3 <title>Lua Support in Wireshark</title>
4 <section id="wsluarm_intro">
5 <title>Introduction</title>
7 Wireshark has an embedded Lua interpreter. Lua is a powerful light-weight
8 programming language designed for extending applications. Lua is designed
9 and implemented by a team at PUC-Rio, the Pontifical Catholic University
10 of Rio de Janeiro in Brazil. Lua was born and raised at Tecgraf, the
11 Computer Graphics Technology Group of PUC-Rio, and is now housed at Lua.org.
12 Both Tecgraf and Lua.org are laboratories of the Department of Computer Science.
15 In Wireshark Lua can be used to write dissectors and taps.
18 Wireshark's Lua interpreter starts by loading <command>init.lua</command> that
19 is located in the global configuration directory of Wireshark.
20 Lua is disabled by default by setting the variable <command>disable_lua</command>
21 to true in <command>init.lua</command>. To enable lua the line that sets that variable
22 must be removed or commented out.
25 After loading <command>init.lua</command> from the data directory if lua is enabled
26 Wireshark will try to load a file named <command>init.lua</command> in the user's
30 The command line option <command>-X lua_script:<file.lua></command> can be used to
31 load lua scripts as well.
34 The Lua code will be executed once after all the protocols have being initialized and before reading
38 <section id="wslua_dissector_example">
39 <title>Example of Dissector written in Lua</title>
42 local p_multi = Proto("multi","MultiProto");
54 local f_proto = ProtoField.uint8("multi.protocol","Protocol",base.DEC,vs_protos)
55 local f_dir = ProtoField.uint8("multi.direction","Direction",base.DEC,{ [1] = "incoming", [0] = "outgoing"})
56 local f_text = ProtoField.string("multi.text","Text")
58 p_multi.fields = { f_proto, f_dir, f_text }
60 local data_dis = Dissector.get("data")
63 [2] = Dissector.get("mtp2"),
64 [3] = Dissector.get("mtp3"),
65 [4] = Dissector.get("alcap"),
66 [5] = Dissector.get("h248"),
67 [6] = Dissector.get("ranap"),
68 [7] = Dissector.get("rnsap"),
69 [8] = Dissector.get("nbap"),
70 [9] = Dissector.get("rrc"),
71 [10] = DissectorTable.get("sctp.ppi"):get_dissector(3), -- m3ua
72 [11] = DissectorTable.get("ip.proto"):get_dissector(132), -- sctp
75 function p_multi.dissector(buf,pkt,root)
77 local t = root:add(p_multi,buf(0,2))
78 t:add(f_proto,buf(0,1))
81 local proto_id = buf(0,1):uint()
83 local dissector = protos[proto_id]
85 if dissector ~= nil then
86 dissector:call(buf(2):tvb(),pkt,root)
87 elseif proto_id < 2 then
89 -- pkt.cols.info:set(buf(2,buf:len() - 3):string())
91 data_dis:call(buf(2):tvb(),pkt,root)
96 local wtap_encap_table = DissectorTable.get("wtap_encap")
97 local udp_encap_table = DissectorTable.get("udp.port")
99 wtap_encap_table:add(wtap.USER15,p_multi)
100 wtap_encap_table:add(wtap.USER12,p_multi)
101 udp_encap_table:add(7555,p_multi)
105 <section id="wslua_tap_example">
106 <title>Example of Listener written in Lua</title>
108 -- This program will register a menu that will open a window with a count of occurrences
109 -- of every address in the capture
112 local function menuable_tap()
113 -- Declare the window we will use
114 local tw = TextWindow.new("Address Counter")
116 -- This will contain a hash of counters of appereances of a certain address
120 local tap = Listener.new();
123 -- this way we remove the listener than otherwise will remain running indifinitelly
127 -- we tell the window to call the remove() function when closed
128 tw:set_atclose(remove)
130 -- this function will be called once for each packet
131 function tap.packet(pinfo,tvb)
132 local src = ips[tostring(pinfo.src)] or 0
133 local dst = ips[tostring(pinfo.dst)] or 0
135 ips[tostring(pinfo.src)] = src + 1
136 ips[tostring(pinfo.dst)] = dst + 1
139 -- this function will be called once every few seconds to update our window
142 for ip,num in pairs(ips) do
143 tw:append(ip .. "\t" .. num .. "\n");
147 -- this function will be called whenever a reset is needed
148 -- e.g. when reloading the capture file
155 -- using this function we register our fuction
156 -- to be called when the user selects the Tools->Test->Packets menu
157 register_menu("Test/Packets",menuable_tap)
161 <section id="wsluarm_modules">
162 <title>Wireshark's Lua API Reference Manual</title>
164 This Part of the User Guide describes the Wireshark specific functions in the embedded Lua.