This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I compare tshark performances with tsv output with Lua script vs "-T fields" output on HTTP packets. (Disclaimer: Lua is 2x faster!)

I have some differences in output, some HTTP packets are missing in Lua's output. When I digged in, I realized that they concern truncated packets during capture that seem to not match my Listener.new("http")

It seems that if a packet is truncated, in the middle of HTTP for ex, and the dissector can not be fully applied, then Lua's callback on http.packet() is not called.

But my truncated HTTP is well displayed in Wireshark and tshark with "-T fields"

Can someone confirm me this behavior with Lua listeners? Is there a workaround?

asked 16 Dec '15, 01:52

TomLaBaude's gravatar image

TomLaBaude
66171724
accept rate: 66%

Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×431
×184
×13

question asked: 16 Dec '15, 01:52

question was seen: 1,141 times

last updated: 16 Dec '15, 01:52

p​o​w​e​r​e​d by O​S​Q​A