11.10. Functions for new protocols and dissectors

The classes and functions in this chapter allow Lua scripts to create new protocols for Wireshark. Proto protocol objects can have Pref preferences, ProtoField fields for filterable values that can be displayed in a details view tree, functions for dissecting the new protocol, and so on.

The dissection function can be hooked into existing protocol tables through DissectorTables so that the new protocol dissector function gets called by that protocol, and the new dissector can itself call on other, already existing protocol dissectors by retrieving and calling the Dissector object. A Proto dissector can also be used as a post-dissector, at the end of every frame's dissection, or as a heuristic dissector.

11.10.1. Dissector

A refererence to a dissector, used to call a dissector against a packet or a part of it.

11.10.1.1. Dissector.get(name)

Obtains a dissector reference by name.

11.10.1.1.1. Arguments
name

The name of the dissector.

11.10.1.1.2. Returns

The Dissector reference.

11.10.1.2. Dissector.list()

Gets a Lua array table of all registered Dissector names.

[Note]Note

this is an expensive operation, and should only be used for troubleshooting.

Since: 1.11.3

11.10.1.2.1. Returns

The array table of registered dissector names.

11.10.1.3. dissector:call(tvb, pinfo, tree)

Calls a dissector against a given packet (or part of it).

11.10.1.3.1. Arguments
tvb

The buffer to dissect.

pinfo

The packet info.

tree

The tree on which to add the protocol items.

11.10.1.4. dissector:__call(tvb, pinfo, tree)

Calls a dissector against a given packet (or part of it).

11.10.1.4.1. Arguments
tvb

The buffer to dissect.

pinfo

The packet info.

tree

The tree on which to add the protocol items.

11.10.1.5. dissector:__tostring()

Gets the Dissector's protocol short name.

11.10.1.5.1. Returns

A string of the protocol's short name.

11.10.2. DissectorTable

A table of subdissectors of a particular protocol (e.g. TCP subdissectors like http, smtp, sip are added to table "tcp.port").

Useful to add more dissectors to a table so that they appear in the Decode As... dialog.

11.10.2.1. DissectorTable.new(tablename, [uiname], [type], [base])

Creates a new DissectorTable for your dissector's use.

11.10.2.1.1. Arguments
tablename

The short name of the table.

uiname (optional)

The name of the table in the User Interface (defaults to the name given).

type (optional)

Either ftypes.UINT8, ftypes.UINT16, ftypes.UINT24, ftypes.UINT32, or ftypes.STRING (defaults to ftypes.UINT32).

base (optional)

Either base.NONE, base.DEC, base.HEX, base.OCT, base.DEC_HEX or base.HEX_DEC (defaults to base.DEC).

11.10.2.1.2. Returns

The newly created DissectorTable.

11.10.2.2. DissectorTable.list()

Gets a Lua array table of all DissectorTable names - i.e., the string names you can use for the first argument to DissectorTable.get().

[Note]Note

this is an expensive operation, and should only be used for troubleshooting.

Since: 1.11.3

11.10.2.2.1. Returns

The array table of registered DissectorTable names.

11.10.2.3. DissectorTable.heuristic_list()

Gets a Lua array table of all heuristic list names - i.e., the string names you can use for the first argument in Proto:register_heuristic().

[Note]Note

this is an expensive operation, and should only be used for troubleshooting.

Since: 1.11.3

11.10.2.3.1. Returns

The array table of registered heuristic list names

11.10.2.4. DissectorTable.get(tablename)

Obtain a reference to an existing dissector table.

11.10.2.4.1. Arguments
tablename

The short name of the table.

11.10.2.4.2. Returns

The DissectorTable.

11.10.2.5. dissectortable:add(pattern, dissector)

Add a Proto with a dissector function, or a Dissector object, to the dissector table.

11.10.2.5.1. Arguments
pattern

The pattern to match (either an integer, a integer range or a string depending on the table's type).

dissector

The dissector to add (either a Proto or a Dissector).

11.10.2.6. dissectortable:set(pattern, dissector)

Remove existing dissectors from a table and add a new or a range of new dissectors.

Since: 1.11.3

11.10.2.6.1. Arguments
pattern

The pattern to match (either an integer, a integer range or a string depending on the table's type).

dissector

The dissector to add (either a Proto or a Dissector).

