This is our old Q&A Site. Please post any new questions and answers at


I am writing a dissection script for wireshark and I should point the replies/ack for specific packets. As a first implementation I create an array and write down the request ID and when a reply arrives checks if it's ID is part of this table. I would like to print an arrow (just like ping request reply) to point out the request and reply.

alt text

asked 29 Jun '17, 03:27

cyberrobot's gravatar image

accept rate: 0%

In Lua you can add two ProtoField's (one for request and one for response) for this and use frametype.REQUEST / frametype.RESPONSE as valuestring. You will get the arrows when using this fields.

Have a look in the ProtoField documentation.

permanent link

answered 08 Jul '17, 11:44

stig's gravatar image

stig ♦
accept rate: 0%

Thanks for the reply, hyperlink with framenum worked for me. Is there any elegant way to match two packets with the same sequence number?

(10 Jul '17, 05:12) cyberrobot

I think you have to make sure to register the fields appropriately

From the ICMP dissector:

             {"Response frame", "icmp.resp_in", FT_FRAMENUM, BASE_NONE,
              "The frame number of the corresponding response",

             {"Request frame", "icmp.resp_to", FT_FRAMENUM, BASE_NONE,
              "The frame number of the corresponding request", HFILL}},

I don't know if this can be done from LUA already.

permanent link

answered 29 Jun '17, 03:53

Jaap's gravatar image

Jaap ♦
accept rate: 14%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 29 Jun '17, 03:27

question was seen: 1,497 times

last updated: 10 Jul '17, 05:12

p​o​w​e​r​e​d by O​S​Q​A