11.5. Obtaining Packet Information
Prev Chapter 11. Wireshark’s Lua API Reference Manual Next

11.5. Obtaining Packet Information

11.5.1. Address

Represents an address.

11.5.1.1. Address.ip(hostname)

Creates an Address Object representing an IPv4 address.

Arguments
hostname
The address or name of the IP host.
Returns

The Address object.

11.5.1.2. Address.ipv6(hostname)

Creates an Address Object representing an IPv6 address.

Arguments
hostname
The address or name of the IP host.
Returns

The Address object

11.5.1.3. Address.ether(eth)

Creates an Address Object representing an Ethernet address.

Arguments
eth
The Ethernet address.
Returns

The Address object.

11.5.1.4. address:__tostring()

Returns

The string representing the address.

11.5.1.5. address:__eq()

Compares two Addresses.

11.5.1.6. address:__le()

Compares two Addresses.

11.5.1.7. address:__lt()

Compares two Addresses.

11.5.2. Column

A Column in the packet list.

11.5.2.1. column:__tostring()

Returns

The column’s string text (in parenthesis if not available).

11.5.2.2. column:clear()

Clears a Column.

11.5.2.3. column:set(text)

Sets the text of a Column.

Arguments
text
The text to which to set the Column.

11.5.2.4. column:append(text)

Appends text to a Column.

Arguments
text
The text to append to the Column.

11.5.2.5. column:prepend(text)

Prepends text to a Column.

Arguments
text
The text to prepend to the Column.

11.5.2.6. column:fence()

Sets Column text fence, to prevent overwriting.

Since: 1.10.6

11.5.2.7. column:clear_fence()

Clear Column text fence.

Since: 1.11.3

11.5.3. Columns

The Columns of the packet list.

11.5.3.1. columns:__tostring()

Returns

The string "Columns". This has no real use aside from debugging.

11.5.3.2. columns:__newindex(column, text)

Sets the text of a specific column. Some columns cannot be modified, and no error is raised if attempted. The columns that are known to allow modification are "info" and "protocol".

Arguments
column
The name of the column to set. Valid values are:
NameDescription

number

Frame number

abs_time

Absolute timestamp

utc_time

UTC timestamp

cls_time

CLS timestamp

rel_time

Relative timestamp

date

Absolute date and time

date_doy

Absolute year, day of year, and time

utc_date

UTC date and time

utc_date_doy

UTC year, day of year, and time

delta_time

Delta time from previous packet

delta_time_displayed

Delta time from previous displayed packet

src

Source address

src_res

Resolved source address

src_unres

Numeric source address

dl_src

Source data link address

dl_src_res

Resolved source data link address

dl_src_unres

Numeric source data link address

net_src

Source network address

net_src_res

Resolved source network address

net_src_unres

Numeric source network address

dst

Destination address

dst_res

Resolve destination address

dst_unres

Numeric destination address

dl_dst

Destination data link address

dl_dst_res

Resolved destination data link address

dl_dst_unres

Numeric destination data link address

net_dst

Destination network address

net_dst_res

Resolved destination network address

net_dst_unres

Numeric destination network address

src_port

Source port

src_port_res

Resolved source port

src_port_unres

Numeric source port

dst_port

Destination port

dst_port_res

Resolved destination port

dst_port_unres

Numeric destination port

protocol

Protocol name

info

General packet information

packet_len

Packet length

cumulative_bytes

Cumulative bytes in the capture

direction

Packet direction

vsan

Virtual SAN

tx_rate

Transmit rate

rssi

RSSI value

dce_call

DCE call

11.5.3.3. Example

pinfo.cols['info'] = 'foo bar'

 — syntactic sugar (equivalent to above) pinfo.cols.info = 'foo bar'

text
The text for the column.

11.5.3.4. columns:__index()

Get a specific Column.

11.5.4. NSTime

NSTime represents a nstime_t. This is an object with seconds and nanoseconds.

11.5.4.1. NSTime.new([seconds], [nseconds])

Creates a new NSTime object.

Arguments
seconds (optional)
Seconds.
nseconds (optional)
Nano seconds.
Returns

The new NSTime object.

11.5.4.2. nstime:__call([seconds], [nseconds])

Creates a NSTime object.

Arguments
seconds (optional)
Seconds.
nseconds (optional)
Nanoseconds.
Returns

The new NSTime object.

11.5.4.3. nstime:tonumber()

Returns a Lua number of the NSTime representing seconds from epoch

Since: 2.4.0

Returns

The Lua number.

11.5.4.4. nstime:__tostring()

Returns

The string representing the nstime.

11.5.4.5. nstime:__add()

Calculates the sum of two NSTimes.

