11.10. Functions for writing dissectors

Wireshark

previous page next page

11.10. Functions for writing dissectors

11.10.1. Dissector

A refererence to a dissector, used to call a dissector against a packet or a part of it.

11.10.1.1. Dissector.get(name)

Obtains a dissector reference by name

11.10.1.1.1. Arguments

name: The name of the dissector

11.10.1.1.2. Returns

The Dissector reference

11.10.1.2. dissector:call(tvb, pinfo, tree)

Calls a dissector against a given packet (or part of it)

11.10.1.2.1. Arguments

tvb: The buffer to dissect
pinfo: The packet info
tree: The tree on which to add the protocol items

11.10.1.3. dissector:__tostring()

Gets the Dissector's protocol short name

11.10.1.3.1. Returns

A string of the protocol's short name

11.10.2. DissectorTable

A table of subdissectors of a particular protocol (e.g. TCP subdissectors like http, smtp, sip are added to table "tcp.port"). Useful to add more dissectors to a table so that they appear in the Decode As... dialog.

11.10.2.1. DissectorTable.new(tablename, [uiname], [type], [base])

Creates a new DissectorTable for your dissector's use.

11.10.2.1.1. Arguments

tablename: The short name of the table.
uiname (optional): The name of the table in the User Interface (defaults to the name given).
type (optional): Either ftypes.UINT{8,16,24,32} or ftypes.STRING (defaults to ftypes.UINT32)
base (optional): Either base.NONE, base.DEC, base.HEX, base.OCT, base.DEC_HEX or base.HEX_DEC (defaults to base.DEC)

11.10.2.1.2. Returns

The newly created DissectorTable

11.10.2.2. DissectorTable.get(tablename)

Obtain a reference to an existing dissector table.

11.10.2.2.1. Arguments

tablename: The short name of the table.

11.10.2.2.2. Returns

The DissectorTable

11.10.2.3. dissectortable:add(pattern, dissector)

Add a dissector to a table.

11.10.2.3.1. Arguments

pattern: The pattern to match (either an integer or a string depending on the table's type).
dissector: The dissector to add (either an Proto or a Dissector).

11.10.2.4. dissectortable:remove(pattern, dissector)

Remove a dissector from a table

11.10.2.4.1. Arguments

pattern: The pattern to match (either an integer or a string depending on the table's type).
dissector: The dissector to add (either an Proto or a Dissector).

11.10.2.5. dissectortable:try(pattern, tvb, pinfo, tree)

Try to call a dissector from a table

11.10.2.5.1. Arguments

pattern: The pattern to be matched (either an integer or a string depending on the table's type).
tvb: The buffer to dissect
pinfo: The packet info
tree: The tree on which to add the protocol items

11.10.2.6. dissectortable:get_dissector(pattern)

Try to obtain a dissector from a table.

11.10.2.6.1. Arguments

pattern: The pattern to be matched (either an integer or a string depending on the table's type).

11.10.2.6.2. Returns

The dissector handle if found

nil if not found

11.10.2.7. dissectortable:__tostring()

Gets some debug information about the DissectorTable

11.10.2.7.1. Returns

A string of debug information about the DissectorTable

11.10.3. Pref

A preference of a Protocol.

11.10.3.1. Pref.bool(label, default, descr)

Creates a boolean preference to be added to a Protocol's prefs table.

11.10.3.1.1. Arguments

label: The Label (text in the right side of the preference input) for this preference
default: The default value for this preference
descr: A description of what this preference is

11.10.3.2. Pref.uint(label, default, descr)

Creates an (unsigned) integer preference to be added to a Protocol's prefs table.

11.10.3.2.1. Arguments

label: The Label (text in the right side of the preference input) for this preference
default: The default value for this preference
descr: A description of what this preference is

11.10.3.3. Pref.string(label, default, descr)

Creates a string preference to be added to a Protocol's prefs table.

