hi, i'm writing a lua script for tshark that has to run (using a listener) on a whole log once (or until it finds a specific packet) and then run on the log again and verifies it with the previously found data. i have managed to do so in wireshark using tap:remove() and then calling a function that opens a new listener. however, on tshark, the new listener doesnt start from the begining of the log but from where i stopped the first tap. thank you! This question is marked "community wiki". asked 15 Jul '14, 06:51  orenn |
One Answer:
Tshark doesn't work the same way as Wireshark in terms of reading capture files. By default tshark only reads a capture file once and only dissects+taps each frame once, whereas wireshark reads it multiple times and even lets Lua force a re-read using the answered 15 Jul '14, 14:13  Hadriel edited 15 Jul '14, 14:13 |
