This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have a bunch of dissectors I wrote in Lua, which I used in the Wireshark GUI so far - now I want to use them with tshark (under Windows 10). The problem is that one of my dissectors does not work when invoked in tshark (even though it gets initialized). tshark does not output any packets at all, even though all other dissectors are working fine. I am calling the dissector from one of my other dissectors with

[...]
info("calling dissector")
getDissector("myproto"):call(payload_tvb, packet_info, tree)

while the dissector itself looks like:

function myproto.init()
    info("Initialization of myproto dissector")
end
function myproto.dissector(buffer, packet_info, tree)
    info("dissector successfully called")
    [...]
end

Nothing special, actually. From the log, I can see that the dissector gets initialized. But when I open a .pcapng file with tshark, then the log message "dissector successfully called" never gets printed, while in the Wireshark GUI, it does.

I am not seeing any error message, so I have no clue what the issue might be. The getDissector function call does not return nil, I checked that. The lua files are placed in my AppData\Roaming\Wireshark\plugins directory, and tshark does not seem to have a problem finding them there. Does anybody have an idea what might be wrong with this dissector? Any help is appreciated, thanks in advance.

asked 08 Mar '17, 05:29

patrick_oppermann's gravatar image

patrick_oppe...
466611
accept rate: 0%

Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×637
×431

question asked: 08 Mar '17, 05:29

question was seen: 959 times

last updated: 08 Mar '17, 05:29

p​o​w​e​r​e​d by O​S​Q​A