_tbl = DissectorTable.get("sccp.ssn")
tcap_dissector = sccp_tbl:get_dissector(9)
sccp_tbl:set ("6-9",proxy)

And I thought that that the same commands will help me to solve the problem with sccp.ppi

Can you give me some advice?

(16 Aug '16, 04:51) domeno

Sure you can add the same dissector to as many PPIs as you want. My original Answer suggested that. I only did not understand why you were saving the link to original dissector for ppi == 3 and for ppi == 5 into the same variable, as you were effectively storing only the second one, overwriting the link to the first one with the new one.

So the complete code would be:

local sctp_tbl = DissectorTable.get("sctp.ppi")
orig_sctp dissector_for_3 = sctp_tbl:get_dissector(3)
orig_sctp_dissector_for_5 = sctp_tbl:get_dissector(5)

(or you might also use a table for the links to the original dissectors if you prefer that).

And back then I haven't found the DissectorTable:set method in the doc, but it seems to be present there. So maybe there is an issue with :set when there is no dissector for the value of index which you are replacing? I know for sure that :add(index,new_dissector) replaces the existing dissector for index if it exists (which is what :set is expected to do) or adds it if no dissector existed for index before. For the same index, there is always just one dissector in the table. If you want/need to chain them, you have to do it algorithmically, which is the reason for storing the links to the original ones.

(16 Aug '16, 05:06) sindy

Thanks for your comments. They are very helpful for me. But there is only one problem: in my lua script I parse pcap file with the tshark and lua. I have my own protocol "proxy" by which I replace the original protocol and inside the proxy dissector (new protocol) I use the created original dissector (in my case it was "tcap_dissector"):

function proxy.dissector(tvbuf,pinfo,root)

local num_vlan_id_field = vlan_id()

But if I create more then two dissectors then I will have to call the parsing od the file two times: first by "orig_sctp dissector_for_3" and sercondly by "orig_sctp dissector_for_5". It is not suitable for me. Or I can create an if statement in lua script to choose what dissector to use according to the value in specific field?

Friendly speaking I am beginner in lua script and dissectors then It will be great if you give me some advices to solve problem with two dissectors and one time analyze the pcap file.

(16 Aug '16, 05:49) domeno

Of course you can use if in Lua to choose the necessary original dissector. The point is how to convey the information about which one to use. To do that, you would either need to refer to the sctp.ppi field from within your dissector and use the value to choose the right original dissector, or you would have to register two individual dissector functions proxy_3 and proxy_5, which may be just thin wrappers calling a common code with an additional parameter (3 or 5). I cannot see any clear advantage of any of these two methods. In a single Lua script you can create as many dissector functions as you want, i.e. you don't need to split your code into several files.

(16 Aug '16, 05:58) sindy

First of all thank you for your help. I used "if" statement in Lua script and now I use different dissectors according to the value of the field sctp.ppi (or in wireshark sctp.data_payload_proto_id).

But for the future purpose I want to know is there a method to use dissector for any value of the "sctp.ppi"? It is not comfortable to create N dissectors for N different values of sctp.ppi.

(17 Aug '16, 03:35) domeno

I'm not sure I get you right. So now you have a single dissector function, registered for both ppi == 3 and ppi == 5, and this single function first fetches the contents of sctp.data_payload_proto_id and then, based on that value, it chooses the right part of its code using if?

Because your next question suggests that your problem is not that you need to create many dissector functions but that you have to register a dissector function individually for each ppi value into the dissection table. If this is a correct understanding, then the only answer is that the DissectorTable:set should support ranges according to the documentation, but I have never tested it myself. The table as such does not support ranges: if you eventually succeed with a :set of a range from 5 to 7, you'll end up with three individual rows in the table.

(17 Aug '16, 03:49) sindy

Unfortunately the solution with using :set was unsuccessful. In my case it does not work for dissector table "sctp.ppi". I decided to create all dissectors for any value of sctp.ppi and create long "if" statement to choose what dissector to use according to the value of the field.

Thank for your help!

(18 Aug '16, 07:44) domeno
showing 5 of 7 show 2 more comments