This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

tap functions in Lua script

0

Hi. I want to ask about the tap.packet functions. I have two listeners one for outbound traffic and the other for the inbound. Unfortunately, the examples of using Lua with wireshark are limited and I didn't find documentation talks about the scope of tap functions and why they are written like that; I mean the use of local init_listener()function or any other function the script start with, and why it is local and functions like: tap.packet and tap.draw as example are global inside these functions, does this mean something I should care about ? I tried to process online data using directly the tap.packet function without inserting it inside a local function as the examples I saw, is it just as convention or it has an effect on the performance of the program in some views? What is the benefit of writing the lua program with wireshark like this?? and I need any advice about using two listeners if there are any points I should care about, especially when I use data from one of the tap.packet function to be benefited from by the other tap.packet functions, Is there any advice about these listeners? Thanks alot.

asked 05 Dec '12, 11:01

Leena's gravatar image

Leena
51171821
accept rate: 0%

edited 06 Dec '12, 19:26

Is it enough and safe to use the tap functions and functions use their outputs inside a "do..end" since I'm working online, without putting them inside a local function and call it at the end of the script??

(05 Dec '12, 11:48) Leena

One Answer:

1

There are several reasons to prefer local scope over global scope, including a performance improvement of the variable lookup. Locals are referenced via registers on the stack while globals are stored in a table [on the heap] (applies only to Lua 5.1 -- which is the currently supported version in Wireshark). Read up on more reasons here.

In addition, globals should be avoided for the same reasons in most other languages (one of which is that it's normally easier to maintain). Google/StackOverflow will fill you in on that.

The tap definitions don't need to be local, but if it's run in an environment where other scripts are also run, then you want to limit your variable scopes to avoid name collisions (where another script that is also using globals inadvertently overwrites your global of the same name, or vice-versa). I recommend using local as much as possible.

A do..end block creates an isolated scope where variables can live (locals within the block are not seen outside the block). When used with locals, the do..end block is useful to prevent colliding with variables in an outer scope with the same name. Note that you can still [accidentally] declare/overwrite globals from within a do..end.

local i = 10
local j = 22
do
     print(i) -- "10"
     i = 1
     local j = 5
     k = "hello" -- declare global string
end
print(i) -- "1"
print(j) -- "22"
print(k) -- "hello"

In the Lua example (from the Wiki), tap.packet is not a global function. That happens to be the syntax in Lua to declare a function member. In this case, it's declaring a function member named packet for tap (a local variable). Since the function member can only be accessed through the parent object (tap), the function member effectively has the same scope as the parent (local in this case).

Note that it's a syntax error to write:

local function tap.packet()
    -- ...
end

(but the local declaration actually doesn't make sense here).

answered 05 Dec '12, 19:13

helloworld's gravatar image

helloworld
3.1k42041
accept rate: 28%

Thanks a lot helloworld, you really helped, May God bless you.

(05 Dec '12, 21:31) Leena

Can I skip the step of making a function contains all the funcions inside like init_Listener() and just write the functions inside the "do..end" and declare the tap as a local inside the "do..end", I want to know exactly what is the job of this main function since "do..end" wrap the variables, is it just the style of writing a program or there is a benefit from programming view??

(05 Dec '12, 21:37) Leena
1

Yes, you can declare your tap outside of a function. It really comes down to your specific requirements and what works best for you.

(06 Dec '12, 17:52) helloworld
1

Declaring your tap inside a function doesn't look very useful, especially in the Wiki example, but there are some advantages to this:

  • It limits the scope of tap since nobody else in the script should care about it, and thus provides for better modularity (which is a best practice -- not a requirement).
  • You can call this tap-creating function multiple times, each call creating a new instance of the tap or a variation of the tap, based on some passed-in parameter (such as a filter string).
(06 Dec '12, 17:53) helloworld
1
  • The function allows you to abstract the [gory] details of setting up a tap, and listening for specific fields, etc.
(06 Dec '12, 17:53) helloworld

Thanks a lot.Your explanation is clear and rich.

(06 Dec '12, 19:10) Leena
showing 5 of 6 show 1 more comments