pyshark icon indicating copy to clipboard operation
pyshark copied to clipboard

Pyshark not recognizing lua plugin layer

Open moodster321 opened this issue 4 years ago • 1 comments

I recently updated from wireshark 3.0.0 to 3.4.0, and I found that when dissecting packets as with my custom lua dissector, pyshark would no longer recognize the new layer in the packet as it did previously, but this only happens for some of the packets dissected. I have narrowed down the changes to something that happened between Wireshark 3.1.0 to 3.2.0 by testing different versions but haven't been able to find what the cause is. The dissector works fine when viewing in Wireshark.

Python 3.7.8 Pyshark 0.4.3

\AppData\Roaming\Python\Python37\site-packages\pyshark\packet\packet.py", line 50, in __getitem__
    raise KeyError('Layer does not exist in packet')
KeyError: 'Layer does not exist in packet'

If anyone has some ideas on what is happening that would be great, thanks!

moodster321 avatar Feb 22 '21 16:02 moodster321

It's probably a change in the pdml format in tshark. Run the pcap with dissector through tshark 3.0 and 3.4 with output format pdml and see if there is any difference.

primal100 avatar May 21 '21 16:05 primal100