Hey, I made a Dissector using LUA and I want to use an information that was available two packets before , is there a way to store data with the number of the frame to use later. I heard that it is done using "conversations" but i never saw a working example so I can do the same, or is there some way other than storing data in a session , maybe a way to retrieve data in a previous packet. Thanks alot asked 13 Oct '17, 00:02  webtuto |
This is a static archive of our old Q&A Site.
Please post any new questions and answers at ask.wireshark.org.
There are several questions dealing with this subject here. You can create Lua tables (arrays) indexed by
frame.numberfield or by some other unique identifiers available in the packets of your interest. On top of the quite obvious requirement that these tables must not be local to the dissector function, you have to deal with the fact that a dissector is called several times for the same packet, and that only the very first pass is sequential.