title: Pyshark - tshark can't use user plugin in 'decode_as'
body: <p>I use <code>Pyshark</code> that uses <code>tshark</code> to decode a pcap file, and I have a problem using 'decode_as' option. 
  I'm trying to decode a specific UDP port as SOMEIP protocol. This is a dissector I added that is taken from <a href="https://github.com/jamores/eth-ws-someip/blob/master/someip.lua" rel="nofollow noreferrer">here</a>. </p>
  
  <p>It is important to say that both the dissector and the "decode_as" option work perfectly in Wireshark. </p>
  
  <p>This is the code I use:</p>
  
  <pre><code>import pyshark
  
  packets=pyshark.FileCapture(pcap_path, display_filter="udp")
  packets.next() # Works fine
  
  packets=pyshark.FileCapture(pcap_path, display_filter="udp", decode_as={"udp.port==50000":"someip"})
  packets.next() # doesn't return a packet
  </code></pre>
  
  <p>There is also an ignored exception: </p>
  
  <pre><code>Exception ignored in: &lt;function Capture.__del__ at 0x000001D9CE035268&gt;
  Traceback (most recent call last):
    File "C:\Users\SHIRM\AppData\Local\Continuum\anaconda3\lib\site-packages\pyshark\capture\capture.py", line 412, in __del__
      self.close()
    File "C:\Users\SHIRM\AppData\Local\Continuum\anaconda3\lib\site-packages\pyshark\capture\capture.py", line 403, in close
      self.eventloop.run_until_complete(self._close_async())
    File "C:\Users\SHIRM\AppData\Local\Continuum\anaconda3\lib\asyncio\base_events.py", line 573, in run_until_complete
      return future.result()
    File "C:\Users\SHIRM\AppData\Local\Continuum\anaconda3\lib\site-packages\pyshark\capture\capture.py", line 407, in _close_async
      await self._cleanup_subprocess(process)
    File "C:\Users\SHIRM\AppData\Local\Continuum\anaconda3\lib\site-packages\pyshark\capture\capture.py", line 400, in _cleanup_subprocess
      % process.returncode)
  pyshark.capture.capture.TSharkCrashException: TShark seems to have crashed (retcode: 1). Try rerunning in debug mode [ capture_obj.set_debug() ] or try updating tshark.
  </code></pre>
  
  <p>As it recommends I use debug mode(<code>packets.set_debug()</code>), and after running it I get: </p>
  
  <pre><code>tshark: Protocol "someip" isn't valid for layer type "udp.port"
  tshark: Valid protocols for layer type "udp.port" are:
  ....
  </code></pre>
  
  <p>and then a long list of protocols, which "someip" is not in... (but another dissector that I added, and is dll, is)</p>
  
  <p>Any idea what is wrong here? 
  Does the dissector causes the problems, or did I do something wrong? </p>
  
  <p>Again- the "decode as" works fine when done manually in Wireshark. 
  <a href="https://i.stack.imgur.com/57Uti.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/57Uti.png" alt="enter image description here"></a></p>
  
  <p>Thanks!</p>
  
  <hr>
  
  <p><strong>EDIT</strong></p>
  
  <p>I found the part in Wireshark code that causes this error:
  <a href="https://i.stack.imgur.com/IPCD2.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/IPCD2.png" alt="enter image description here"></a></p>
  
  <p>So I read about dissector tables, and it seems that there shouldn't be a problem, since the dissector lua code does add "someip" to the dissector table of "udp.port":</p>
  
  <pre class="lang-lua prettyprint-override"><code>    local udp_dissector_table = DissectorTable.get("udp.port")
      -- Register dissector to multiple ports
      for i,port in ipairs{30490,30491,30501,30502,30503,30504} do
          udp_dissector_table:add(port,p_someip)
          tcp_dissector_table:add(port,p_someip)
      end
  </code></pre>
  
  <p>I also tried to use the <code>dissectortable:add_for_decode_as(proto)</code> function (described in 11.6.2.11 <a href="http:////https://www.wireshark.org/docs/wsdg_html_chunked/lua_module_Proto.html" rel="nofollow noreferrer">here</a>):</p>
  
  <pre class="lang-lua prettyprint-override"><code>    udp_dissector_table:add_for_decode_as(p_someip)
  </code></pre>
  
  <p>But it didn't work :( </p>
  
  <p>Any idea will be appreciated, thanks</p>