This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi,

I'm prototyping a listener in LUA using the 'Evaluate Lua' window in WireShark. My goal is to access the SSL Certificate that gets exchanged during the TLS/SSL handshake. Per the data I've googled I have tried this:

ssl_cert_Info = Field.new("ssl.handshake.certificate");

function simplelistenerssl()
  local window2 = TextWindow.new("SSL Window");
  local tap = Listener.new (nil, "ssl.handshake.certificate");

  function tap.packet (pinfo, buffer, userdata)
    local cert = ssl_cert_Info();

    window2:append("Certificate!\r\n");
    window2:append(tostring(cert));
  end
end

When the first line (ssl_cert_info) executes, I get this error:

Lua: Error During execution of dialog callback: [string "ssl_cert_Info = Field.new("ssl");"]:1: Field_get: A Field extractor must be defined before Taps or Dissectors get called

I'm very new to Lua, though I have been using wireshark for the better part of 5 years now. Any resources or help would be greatly appreciated.

asked 22 May '13, 17:31

i68040's gravatar image

i68040
1111
accept rate: 0%


[This question is quite old, but in case someone hits this in the future...]

The error message is a bit cryptic, but you got that error because you can only create Field extractors while a script is loading - because after your script loads Wireshark does some internal setup to make them usable, and it can only do that one time. So the error message says that because it assumes you're trying to create a Field at some later time, which would typically be inside a tap or listener callback, and thus the error message is written to help out people who would (incorrectly) do that in such callback functions.

In your case you're trying to do it in the evaluate console, which is also way too late to go create a Field. There are several things that cannot be done in the evaluate console - for example creating a Proto object. It's not meant as a replacement for writing a real script and loading it the normal way.

permanent link

answered 07 Mar '14, 22:32

Hadriel's gravatar image

Hadriel
2.7k2939
accept rate: 18%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×431
×319
×16

question asked: 22 May '13, 17:31

question was seen: 2,918 times

last updated: 07 Mar '14, 22:32

p​o​w​e​r​e​d by O​S​Q​A