11.5.4.6. nstime:__sub()

Calculates the diff of two NSTimes.

11.5.4.7. nstime:__unm()

Calculates the negative NSTime.

11.5.4.8. nstime:__eq()

Compares two NSTimes.

11.5.4.9. nstime:__le()

Compares two NSTimes.

11.5.4.10. nstime:__lt()

Compares two NSTimes.

11.5.4.11. nstime.secs

Mode: Retrieve or assign.

The NSTime seconds.

11.5.4.12. nstime.nsecs

Mode: Retrieve or assign.

The NSTime nano seconds.

11.5.5. Pinfo

Packet information.

11.5.5.1. pinfo.visited

Mode: Retrieve only.

Whether this packet has been already visited.

11.5.5.2. pinfo.number

Mode: Retrieve only.

The number of this packet in the current file.

11.5.5.3. pinfo.len

Mode: Retrieve only.

The length of the frame.

11.5.5.4. pinfo.caplen

Mode: Retrieve only.

The captured length of the frame.

11.5.5.5. pinfo.abs_ts

Mode: Retrieve only.

When the packet was captured.

11.5.5.6. pinfo.rel_ts

Mode: Retrieve only.

Number of seconds passed since beginning of capture.

11.5.5.7. pinfo.delta_ts

Mode: Retrieve only.

Number of seconds passed since the last captured packet.

11.5.5.8. pinfo.delta_dis_ts

Mode: Retrieve only.

Number of seconds passed since the last displayed packet.

11.5.5.9. pinfo.curr_proto

Mode: Retrieve only.

Which Protocol are we dissecting.

11.5.5.10. pinfo.can_desegment

Mode: Retrieve or assign.

Set if this segment could be desegmented.

11.5.5.11. pinfo.desegment_len

Mode: Retrieve or assign.

Estimated number of additional bytes required for completing the PDU.

11.5.5.12. pinfo.desegment_offset

Mode: Retrieve or assign.

Offset in the tvbuff at which the dissector will continue processing when next called.

11.5.5.13. pinfo.fragmented

Mode: Retrieve only.

If the protocol is only a fragment.

11.5.5.14. pinfo.in_error_pkt

Mode: Retrieve only.

If we’re inside an error packet.

11.5.5.15. pinfo.match_uint

Mode: Retrieve only.

Matched uint for calling subdissector from table.

11.5.5.16. pinfo.match_string

Mode: Retrieve only.

Matched string for calling subdissector from table.

11.5.5.17. pinfo.port_type

Mode: Retrieve or assign.

Type of Port of .src_port and .dst_port.

11.5.5.18. pinfo.src_port

Mode: Retrieve or assign.

Source Port of this Packet.

11.5.5.19. pinfo.dst_port

Mode: Retrieve or assign.

Destination Port of this Packet.

11.5.5.20. pinfo.dl_src

Mode: Retrieve or assign.

Data Link Source Address of this Packet.

11.5.5.21. pinfo.dl_dst

Mode: Retrieve or assign.

Data Link Destination Address of this Packet.

11.5.5.22. pinfo.net_src

Mode: Retrieve or assign.

Network Layer Source Address of this Packet.

11.5.5.23. pinfo.net_dst

Mode: Retrieve or assign.

Network Layer Destination Address of this Packet.

11.5.5.24. pinfo.src

Mode: Retrieve or assign.

Source Address of this Packet.

11.5.5.25. pinfo.dst

Mode: Retrieve or assign.

Destination Address of this Packet.

11.5.5.26. pinfo.p2p_dir

Mode: Retrieve or assign.

Direction of this Packet. (incoming / outgoing)

11.5.5.27. pinfo.match

Mode: Retrieve only.

Port/Data we are matching.

11.5.5.28. pinfo.columns

Mode: Retrieve only.

Access to the packet list columns.

11.5.5.29. pinfo.cols

Mode: Retrieve only.

Access to the packet list columns (equivalent to pinfo.columns).

11.5.5.30. pinfo.private

Mode: Retrieve only.

Access to the private table entries.

11.5.5.31. pinfo.hi

Mode: Retrieve or assign.

Higher Address of this Packet.

11.5.5.32. pinfo.lo

Mode: Retrieve only.

Lower Address of this Packet.

11.5.5.33. pinfo.conversation

Mode: Assign only.

Sets the packet conversation to the given Proto object.

11.5.6. PrivateTable

PrivateTable represents the pinfo→private_table.

11.5.6.1. privatetable:__tostring()

Gets debugging type information about the private table.

Returns

A string with all keys in the table, mostly for debugging.

Prev Up Next
11.4. Post-Dissection Packet Analysis Home 11.6. Functions For New Protocols And Dissectors