11.10.2.7. dissectortable:remove(pattern, dissector)

Remove a dissector or a range of dissectors from a table

11.10.2.7.1. Arguments
pattern

The pattern to match (either an integer, a integer range or a string depending on the table's type).

dissector

The dissector to remove (either a Proto or a Dissector).

11.10.2.8. dissectortable:remove_all(dissector)

Remove all dissectors from a table.

Since: 1.11.3

11.10.2.8.1. Arguments
dissector

The dissector to remove (either a Proto or a Dissector).

11.10.2.9. dissectortable:try(pattern, tvb, pinfo, tree)

Try to call a dissector from a table

11.10.2.9.1. Arguments
pattern

The pattern to be matched (either an integer or a string depending on the table's type).

tvb

The buffer to dissect.

pinfo

The packet info.

tree

The tree on which to add the protocol items.

11.10.2.10. dissectortable:get_dissector(pattern)

Try to obtain a dissector from a table.

11.10.2.10.1. Arguments
pattern

The pattern to be matched (either an integer or a string depending on the table's type).

11.10.2.10.2. Returns

The dissector handle if found.

nil if not found.

11.10.2.11. dissectortable:__tostring()

Gets some debug information about the DissectorTable.

11.10.2.11.1. Returns

A string of debug information about the DissectorTable.

11.10.3. Pref

A preference of a Protocol.

11.10.3.1. Pref.bool(label, default, descr)

Creates a boolean preference to be added to a Proto.prefs Lua table.

11.10.3.1.1. Arguments
label

The Label (text in the right side of the preference input) for this preference.

default

The default value for this preference.

descr

A description of what this preference is.

11.10.3.2. Pref.uint(label, default, descr)

Creates an (unsigned) integer preference to be added to a Proto.prefs Lua table.

11.10.3.2.1. Arguments
label

The Label (text in the right side of the preference input) for this preference.

default

The default value for this preference.

descr

A description of what this preference is.

11.10.3.3. Pref.string(label, default, descr)

Creates a string preference to be added to a Proto.prefs Lua table.

11.10.3.3.1. Arguments
label

The Label (text in the right side of the preference input) for this preference.

default

The default value for this preference.

descr

A description of what this preference is.

11.10.3.4. Pref.enum(label, default, descr, enum, radio)

Creates an enum preference to be added to a Proto.prefs Lua table.

11.10.3.4.1. Arguments
label

The Label (text in the right side of the preference input) for this preference.

default

The default value for this preference.

descr

A description of what this preference is.

enum

An enum Lua table.

radio

Radio button (true) or Combobox (false).

11.10.3.5. Pref.range(label, default, descr, max)

Creates a range preference to be added to a Proto.prefs Lua table.

11.10.3.5.1. Arguments
label

The Label (text in the right side of the preference input) for this preference.

default

The default value for this preference, e.g., "53", "10-30", or "10-30,53,55,100-120".

descr

A description of what this preference is.

max

The maximum value.

11.10.3.6. Pref.statictext(label, descr)

Creates a static text string to be added to a Proto.prefs Lua table.

11.10.3.6.1. Arguments
label

The static text.

descr

The static text description.

11.10.4. Prefs

The table of preferences of a protocol.

11.10.4.1. prefs:__newindex(name, pref)

Creates a new preference.

11.10.4.1.1. Arguments
name

The abbreviation of this preference.

pref

A valid but still unassigned Pref object.

11.10.4.1.2. Errors
  • Unknow Pref type

11.10.4.2. prefs:__index(name)

Get the value of a preference setting.

11.10.4.2.1. Arguments
name

The abbreviation of this preference.

11.10.4.2.2. Returns

The current value of the preference.

11.10.4.2.3. Errors
  • Unknow Pref type

11.10.5. Proto

A new protocol in Wireshark. Protocols have more uses, the main one is to dissect a protocol. But they can also be just dummies used to register preferences for other purposes.

11.10.5.1. Proto.new(name, desc)

11.10.5.1.1. Arguments
name

The name of the protocol.

desc

A Long Text description of the protocol (usually lowercase).

11.10.5.1.2. Returns

The newly created protocol.

11.10.5.2. proto:__call(name, desc)

Creates a Proto object.

11.10.5.2.1. Arguments
name

The name of the protocol.

desc

A Long Text description of the protocol (usually lowercase).

11.10.5.2.2. Returns

The new Proto object.

11.10.5.3. proto:register_heuristic(listname, func)

Registers a heuristic dissector function for this Proto protocol, for the given heuristic list name.

