Verified with Wireshark SVN 45134

Lua Taps/Listeners

Taps are a mechanism to fetch data from every frame. They can be defined to use a display filter.

A simple Tap

This tap is meant to be used as a script run by tshark. It counts the number of HTTP packets that occur during the trace. To run this tap on a trace file called mylan.pcap and assuming that tshark is in the path, one would issue the command tshark -X lua_script:simple_http.lua -r mylan.pcap

-- simple_http.lua
-- implements a very simple tap in Lua

-- this is going to be our counter
http_packets = 0

-- this is going to be our tap
tap_http = nil

-- first we declare the tap called "http tap" with the filter it is going to use
tap_http =,"http")

-- this function will get called at the end(3) of the capture to print the summary
function tap_http.draw()
    debug("http packets:" .. http_packets)

-- this function is going to be called once each time the filter of the tap matches
function tap_http.packet()
    http_packets = http_packets + 1

-- this function will be called at the end of the capture run
function tap_http.reset()
    http_packets = 0


-- text_window_tap.lua
-- an example of a tap that registers a menu
-- and prints to a text window

instances = 0 -- number of instances of the tap created so far

function mytap_menu()
    instances = instances + 1

    local td = {}
    -- the tap data, locally accessible by every function of the tap
    -- beware not to use a global for taps with multiple instances or you might
    -- find it been written by more instances of the tap, not what we want.
    -- each tap will have its own private instance of td. ="My Tap " .. instances) -- the window we'll use
    td.text = "" -- the text of the tap
    td.instance = instances -- the instance number of this tap

    -- this tap will be local to the menu_function that called it
    local tap =

    -- callback to remove the tap when the text window closes
    function remove_tap()
        if tap and tap.remove then

    -- make sure the tap doesn't hang around after the window was closed

    -- this function will be called for every packet
    function tap.packet(pinfo,tvb,tapdata)
        local text = "packet " .. pinfo.number
        td.text = td.text .. "\n" .. text
        -- debug("packet " .. pinfo.number, tapdata.instance)

    -- this function will be called once every few seconds to redraw the window
    function tap.draw()
        -- debug("draw", tapdata.instance)

-- last we register the menu
-- the first arg is the menu name
-- the 2nd arg is the function to be called
-- the third argument is the menu to hold this new menu
register_menu("Lua Tap Test",mytap_menu,MENU_TOOLS_UNSORTED)

-- debug("registered")

Imported from on 2020-08-11 23:16:13 UTC