This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Lua dissector and “tshark -e data.data”

0

For a private protocol over TCP, I am writing a Lua-based dissector. The dissector is very much in the spirit of the first part of http://wiki.wireshark.org/Lua/Dissectors. Within Wireshark, this dissector works fine, but if I use

tshark -X lua_script:foo.lua ... -e data.data ...

to simply dump the whole TCP PDU onto stdout, I don't get anything. But, of course, if I remove the -X..., the dump works. I am in search for the magic statement to enable this feature. I am using the latest Wireshark version.

asked 23 Oct '12, 06:28

Salonbolschewik's gravatar image

Salonbolschewik
1111
accept rate: 0%

edited 23 Oct '12, 18:08

helloworld's gravatar image

helloworld
3.1k42041

It could be the code in foo.lua, the command you're entering, or simply just a bug. Too difficult to tell without more details. Include your code in the question; and the complete command line (plus its output). What OS are you using?

(23 Oct '12, 18:38) helloworld

One Answer:

0

But, of course, if I remove the -X..., the dump works.

O.K. that probably means, that you loaded your script in init.lua, otherwise you would not see the output of your script.

So, if you load the script a second time with -X, that will probably lead to a problem with duplicate declarations and you might see an error message in the console window where you started tshark.

Suggestion: Remove your script from init.lua when you run it with -X.

Regards
Kurt

answered 29 Oct '12, 04:30

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%