In some older versions Lua was available as a plugin. To see if your version of Wireshark supports Lua, go to Help→About Wireshark and look for Lua in the 'Compiled with' paragraph. Lua has shipped with the Windows version of Wireshark since 0.99.4. Taps are used to collect information after the packet has been dissected. They can add items the dissection tree so they can be used to create your own extensions to the filtering mechanism. Post-dissectors are dissectors meant to run after every other dissector has run.

Lua is ok for prototyping dissectors, during Reverse Engineering you can use your time for finding out how things work instead of compiling and debugging your C dissector. Lua can be used to write dissectors, post-dissectors and taps.Īlthough it's possible to write dissectors in Lua, Wireshark dissectors are written in C, as C is several times faster than Lua.

If it isn't clear to you what the GPL is and how it works please consult your lawyer. To distribute Lua code that uses Wireshark's bindings under different terms would be a clear violation of the GPL. There is at least one Wireshark author that will not allow to distribute derivative work under different terms. The code written in Lua that uses bindings to Wireshark must be distributed under the GPL terms. Wireshark is released under GPL so every derivative work based on Wireshark must be released under the terms of the GPL.Įven if the code you write in Lua does not need to be GPL'ed.

How to use wireshark in windows