Take the 2-minute tour ×

I'm working on a Wireshark Dissector in Lua.

I try to provide wireshark as much information about my custom protocol as possible to make use of the available analysis tools. Therefore I'm trying to set the correct source and destination address for my protocol.

My protocol can be on top of different other protocols such as UDP or IEEE 802.15.4. So it might even be that the package source/destination is already set (UDP).

However I want wireshark to show my addresses, so I tried the following:

myproto = Proto("myproto"), "My Protocol")
myproto_source = ProtoField.uint16("myproto.src", "Source Address", base.HEX)
myproto.fields = { myproto_source }

function myproto.dissector(buffer, pinfo, tree)
    local subtree = tree:add(myproto, buffer(), "My Proto")

    subtree:add(myproto_source, buffer(0,2)

    -- does not work with error:
    -- bad argument #1 to '?' (Address expected, got userdata)
    pinfo.src = myproto_source

    -- does work, but only adds text, wireshark tools rely on pinfo.src
    pinfo.cols.src = tostring(buffer(0,2):uint())

udp_table = DissectorTable.get("udp.port")
udp_table:add( 12345, myproto )
wtap_encap_table = DissectorTable.get("wtap_encap")
wtap_encap_table:add(wtap["IEEE802_15_4"], myproto)

So is there maybe a datatype/class "address" that is necessary to set pinfo.src? Or is there a totally different way to set the packet information?

Thanks in advance!

share|improve this question

2 Answers 2

up vote 3 down vote accepted

pinfo.src takes an Address object (which is an IP address; not a 16-bit integer). Example usage:

pinfo.src = Address.ip('')

Note that this only sets the text of the "Source" column shown in Wireshark. The underlying packet info cannot be modified, and the IP packet details will continue to show the actual IP address.

share|improve this answer
not quite what I was hoping for, but very helpful explanation! Thank you! –  Martin Schulze Feb 9 '12 at 18:28

Just a suggestion - I'm not an LUA wiz:

pinfo:col.src = buffer(0,2):uint()


share|improve this answer
It would have to be pinfo.cols.src = buffer(0,2):uint() which actually sets the column information, even though it is still not recognized by the wireshark tools (i.e. flow graph) –  Martin Schulze Feb 9 '12 at 17:25

Your Answer


