This is our old Q&A Site. Please post any new questions and answers at


i am currently writing a dissector with lua which use data from UDP AND TCP. So i register the dissector like this

udp_table = DissectorTable.get("udp.port")
udp_table:add(1024, SEL)
tcp_table = DissectorTable.get("tcp.port")
tcp_table:add(1024, SEL)

but in the function SEL.dissector(_tvbuf, _pktinfo, _root), i need to know if this if data is coming from UDP or TCP.

Is there a way to detect UDP ou TCP data ?


asked 26 Apr '17, 12:28

SebastienRolle's gravatar image

accept rate: 0%

edited 26 Apr '17, 17:07

Yes, there is. Create the SEL_udp and SEL_tcp functions to register with the respective protocols and have them call SEL with an extra flag indicating the protocol it came from. This is how it's done in other dissectors as well.

permanent link

answered 26 Apr '17, 23:48

Jaap's gravatar image

Jaap ♦
accept rate: 14%

Thank a lot. Can you point me to an existing dissector in order for me to understand.

Thank, Sebastien

(27 Apr '17, 05:36) SebastienRolle

i have done this but unfortunately, it doesn't work. Can you give me a little more details about the proposed solution.

local SEL = Proto("sel", "sel");

function aa(_tvbuf, _pktinfo, _root)
function bb(_tvbuf, _pktinfo, _root)
function SEL.dissector(_tvbuf, _pktinfo, _root)

(27 Apr '17, 10:59) SebastienRolle

I don't do LUA myself, but recon it would be something like this:

local SEL_udp = Proto("sel_udp", "sel_udp")
udp_table = DissectorTable.get("udp.port")
udp_table:add(1024, SEL_udp)
local SEL_tcp = Proto("sel_tcp", "sel_tcp")
tcp_table = DissectorTable.get("tcp.port")
tcp_table:add(1024, SEL_tcp)

function SEL_udp(_tvb, _pktinfo, _root)
    SEL(_tvbuf, _pktinfo, _root, FALSE)
function SEL_tcp(_tvb, _pktinfo, _root)
    SEL(_tvbuf, _pktinfo, _root, TRUE)
function SEL(_tvb, _pktinfo, _root, is_tcp)

If you don't want to have the separate dissector registrations (one for UDP, one for TCP) you might also be able to look at pktinfo. In that structure you should have a ptype field, which indicates the (transport) protocol as well.

(28 Apr '17, 01:39) Jaap ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 26 Apr '17, 12:28

question was seen: 1,609 times

last updated: 28 Apr '17, 01:39

p​o​w​e​r​e​d by O​S​Q​A