This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

wireshark lua dissector – how to query the name of the capture file?

0

I am writing a lua dissector for a propietary protocol. The packets include embedded .png files that I would like to write to an output folder named "ImageDump_<capturefilename>". Is there a way in lua to query the name of the current capture file being loaded?

asked 04 Aug '15, 18:42

mfbaker's gravatar image

mfbaker
16●4●4●8
accept rate: 0%

edited 04 Aug '15, 18:44

One Answer:

0

Not that I know of.

Are you doing this in tshark, or wireshark, or both?

If you're doing this in Wireshark, then you should probably not do it automatically but instead only when the user tells you to, like through a menu command - in which case you could have them type a folder name to use in a dialog window when they select that menu item. (i.e., have the Lua script add a menu item called "Export PNG...", and have that create a window for text input of the folder name)

If you're doing this in tshark, then you should probably still not do it automatically, but only if they load your script with the "tshark -r [capture_filename] -X lua_script:png_export.lua" command switch - in which case you can have an argument passed to your script as well, by doing "tshark -r [capture_filename] -X lua_script:png_export.lua -X lua_script1:[folder_name]".

answered 04 Aug '15, 19:09

Hadriel's gravatar image

Hadriel
2.7k●2●9●39
accept rate: 18%

It is only for wireshark. I did add a menu item to only write the image files if a menu item is selected to do so:

local ImageDumpOn = false
local ImageDumpMenuText = "Toggle RFBTV Image Dump"

local function toggleImageDump()
if ImageDumpOn then
ImageDumpOn = false
else
ImageDumpOn = true
end
end


register_menu(ImageDumpMenuText, toggleImageDump, MENU_TOOLS_UNSORTED)
(04 Aug ‘15, 19:18) mfbaker

I am writing a wireshark lua dissector for a propietary protocol, and am still looking for an answer to the question I posted about a month ago. Is there a way in lua to query the name of the current capture file being loaded? The packets include embedded .png files that I would like to write to an output folder named “ImageDump_<capturefilename>”.

(27 Aug ‘15, 17:07) mfbaker