Lua Scripts

Table of Contents

Quicklinks: Wireshark: Lua API docs | Lua Examples

Lua scripting allows you to dynamically access info that might not be available in Wireshark normally! Examples will be added at some point.

To use a lua script with tshark, use option -X lua_script:<path/to/script>.
Obligatory Hello World example, capturing one packet:

bash$ echo 'print("Hello World!")' > temp.lua
bash$ tshark -X lua_script:temp.lua -c 1
Hello World!
Capturing on 'Wi-Fi: en0'
    1   0.000000 178.33.111.155 → mbp.attlocal.net TLSv1.2 839 Application Data
5 packets dropped from Wi-Fi: en0
1 packet captured

Metaprogramming

There are two libraries I came across that are more metaprogramming that lua dissectors:

• kaitai-to-wireshark: Convert a Kaitai struct binary file description to a Lua Plugin. Only some elements are supported.
• pyreshark: Use Python instead of Lua to communicate with Wireshark. Limited to Python 2.6/ 2.7.

Lua Dissectors

I’ve compiled a list of the most popular lua dissectors on github.

Have a dissector you want added to this list? Has a dissector been merged into Wireshark? Make a pull request.

Repo Metrics

A ✔ is given for each of the following (in order of importance):

• D: Has Documentation in the form a README. Ideally, this includes separate installation and usage sections.
• T: One or more of: Test code / CICD / Examples folder
• I: Has Issues opened or closed by a different user
• R: Has github Release or version. Lacking one may mean that the project is not yet stable.
• C: Has multiple Contributors (>1)

Star/Fork count in 2019 Aug [★] and can be converted to an in-browser javascript github API query. Repos below are on github and have at least 5 stars. None of these repos have been tested.

Note: Any derivative works of Wireshark MUST use a GPL2-compatible license.

Github Dissector List