Wireshark supports plugins for various purposes. Plugins can either be scripts written in Lua or code written in C or C++ and compiled to machine code.
Wireshark looks for plugins in both a personal plugin folder and a
global plugin folder. Lua plugins are stored in the plugin folders;
compiled plugins are stored in subfolders of the plugin folders, with
the subfolder name being the Wireshark minor version number (X.Y). There is
another hierarchical level for each Wireshark library (libwireshark, libwscodecs
and libwiretap). So for example the location for a libwireshark plugin
foo.dll on Windows) would be PLUGINDIR
(libwireshark used to be called libepan; the other folder names are
On Unix-like systems:
To provide better support for binary plugins this folder changed in Wireshark 2.5.
It is recommended to use the new folder but for lua scripts only you may
continue to use XDG_CONFIG_HOME
/Contents/PlugIns/wireshark, otherwise it’s INSTALLDIR