When later called, the passed-in function will be given:

  1. A Tvb object

  2. A Pinfo object

  3. A TreeItem object

The function must return true if the payload is for it, else false.

The function should perform as much verification as possible to ensure the payload is for it, and dissect the packet (including setting TreeItem info and such) only if the payload is for it, before returning true or false.

Since: 1.11.3

11.10.5.3.1. Arguments
listname

The heuristic list name this function is a heuristic for (e.g., "udp" or "infiniband.payload").

func

A Lua function that will be invoked for heuristic dissection.

11.10.5.4. proto.dissector

Mode: Retrieve or assign.

The protocol's dissector, a function you define.

When later called, the function will be given:

  1. A Tvb object

  2. A Pinfo object

  3. A TreeItem object

11.10.5.5. proto.prefs

Mode: Retrieve only.

The preferences of this dissector.

11.10.5.6. proto.prefs_changed

Mode: Assign only.

The preferences changed routine of this dissector, a Lua function you define.

11.10.5.7. proto.init

Mode: Assign only.

The init routine of this dissector, a function you define.

The called init function is passed no arguments.

11.10.5.8. proto.name

Mode: Retrieve only.

The name given to this dissector.

11.10.5.9. proto.description

Mode: Retrieve only.

The description given to this dissector.

11.10.5.10. proto.fields

Mode: Retrieve or assign.

The ProtoFields Lua table of this dissector.

11.10.5.11. proto.experts

Mode: Retrieve or assign.

The expert info Lua table of this Proto.

Since: 1.11.3

11.10.6. ProtoExpert

A Protocol expert info field, to be used when adding items to the dissection tree.

Since: 1.11.3

11.10.6.1. ProtoExpert.new(abbr, text, group, severity)

Creates a new ProtoExpert object to be used for a protocol's expert information notices.

Since: 1.11.3

11.10.6.1.1. Arguments
abbr

Filter name of the expert info field (the string that is used in filters).

text

The default text of the expert field.

group

Expert group type: one of: expert.group.CHECKSUM, expert.group.SEQUENCE, expert.group.RESPONSE_CODE, expert.group.REQUEST_CODE, expert.group.UNDECODED, expert.group.REASSEMBLE, expert.group.MALFORMED, expert.group.DEBUG, expert.group.PROTOCOL, expert.group.SECURITY, or expert.group.COMMENTS_GROUP.

severity

Expert severity type: one of: expert.severity.COMMENT, expert.severity.CHAT, expert.severity.NOTE, expert.severity.WARN, or expert.severity.ERROR.

11.10.6.1.2. Returns

The newly created ProtoExpert object.

11.10.6.2. protoexpert:__tostring()

Returns a string with debugging information about a ProtoExpert object.

Since: 1.11.3

11.10.7. ProtoField

A Protocol field (to be used when adding items to the dissection tree).

11.10.7.1. ProtoField.new(name, abbr, type, [valuestring], [base], [mask], [descr])

Creates a new ProtoField object to be used for a protocol field.

11.10.7.1.1. Arguments
name

Actual name of the field (the string that appears in the tree).

abbr

Filter name of the field (the string that is used in filters).

type

Field Type: one of: ftypes.BOOLEAN, ftypes.UINT8, ftypes.UINT16, ftypes.UINT24, ftypes.UINT32, ftypes.UINT64, ftypes.INT8, ftypes.INT16, ftypes.INT24, ftypes.INT32, ftypes.INT64, ftypes.FLOAT, ftypes.DOUBLE , ftypes.ABSOLUTE_TIME, ftypes.RELATIVE_TIME, ftypes.STRING, ftypes.STRINGZ, ftypes.UINT_STRING, ftypes.ETHER, ftypes.BYTES, ftypes.UINT_BYTES, ftypes.IPv4, ftypes.IPv6, ftypes.IPXNET, ftypes.FRAMENUM, ftypes.PCRE, ftypes.GUID, ftypes.OID, or ftypes.EUI64.

valuestring (optional)

A table containing the text that corresponds to the values.

base (optional)

The representation, one of: base.NONE, base.DEC, base.HEX, base.OCT, base.DEC_HEX, or base.HEX_DEC.

mask (optional)

The bitmask to be used.

descr (optional)

The description of the field.

11.10.7.1.2. Returns

The newly created ProtoField object.

