Hello, I'm trying to modify RTP dissector table with Lua. When I create a Lua script like below and run it either from plugins directory or the command line it doesn't work, and I can see via
However, when I enter the same code via the evaluate window and reload the pcap file, it works as expected. This leads me to think that startup Lua code is executed before the other protocol adds itself to the same table, effectively being overwritten. Am I right and, if yes, is there a way in which I can control that order? By maybe somehow putting that Lua code in a function and running it when all dissectors and protocols have been fully loaded? Thanks asked 11 Jan '12, 09:07 izopizo edited 11 Jan '12, 10:06 multipleinte... |
2 Answers:
AMR preferencesAs @Anders pointed out, the problem is due to your preference for "AMR dynamic payload type" conflicting with your dissector registration. Set that preference to Initialization orderActually, the dissectors are not loaded randomly. Wireshark loads the C dissectors and then the Lua scripts, each of which is always loaded in the same order. Note that preferences are read last during initialization, which is the reason the AMR preference took effect over your Lua dissector. The Then, Lua scripts (which can contain dissectors) are also loaded in ascending ASCII order as follows:
The path variables above can be determined in Wireshark (
Control of initialization orderYou can't change the initialization order of the C dissectors unless you modify the code. However, you do have control of Lua script loading, but it requires you to make changes to prevent the scripts from being auto-loaded:
Example: Let's say I had this directory structure:
...which has a load order of
Assume the contents of each Lua script contains:
which prints the absolute path to the running script. Now, if I start Wireshark or TShark, I should see the load order from the command line, like so:
answered 14 Jan ‘12, 10:42 helloworld edited 14 Jan ‘12, 10:42 |
Dissectors are loaded in a random order, and there is nothing you can do to control the specific order in which they are loaded. What you could do in stead is to disable the AMR protocol in The reason it works in the evaluate window is because all of the protocols are already registered at that point, so your dissector will be the last on to overwrite that table entry. answered 11 Jan '12, 10:03 multipleinte... |
You can set the PT preference for AMR to 0