Wireshark supports plugins for various purposes. Plugins can either be scripts written in Lua or code written in C or C++ and compiled to machine code.
Wireshark looks for plugins in both a personal plugin folder and a global plugin folder. Lua plugins are stored in the plugin folders; compiled plugins are stored in subfolders of the plugin folders, with the subfolder name being the plugin binary type. Each Wireshark binary plugin has one of three distinct types (libwireshark, libwiretap and codecs). So for example the location for a libwireshark plugin foo.so (foo.dll on Windows) would be PLUGINDIR/epan (libwireshark used to be called libepan), for libwiretap it would be PLUGINDIR/wiretap and for codecs PLUGINDIR/codecs.
Plugins should come with the ABI version appended to the filename, so the complete example for an epan binary plugin would be PLUGINDIR/epan/foo.so.1_ for epan ABI version 1.
On Windows:
- The personal plugin folder is %APPDATA%\Wireshark\plugins.
- The global plugin folder is WIRESHARK\plugins.
On Unix-like systems:
- The personal plugin folder is ~/.local/lib/wireshark/plugins.
![[Note]](images/note.svg) | Note |
|---|---|
|
To provide better support for binary plugins this folder changed in Wireshark 2.5. It is recommended to use the new folder but for lua scripts only you may continue to use $XDG_CONFIG_HOME/wireshark/plugins for backward-compatibility. This is useful to have older versions of Wireshark installed side-by-side. In case of duplicate file names between old and new the new folder wins. |
- If you are running on macOS and Wireshark is installed as an application bundle, the global plugin folder is %APPDIR%/Contents/PlugIns/wireshark, otherwise it’s INSTALLDIR/lib/wireshark/plugins.