11.10.7.2. ProtoField.uint8(abbr, [name], [base], [valuestring], [mask], [desc])

Creates a ProtoField of an unsigned 8-bit integer (i.e., a byte).

11.10.7.2.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

base (optional)

One of base.DEC, base.HEX or base.OCT.

valuestring (optional)

A table containing the text that corresponds to the values.

mask (optional)

Integer mask of this field.

desc (optional)

Description of the field.

11.10.7.2.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.3. ProtoField.uint16(abbr, [name], [base], [valuestring], [mask], [desc])

Creates a ProtoField of an unsigned 16-bit integer.

11.10.7.3.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

base (optional)

One of base.DEC, base.HEX or base.OCT.

valuestring (optional)

A table containing the text that corresponds to the values.

mask (optional)

Integer mask of this field.

desc (optional)

Description of the field.

11.10.7.3.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.4. ProtoField.uint24(abbr, [name], [base], [valuestring], [mask], [desc])

Creates a ProtoField of an unsigned 24-bit integer.

11.10.7.4.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

base (optional)

One of base.DEC, base.HEX or base.OCT.

valuestring (optional)

A table containing the text that corresponds to the values.

mask (optional)

Integer mask of this field.

desc (optional)

Description of the field.

11.10.7.4.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.5. ProtoField.uint32(abbr, [name], [base], [valuestring], [mask], [desc])

Creates a ProtoField of an unsigned 32-bit integer.

11.10.7.5.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

base (optional)

One of base.DEC, base.HEX or base.OCT.

valuestring (optional)

A table containing the text that corresponds to the values.

mask (optional)

Integer mask of this field.

desc (optional)

Description of the field.

11.10.7.5.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.6. ProtoField.uint64(abbr, [name], [base], [valuestring], [mask], [desc])

Creates a ProtoField of an unsigned 64-bit integer.

11.10.7.6.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

base (optional)

One of base.DEC, base.HEX or base.OCT.

valuestring (optional)

A table containing the text that corresponds to the values.

mask (optional)

Integer mask of this field.

desc (optional)

Description of the field.

11.10.7.6.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.7. ProtoField.int8(abbr, [name], [base], [valuestring], [mask], [desc])

Creates a ProtoField of a signed 8-bit integer (i.e., a byte).

11.10.7.7.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

base (optional)

One of base.DEC, base.HEX or base.OCT.

valuestring (optional)

A table containing the text that corresponds to the values.

mask (optional)

Integer mask of this field.

desc (optional)

Description of the field.

11.10.7.7.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.8. ProtoField.int16(abbr, [name], [base], [valuestring], [mask], [desc])

Creates a ProtoField of a signed 16-bit integer.

11.10.7.8.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

base (optional)

One of base.DEC, base.HEX or base.OCT.

valuestring (optional)

A table containing the text that corresponds to the values.

mask (optional)

Integer mask of this field.

desc (optional)

Description of the field.

11.10.7.8.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.9. ProtoField.int24(abbr, [name], [base], [valuestring], [mask], [desc])

Creates a ProtoField of a signed 24-bit integer.

11.10.7.9.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

base (optional)

One of base.DEC, base.HEX or base.OCT.

valuestring (optional)

A table containing the text that corresponds to the values.

mask (optional)

Integer mask of this field.

desc (optional)

Description of the field.

11.10.7.9.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.10. ProtoField.int32(abbr, [name], [base], [valuestring], [mask], [desc])

Creates a ProtoField of a signed 32-bit integer.

11.10.7.10.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

base (optional)

One of base.DEC, base.HEX or base.OCT.

valuestring (optional)

A table containing the text that corresponds to the values.

mask (optional)

Integer mask of this field.

desc (optional)

Description of the field.

11.10.7.10.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.11. ProtoField.int64(abbr, [name], [base], [valuestring], [mask], [desc])

Creates a ProtoField of a signed 64-bit integer.

11.10.7.11.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

base (optional)

One of base.DEC, base.HEX or base.OCT.

valuestring (optional)

A table containing the text that corresponds to the values.

mask (optional)

Integer mask of this field.

desc (optional)

Description of the field.

11.10.7.11.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.12. ProtoField.framenum(abbr, [name], [base], [valuestring], [mask], [desc])

Creates a ProtoField for a frame number (for hyperlinks between frames).

11.10.7.12.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

base (optional)

One of base.DEC, base.HEX or base.OCT.

valuestring (optional)

A table containing the text that corresponds to the values.

mask (optional)

Integer mask of this field.

desc (optional)

Description of the field.

