13.5. Obtaining Packet Information
Prev Chapter 13. Wireshark’s Lua API Reference Manual Next

13.5. Obtaining Packet Information

13.5.1. Address

Represents an address.

13.5.1.1. Address.ip(hostname)

Creates an Address Object representing an IPv4 address.

Arguments
hostname
The address or name of the IP host.
Returns

The Address object.

13.5.1.2. Address.ipv6(hostname)

Creates an Address Object representing an IPv6 address.

Arguments
hostname
The address or name of the IP host.
Returns

The Address object

13.5.1.3. Address.ether(eth)

Creates an Address Object representing an Ethernet address.

Arguments
eth
The Ethernet address.
Returns

The Address object.

13.5.1.4. address:__tostring()

Returns

The string representing the address.

13.5.1.5. address:__eq()

Compares two Addresses.

13.5.1.6. address:__le()

Compares two Addresses.

13.5.1.7. address:__lt()

Compares two Addresses.

13.5.2. Column

A Column in the packet list.

13.5.2.1. column:__tostring()

Returns

The column’s string text (in parenthesis if not available).

13.5.2.2. column:clear()

Clears a Column.

13.5.2.3. column:set(text)

Sets the text of a Column.

Arguments
text
The text to which to set the Column.

13.5.2.4. column:append(text, [sep])

Appends text to a Column.

Arguments
text
The text to append to the Column.
sep (optional)
An optional separator to use as prefix if the column is not empty.

13.5.2.5. column:prepend(text)

Prepends text to a Column.

Arguments
text
The text to prepend to the Column.

13.5.2.6. column:fence()

Sets Column text fence, to prevent overwriting.

13.5.2.7. column:clear_fence()

Clear Column text fence.

13.5.3. Columns

The Columns of the packet list.

13.5.3.1. columns:__tostring()

Returns

The string "Columns". This has no real use aside from debugging.

13.5.3.2. columns:__newindex(column, text)

Sets the text of a specific column. Some columns cannot be modified, and no error is raised if attempted. The columns that are known to allow modification are "info" and "protocol".

Arguments
column
The name of the column to set. Valid values are:
NameDescription

number

Frame number

abs_time

Absolute timestamp

utc_time

UTC timestamp

cls_time

CLS timestamp

rel_time

Relative timestamp

date

Absolute date and time

date_doy

Absolute year, day of year, and time

utc_date

UTC date and time

utc_date_doy

UTC year, day of year, and time

delta_time

Delta time from previous packet

delta_time_displayed

Delta time from previous displayed packet

src

Source address

src_res

Resolved source address

src_unres

Numeric source address

dl_src

Source data link address

dl_src_res

Resolved source data link address

dl_src_unres

Numeric source data link address

net_src

Source network address

net_src_res

Resolved source network address

net_src_unres

Numeric source network address

dst

Destination address

dst_res

Resolve destination address

dst_unres

Numeric destination address

dl_dst

Destination data link address

dl_dst_res

Resolved destination data link address

dl_dst_unres

Numeric destination data link address

net_dst

Destination network address

net_dst_res

Resolved destination network address

net_dst_unres

Numeric destination network address

src_port

Source port

src_port_res

Resolved source port

src_port_unres

Numeric source port

dst_port

Destination port

dst_port_res

Resolved destination port

dst_port_unres

Numeric destination port

protocol

Protocol name

info

General packet information

packet_len

Packet length

cumulative_bytes

Cumulative bytes in the capture

direction

Packet direction

vsan

Virtual SAN

tx_rate

Transmit rate

rssi

RSSI value

dce_call

DCE call

13.5.3.3. Example

pinfo.cols['info'] = 'foo bar'

 — syntactic sugar (equivalent to above) pinfo.cols.info = 'foo bar'

text
The text for the column.

13.5.3.4. columns:__index()

Get a specific Column.

13.5.4. Conversation

Conversation object, used to attach conversation data or a conversation dissector

13.5.4.1. Conversation.find(framenum, ctype, addr1, [addr2], [port1], [port2], [create])

Searches for a Conversation instance matching criteria. If one does not exist and 'create' is true, one will be created, otherwise nil will be returned. Note that, although there are 'first' and 'second' addresses and ports, a conversation does not distinguish between source or destination. These are effectively matching criteria that wireshark uses to flag a packet as belonging to the conversation.

Arguments
framenum
The number of a frame within the conversation. If a new conversation is created, this will be used as the first frame of the conversation.
ctype
Conversation Type. One of: convtypes.NONE, convtypes.SCTP, convtypes.TCP, convtypes.UDP, convtypes.DCCP, convtypes.IPX, convtypes.NCP, convtypes.EXCHG, convtypes.DDP, convtypes.SBCCS, convtypes.IDP, convtypes.TIPC, convtypes.USB, convtypes.I2C, convtypes.IBQP, convtypes.BLUETOOTH, convtypes.TDMOP, convtypes.DVBCI, convtypes.ISO14443, convtypes.ISDN, convtypes.H223, convtypes.X25, convtypes.IAX2, convtypes.DLCI, convtypes.ISUP, convtypes.BICC, convtypes.GSMTAP, convtypes.IUUP, convtypes.DVBBBF, convtypes.IWARP_MPA, convtypes.BT_UTP, convtypes.LOG, convtypes.LTP, convtypes.MCTP, convtypes.NVME_MI, convtypes.BP, convtypes.SNMP, convtypes.QUIC, convtypes.IDN, convtypes.IP, convtypes.IPV6, convtypes.ETH, convtypes.ETH_NN, convtypes.ETH_NV, convtypes.ETH_IN, convtypes.ETH_IV, convtypes.VSPC_VMOTION, convtypes.OPENVPN, convtypes.PROXY, convtypes.DNP3
addr1
First