Here's my basic dissector

foo_proto = Proto("foo","foo proto") = ProtoField.string("","bar field")

function foo_proto.dissector(buffer,pinfo,tree)
   local subtree = tree:add(foo_proto,"Foo Protocol Data")
   subtree:add(, pinfo.number)


I use wireshark 1.4.4, I start wireshark and load my dissector in the Lua "Evaluate" window, my packet got dissected correctly and I can see my bar field under the foo proto.

My problem is that I can't use as a filter. When I click on "Expression..." the foo proto appears but it has not fields under. The only filter I can use is: foo

When try to evaluate:

  bar_f ="")

I have:

[string "bar_f ="")"]:1: bad argument #1 
 to 'new' (Field_new: a field with this name must exist)

Surprisingly when I use tshark with the option -T fields -e and load the lua script, it works, pinfo.number is displayed.

How can I get my field usable in my lua scripts ?


asked 21 Mar '11, 09:01

khshark's gravatar image

accept rate: 0%

edited 21 Mar '11, 09:03

I recreated your problem with Wireshark 1.4.6 on Mac OS X 10.6, but it actually works correctly on Windows XP SP3; Windows Wireshark lets me use as a filter, and it evaluates"") without error.

I would submit a bug.


answered 28 Apr '11, 09:41

bstn's gravatar image

accept rate: 14%

I can confirm the original posters problem using Version 1.6.2 (SVN Rev 38931 from /trunk-1.6) x64 under Windows 7 x64 (I used the evaluate function to run both commands)


answered 14 Sep '11, 05:55

wojtech's gravatar image

accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported



Asked: 21 Mar '11, 09:01

Seen: 4,163 times

Last updated: 14 Sep '11, 05:55

p​o​w​e​r​e​d by O​S​Q​A