IP info with ‘xml’ filter?

Question

Hi, I'm trying to extract SOAP payloads with timestamps and source/dest IP addresses and ports with the following code:

local tap = Listener.new(nil, "xml", true)
local xml_field = Field.new("xml")
function tap.packet(pinfo,tvb,tapinfo)
local xml_string = string.gsub(tostring(xml_field().value), "(..)",
function(c) c=tonumber(c,16); if c==13 or c==10 then c=0 end; return string.char(c) end)
print( table.concat( {
os.date("%Y-%m-%d %H:%M:%S", pinfo.abs_ts) .. string.sub(select(2,math.modf(pinfo.abs_ts)), 2,8),
tostring(ip_dst), –  pinfo.cols.src_port, pinfo.cols.dst, pinfo.cols.dst_port,
xml_string
}, "|" ) )
end
function tap.reset()
– file:close()
end

I’ve succeeded in converting the XML data and timestamps, but tapinfo comes as nil. How can I have the IP addresses+ports?

Accepted Answer

The Listener tapinfo is only populated for some specific Listener tap types, such as ip, tcp, udp, or http types... but not for a frame tap type, which is what you're creating since you passed nil for the first argument of Listener.new().

Is there some specific reason you want to tap the frame instead of the IP packet, or even TCP segment? Because doing "Listener.new("ip", "xml", true)" would get you the tapinfo for IP-layer including addresses, but not port numbers. Doing "Listener.new("tcp", "xml", true)" would get you the tapinfo for TCP-layer, which would include IP addresses as well as TCP port numbers.

Alternatively, you don't need to get the IP addresses+ports from the tapinfo - you can instead just get them from explicit field extractors, like this:

local tap = Listener.new(nil, "xml", true)
local f_ip_src   = Field.new("ip.src")
local f_ip_dst   = Field.new("ip.dst")
local f_src_port = Field.new("tcp.srcport")
local f_dst_port = Field.new("tcp.dstport")
function tap.packet(pinfo,tvb)
local ip_src   = f_ip_src().value
local ip_dst   = f_ip_dst().value
local src_port = f_src_port().value
local dst_port = f_dst_port().value

…

Note that the above is just example code - in a real script one would do verification checks to make sure each field extractor returns something before calling its value attribute, etc.