11.10.7.12.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.13. ProtoField.bool(abbr, [name], [display], [valuestring], [mask], [desc])

Creates a ProtoField for a boolean true/false value.

11.10.7.13.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

display (optional)

How wide the parent bitfield is (base.NONE is used for NULL-value).

valuestring (optional)

A table containing the text that corresponds to the values.

mask (optional)

Integer mask of this field.

desc (optional)

Description of the field.

11.10.7.13.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.14. ProtoField.absolute_time(abbr, [name], [base], [desc])

Creates a ProtoField of a time_t structure value.

11.10.7.14.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

base (optional)

One of base.LOCAL, base.UTC or base.DOY_UTC.

desc (optional)

Description of the field.

11.10.7.14.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.15. ProtoField.relative_time(abbr, [name], [desc])

Creates a ProtoField of a time_t structure value.

11.10.7.15.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

desc (optional)

Description of the field.

11.10.7.15.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.16. ProtoField.ipv4(abbr, [name], [desc])

Creates a ProtoField of an IPv4 address (4 bytes).

11.10.7.16.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

desc (optional)

Description of the field.

11.10.7.16.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.17. ProtoField.ipv6(abbr, [name], [desc])

Creates a ProtoField of an IPv6 address (16 bytes).

11.10.7.17.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

desc (optional)

Description of the field.

11.10.7.17.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.18. ProtoField.ether(abbr, [name], [desc])

Creates a ProtoField of an Ethernet address (6 bytes).

11.10.7.18.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

desc (optional)

Description of the field.

11.10.7.18.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.19. ProtoField.float(abbr, [name], [desc])

Creates a ProtoField of a floating point number (4 bytes).

11.10.7.19.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

desc (optional)

Description of the field.

11.10.7.19.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.20. ProtoField.double(abbr, [name], [desc])

Creates a ProtoField of a double-precision floating point (8 bytes).

11.10.7.20.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

desc (optional)

Description of the field.

11.10.7.20.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.21. ProtoField.string(abbr, [name], [desc])

Creates a ProtoField of a string value.

11.10.7.21.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

desc (optional)

Description of the field.

11.10.7.21.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.22. ProtoField.stringz(abbr, [name], [desc])

Creates a ProtoField of a zero-terminated string value.

11.10.7.22.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

desc (optional)

Description of the field.

11.10.7.22.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.23. ProtoField.bytes(abbr, [name], [desc])

Creates a ProtoField for an arbitrary number of bytes.

11.10.7.23.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

desc (optional)

Description of the field.

11.10.7.23.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.24. ProtoField.ubytes(abbr, [name], [desc])

Creates a ProtoField for an arbitrary number of unsigned bytes.

11.10.7.24.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

desc (optional)

Description of the field.

11.10.7.24.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.25. ProtoField.guid(abbr, [name], [desc])

Creates a ProtoField for a Globally Unique IDentifier (GUID).

11.10.7.25.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

desc (optional)

Description of the field.

11.10.7.25.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.26. ProtoField.oid(abbr, [name], [desc])

Creates a ProtoField for an ASN.1 Organizational IDentified (OID).

11.10.7.26.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

desc (optional)

Description of the field.

11.10.7.26.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.27. ProtoField.rel_oid(abbr, [name], [desc])

Creates a ProtoField for an ASN.1 Relative-OID.

11.10.7.27.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

desc (optional)

Description of the field.

11.10.7.27.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.28. ProtoField.systemid(abbr, [name], [desc])

Creates a ProtoField for an OSI System ID.

11.10.7.28.1. Arguments
abbr

Abbreviated name of the field (the string used in filters).

name (optional)

Actual name of the field (the string that appears in the tree).

desc (optional)

Description of the field.

11.10.7.28.2. Returns

A ProtoField object to be added to a table set to the Proto.fields attribute.

11.10.7.29. protofield:__tostring()

Returns a string with info about a protofield (for debugging purposes).

11.10.8. Global Functions

11.10.8.1. register_postdissector(proto, [allfields])

Make a Proto protocol (with a dissector function) a post-dissector. It will be called for every frame after dissection.

11.10.8.1.1. Arguments
proto

The protocol to be used as post-dissector.

allfields (optional)

Whether to generate all fields.

[Note]Note

this impacts performance (default=false).