Postdissectors

Postdissectors are a type of dissector used in packet analysis tools such as Wireshark that run after the standard protocol dissectors have finished dissecting a packet. They enable additional analysis by examining fields that have already been decoded and by deriving new information for display or reporting.

Postdissectors are implemented either in native code (C) or in Lua and are registered to be invoked for each packet after the primary dissection. In the Wireshark architecture, they receive the same per-packet context (packet data, metadata, and the protocol tree) and can read existing fields, compute derived values, and declare new fields that are then added to the dissection view or to the packet summary.

Typical use cases include cross-field or cross-protocol analysis, generation of aggregate metrics, validation of hypotheses about a packet, or enhancing the user interface with additional summary information. They are not meant to replace core dissectors but to augment them by providing supplementary conclusions based on the complete set of decoded data.

Because postdissectors run after every packet, they should be efficient and careful not to degrade performance. They can be provided as plugins or built into the dissector framework and can be enabled or disabled as needed. They complement the main dissectors by offering additional, derived insight and can be a valuable tool for protocol analysis and traffic characterization.