This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

hi, i'm writing a lua script for tshark that has to run (using a listener) on a whole log once (or until it finds a specific packet) and then run on the log again and verifies it with the previously found data. i have managed to do so in wireshark using tap:remove() and then calling a function that opens a new listener. however, on tshark, the new listener doesnt start from the begining of the log but from where i stopped the first tap. thank you!

This question is marked "community wiki".

asked 15 Jul '14, 06:51

orenn's gravatar image

orenn
11112
accept rate: 0%


Tshark doesn't work the same way as Wireshark in terms of reading capture files. By default tshark only reads a capture file once and only dissects+taps each frame once, whereas wireshark reads it multiple times and even lets Lua force a re-read using the reload() function, but that won't work in tshark. There is a command switch to make tshark process a capture file twice (using the "-2" command option switch), but I'm not sure it will help you at all.

permanent link

answered 15 Jul '14, 14:13

Hadriel's gravatar image

Hadriel
2.7k2939
accept rate: 18%

edited 15 Jul '14, 14:13

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×832
×431
×40
×16

question asked: 15 Jul '14, 06:51

question was seen: 1,705 times

last updated: 15 Jul '14, 14:13

p​o​w​e​r​e​d by O​S​Q​A