This is our old Q&A Site. Please post any new questions and answers at

How it is possible to create a "Custom" column which refers to an arbitrary offset in UDP payload. For example, in "Filter definition" it is possible to reffer to the 1st byte in UDP payload as udp[8]. Such simple approach seems to be blocked in Packet Display Plain. What am I missing?

asked 26 Oct '11, 07:18

exbungee's gravatar image

accept rate: 0%

edited 26 Oct '11, 07:37

This is (currently) not possible with Wireshark, although you might be able to do this with the Lua scripting engine that is part of Wireshark.

permanent link

answered 08 Nov '11, 03:07

SYN-bit's gravatar image

SYN-bit ♦♦
accept rate: 20%

edited 08 Nov '11, 06:00

helloworld's gravatar image


Thanks. Is it possible to add an example. Please assume that the documented method to add LUA file is known.

(09 Nov '11, 12:04) exbungee

is it still not possible?

(29 Jan '14, 03:35) Daniil Kharkov

"use the Code, Luk"
add the Custom "" column in Preferences/Columns and tweak protocol port and byte offset in Preferences/Protocol/UDP_DUMP. Upvote! =)

        local udp_dumper_proto = Proto("udp_dump", "UDP dumper");

        udp_dumper_proto.prefs.ofs = Pref.uint( "udp_dump_ofs", 1, "UDP data byte offset" )
        udp_dumper_proto.prefs.port   = Pref.uint( "udp_dump_port", 53, "UDP port" )

        udp_dumper_proto.fields.dump   = ProtoField.uint8("", "a dump of byte", base.HEX)

        local prev_proto
        local f_udp    ="udp")

        function udp_dumper_proto.dissector(tvb, pinfo, tree)
            pcall(function()prev_proto:call(tvb, pinfo, tree)end)

            if not f_udp() then return end

            local ofs = udp_dumper_proto.prefs.ofs -- udp_dumper_proto.prefs.filter
            if (tvb:len() < ofs) then return end

            -- this is just to add text to "" field, 
            -- which you should display as column.
            -- as an alternate, you may remove set_hidden() and view selected data in the treeview
            tree:add(udp_dumper_proto.fields.dump, tvb(ofs,1)):set_hidden();

        -- if we hook upon UDP port, then offset will mean the beginning of the UDP data
        udp_table = DissectorTable.get("udp.port")
        prev_proto = udp_table:get_dissector(udp_dumper_proto.prefs.port)
        udp_table:add(udp_dumper_proto.prefs.port, udp_dumper_proto)

        -- if we hook as post dissector, the offset will be from start of the frame. 
        -- don't forget to remove the prev_proto call if you'll use that kind of hook
--        register_postdissector(udp_dumper_proto)
permanent link

answered 09 Nov '11, 18:06

ShomeaX's gravatar image

accept rate: 0%

edited 09 Nov '11, 18:08

Short and cool! Really thanks! Just for clarity: on my WS (Rel 1.7.xx) it creates the following stack Protocols in frame: eth:vlan:ip:udp:udp_dump:dns I expected "udp_dump" to be the last item on the stack. Any way to get rid of "dns"?

(10 Nov '11, 02:16) exbungee
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 26 Oct '11, 07:18

question was seen: 6,932 times

last updated: 29 Jan '14, 03:39

p​o​w​e​r​e​d by O​S​Q​A