11.10.3.3.1. Arguments

label: The Label (text in the right side of the preference input) for this preference
default: The default value for this preference
descr: A description of what this preference is

11.10.3.4. Pref.enum(label, default, descr, enum, radio)

Creates an enum preference to be added to a Protocol's prefs table.

11.10.3.4.1. Arguments

label: The Label (text in the right side of the preference input) for this preference
default: The default value for this preference
descr: A description of what this preference is
enum: A enum table
radio: Radio button (true) or Combobox (false)

11.10.3.5. Pref.range(label, default, descr, max)

Creates a range preference to be added to a Protocol's prefs table.

11.10.3.5.1. Arguments

label: The Label (text in the right side of the preference input) for this preference
default: The default value for this preference, e.g., "53", "10-30", or "10-30,53,55,100-120"
descr: A description of what this preference is
max: The maximum value

11.10.3.6. Pref.statictext(label, descr)

Creates a static text preference to be added to a Protocol's prefs table.

11.10.3.6.1. Arguments

label: The static text
descr: The static text description

11.10.4. Prefs

The table of preferences of a protocol

11.10.4.1. prefs:__newindex(name, pref)

Creates a new preference

11.10.4.1.1. Arguments

name: The abbreviation of this preference
pref: A valid but still unassigned Pref object

11.10.4.1.2. Errors

Unknow Pref type

11.10.4.2. prefs:__index(name)

Get the value of a preference setting

11.10.4.2.1. Arguments

name: The abbreviation of this preference

11.10.4.2.2. Returns

The current value of the preference

11.10.4.2.3. Errors

Unknow Pref type

11.10.5. Proto

A new protocol in wireshark. Protocols have more uses, the main one is to dissect a protocol. But they can be just dummies used to register preferences for other purposes.

11.10.5.1. Proto.new(name, desc)

11.10.5.1.1. Arguments

name: The name of the protocol
desc: A Long Text description of the protocol (usually lowercase)

11.10.5.1.2. Returns

The newly created protocol

11.10.5.2. proto.dissector

The protocol's dissector, a function you define. The called dissector function will be given three arguments of (1) a Tvb object, (2) a Pinfo object, and (3) a TreeItem object.

11.10.5.3. proto.fields

The Fields Table of this dissector

11.10.5.4. proto.prefs

The preferences of this dissector

11.10.5.5. proto.init

The init routine of this dissector, a function you define. The called init function is passed no arguments.

11.10.5.6. proto.name

The name given to this dissector

11.10.5.7. proto.description

The description given to this dissector

11.10.6. ProtoField

A Protocol field (to be used when adding items to the dissection tree)

11.10.6.1. ProtoField.new(name, abbr, type, [voidstring], [base], [mask], [descr])

Creates a new field to be used in a protocol.

11.10.6.1.1. Arguments

name: Actual name of the field (the string that appears in the tree).
abbr: Filter name of the field (the string that is used in filters).
type: Field Type: one of ftypes.NONE, ftypes.PROTOCOL, ftypes.BOOLEAN, ftypes.UINT8, ftypes.UINT16, ftypes.UINT24, ftypes.UINT32, ftypes.UINT64, ftypes.INT8, ftypes.INT16 ftypes.INT24, ftypes.INT32, ftypes.INT64, ftypes.FLOAT, ftypes.DOUBLE, ftypes.ABSOLUTE_TIME ftypes.RELATIVE_TIME, ftypes.STRING, ftypes.STRINGZ, ftypes.UINT_STRING, ftypes.ETHER, ftypes.BYTES ftypes.UINT_BYTES, ftypes.IPv4, ftypes.IPv6, ftypes.IPXNET, ftypes.FRAMENUM, ftypes.PCRE, ftypes.GUID ftypes.OID, ftypes.EUI64
voidstring (optional): A VoidString object.
base (optional): The representation: one of base.NONE, base.DEC, base.HEX, base.OCT, base.DEC_HEX, base.HEX_DEC
mask (optional): The bitmask to be used.
descr (optional): The description of the field.

11.10.6.1.2. Returns

The newly created ProtoField object