Canot run lua script in tshark

Question

I am using wireshark/tshark 1.10.6 on ubuntu 12.04. When trying to run

tshark -X lua_script:hello.lua

I don't see the "hello.lua" got executed (which should print "hello").

Yes, I have set the /usr/share/wireshark/init.lua to have

.... -- Set disable_lua to true to disable Lua support. disable_lua = false

if disable_lua then return end ….

The strange thing is, when I run tshark with strace, I don’t see it attempted to open init.lua at all.

Any idea why? Thanks!

EDIT 1 Thanks to Hadriel who pointed out my error in writing. I updated the problem statement

EDIT 2 I am not running it as root, just want to run a lua script using tshark with an input pcap file.

$ tshark -v TShark 1.10.6 (Git Rev Unknown from unknown) Copyright 1998-2014 Gerald Combs <[email protected]> and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Compiled (64-bit) with GLib 2.32.4, with libpcap, with libz 1.2.3.4, without POSIX capabilities, without libnl, without SMI, with c-ares 1.7.5, without Lua, without Python, without GnuTLS, without Gcrypt, without Kerberos, without GeoIP. Running on Linux 3.2.0-64-generic, with locale en_US.UTF-8, with libpcap version 1.1.1, with libz 1.2.3.4. Intel(R) Core(TM) i7-2670QM CPU @ 2.20GHz

Built using gcc 4.6.3.

Accepted Answer

OK, so the problem is the version info says "without Lua", which means support for Lua wasn't compiled into tshark/wireshark when it was built for your platform. Therefore it won't load init.lua or anything Lua-related.

Did Wireshark come with Ubuntu, or did you get it from an RPM installer (i.e., apt-get/yum/whatever)?

Answer 2

There should be a space between the "-X" and "lua_script:...", so like this:

tshark -X lua_script:hello.lua

Setting "disable_lua = true" in init.lua means you're disabling Lua. Why are you doing that?

Also, verify Lua is actually compiled into Wireshark, by running "tshark -v" at the command line, or in the Wireshark GUI selecting the menu Help -> About Wireshark, and in the third paragraph it should say "with Lua" somewhere.