On Feb 11, 2013, at 4:10 PM, Hadriel Kaplan <HKaplan@xxxxxxxxxxxxxx> wrote:
> Setting column text via Lua plugins by using the pinfo:set() method (the Pinfo from a Listener tap), doesn't seem to work for two reasons:
> 1) The TL_REQUIRES_COLUMNS flag wasn't being set when registering Lua listener taps in Listener_new(). I fixed that in my local copy.
>
> 2) Wireshark apparently calls dissectors twice: once for each packet in the list, during which it calls the taps for that packet including the Lua Listener taps; and a second time after it reaches the end of the list it apparently calls the dissectors for all the packets again but without calling the Listener taps.
Wireshark can call dissectors an arbitrary number of times for a given packet. In this particular case, the first pass is the standard "read all packets and dissect them" pass, and the second pass might be done in order to generate the column text (which might or might not happen on the "read all packets and dissect them" pass).
*If* Wireshark is supposed to support setting columns in taps, rather than in dissectors or in post-dissectors:
http://wiki.wireshark.org/Lua/Examples/PostDissector
*then* the listener taps would have to be called whenever the columns are being generated.
However, I'm not sure it's supposed to support that.
You might want to try using a post-dissector instead.