“A Field extractor must be defined before Taps or Dissectors get called” when I try to create an SSL Tap

Question

Hi,

I'm prototyping a listener in LUA using the 'Evaluate Lua' window in WireShark. My goal is to access the SSL Certificate that gets exchanged during the TLS/SSL handshake. Per the data I've googled I have tried this:

ssl_cert_Info = Field.new("ssl.handshake.certificate");
function simplelistenerssl()
local window2 = TextWindow.new("SSL Window");
local tap = Listener.new (nil, "ssl.handshake.certificate");
function tap.packet (pinfo, buffer, userdata)
local cert = ssl_cert_Info();
window2:append(&quot;Certificate!\r\n&quot;);
window2:append(tostring(cert));

end
end

When the first line (ssl_cert_info) executes, I get this error:

Lua: Error During execution of dialog callback: [string “ssl_cert_Info = Field.new(“ssl”);"]:1: Field_get: A Field extractor must be defined before Taps or Dissectors get called

I’m very new to Lua, though I have been using wireshark for the better part of 5 years now. Any resources or help would be greatly appreciated.

Answer 1

[This question is quite old, but in case someone hits this in the future...]

The error message is a bit cryptic, but you got that error because you can only create Field extractors while a script is loading - because after your script loads Wireshark does some internal setup to make them usable, and it can only do that one time. So the error message says that because it assumes you're trying to create a Field at some later time, which would typically be inside a tap or listener callback, and thus the error message is written to help out people who would (incorrectly) do that in such callback functions.

In your case you're trying to do it in the evaluate console, which is also way too late to go create a Field. There are several things that cannot be done in the evaluate console - for example creating a Proto object. It's not meant as a replacement for writing a real script and loading it the normal way.