Ask Your Question
0

Wireshark 2.6 throws error when loading LUA dissector

asked 2018-07-27 07:13:04 +0000

anonymous user

Anonymous

Hello,

I did some LUA dissectors to analyze payload data. These dissectors worked fine for Wireshark 2.4.x. After upgrading to Wireshark 2.6.x. All files throw an error:

Lua: Error during loading: However, all Protocols seem to be registered as I can find them in the list of enabled Protocols and they seem to work properly. I did a fresh installation - this did not fix the problem.

I am running on Windows 10 64Bit

edit retag flag offensive close merge delete

Comments

The error message should also tell you what it is (at least, the code shows that the Lua state is printed). Are the scripts in the correct location (not sure if that changed between 2.4 and 2.6), and are there no duplicates?

Jaap gravatar imageJaap ( 2018-07-27 07:39:27 +0000 )edit

The complete Error message:

Lua: Error during loading:

[string "C:\Program Files\Wireshark\plugins\..."]:161: bad argument #2 to 'Proto' (Proto_new: there cannot be two protocols with the same description)

I also did a try to remove all Scripts but one, the only difference is the number of errors I get (usually 1 one per file). As the dissector seems to work (apart of this loading issue), I assume that the location is still valid.

swl5fr gravatar imageswl5fr ( 2018-07-27 11:46:53 +0000 )edit

And can you show the code (including context) around line 161 referred to in the error message?

grahamb gravatar imagegrahamb ( 2018-07-27 12:06:27 +0000 )edit

-- define dissector and fields

medial_pct = Proto("MEDIAL_PCT","Medial PCT UDP")

local f_type = ProtoField.new("PDU Type","medial_pct.pdu",ftypes.UINT16)
local f_unit  = ProtoField.new("MAC","medial_pct.mac",ftypes.STRING)
swl5fr gravatar imageswl5fr ( 2018-07-27 12:44:51 +0000 )edit

Maybe try:

medial_pct = Proto.new("MEDIAL_PCT","Medial PCT UDP")

As in the API specification for the Proto class here.

grahamb gravatar imagegrahamb ( 2018-07-27 13:29:02 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2018-07-27 14:21:56 +0000

swl5fr gravatar image

The suggested change did not solve the problem, however while having a look at the logfiles I found a solution.

It seems like Wireshark is loading lua plugins automatically, beginning with version 2.6. In 2.4 you had to manually alter the init.lua file and manually add your custom dissectors. If the lua scripts are added to the init.lua, they are basically loaded 2 times.

The automatic load procedure makes them visible and working, the load procedure invoked by init.lua throws the error message.

Thanks for all suggestions

edit flag offensive delete link more

Comments

How do you avoid the double loading?

rneustad gravatar imagerneustad ( 2021-10-19 14:20:42 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-07-27 07:13:04 +0000

Seen: 4,728 times

Last updated: Jul 27 '18