This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Lua script to write the source address to text file when wireshark finds a keyword on live capture not working

0

Hi, I am new to wireshark, tshark and lua.

try to capture all uri which contains "abc" to text file automatically. the following code does work and i can hear beep when tshark find a filtered uri.

BUT, writing to text file part IS NOT working.

could anyone please help me?

local _filter = 'http.request.uri contains "abc"' 
local file = io.open("Test.txt", "w")

local function make_tap(filter)
local tap = Listener.new(nil, filter)


function tap.packet()
    for i=1,3 do print '\007' end                       file:write("Testing....")       
end

return tap   end</code></pre><p>Thanks</p></div><div id="question-tags" class="tags-container tags"><span class="post-tag tag-link-lua" rel="tag" title="see questions tagged &#39;lua&#39;">lua</span> <span class="post-tag tag-link-wireshark" rel="tag" title="see questions tagged &#39;wireshark&#39;">wireshark</span></div><div id="question-controls" class="post-controls"></div><div class="post-update-info-container"><div class="post-update-info post-update-info-user"><p>asked <strong>18 Dec '14, 03:54</strong></p><img src="https://secure.gravatar.com/avatar/fffb59505884915bcdac690c14a93078?s=32&amp;d=identicon&amp;r=g" class="gravatar" width="32" height="32" alt="Shark&#39;s gravatar image" /><p><span>Shark</span><br />



11●1●1●3

accept rate: 0%

edited 19 Dec ‘14, 14:46

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k●3●35●196

It works for me. Or at least, in my script I use:

…
local file = io.open("Test.txt", "w")
function myproto.dissector(tvb, pinfo, tree)
file:write("Packet: " .. pinfo.number .. "\n")
end
…

and it does write out to the file, both using tshark and wireshark.

(23 Dec ‘14, 00:59) Hadriel