Based on my testing (on macOS), Wireshark loads each Lua dissector for only once so the module's private (local) global vars are shared between packet files. Is there a way to distinguish between packetfiles so I can define packetfile specific vars?
Currently, only one capture file can be open at a time in a single process running Wireshark (which is not a feature, especially in macOS, but I digress...), so there's no notion of packet file-specific variables anywhere in Wireshark.
What we do have, at least for C/C++ dissectors, is the ability for a dissector to register a routine to be called when a new capture file is opened, before any packets are read and dissected, and to register a routine to be called when the current capture file is closed.
We also have a version of that for Lua dissectors; to quote the documentation for the Proto class in the Wireshark Developer's Guide:
11.3.5.7. proto.init
Mode: Assign only.The init routine of this dissector, a function you define.
The init routine of a dissector is called when a new capture file is opened and when it's closed (I think that's left over from before we had separate init and close routines for C/C++ dissectors).
So what you want is to (re-)initialize your "should change every time you open a new file" variables in your dissector's init routine.
Open issue: 11316: Lua: should have a way to get current capture filename/path in Lua
You could add a frame comment to frame/packet 1 and process according to it's value.
Comments can be added in the Wireshark gui or using editcap in a script.
Asked: 2022-12-08 02:50:58 +0000
Seen: 159 times
Last updated: Dec 10 '22
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
