This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have a .lua script that has GUI dependencies that I would like to remove. In other words, the .lua script makes calls to functions such as Field.new(), TextWindow.new(), etc.

I want to either remove GUI altogether or automate the GUI in some way.

Are there non-GUI alternatives to passing in pcap files to a lua script and processing the file without using Field.new(), TextWindow.new(), and Listener.new()?

or is there a way I can have my .lua script open the gui and then execute on the newly opened gui?

Ideally I would never have to open wireshark to run my .lua script.

Thanks for the help

asked 16 Feb '16, 17:35

testname0110's gravatar image

testname0110
15559
accept rate: 75%


I figured it out. To input a pcap file to a lua script you do the following:

"tshark -X lua_script:file.lua -r file.pcap -o rtp.heuristic_rtp -w out"

the -w out keeps the terminal from showing stdout, which speeds up the process from 10 minutes to 1ms.

permanent link

answered 17 Feb '16, 14:20

testname0110's gravatar image

testname0110
15559
accept rate: 75%

Field.new() and Listener.new() aren't GUI dependencies, it's a Shark dependencies - they should work in TShark as well.

TextWindow.new() is a GUI dependency, and you eliminate it by producing your output in some other fashion, e.g. using Lua's input and output facilities.

permanent link

answered 16 Feb '16, 18:08

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

Thanks, that's very helpful. But I still don't understand how Listener.new(), Field.new() are getting inputs from my pcap file.

(17 Feb '16, 10:32) testname0110

They're getting the inputs because the file is being read by Wireshark or TShark and the Lua interpreter embedded inside Wireshark and TShark is given those objects from Wireshark or TShark.

If you want to be able to access them in a version of Lua that is NOT embedded inside Wireshark or TShark, such as the one in the lua command, that will NOT work.

(17 Feb '16, 10:42) Guy Harris ♦♦

Ok I got it. I was piping the input pcap file incorrectly, but thanks for the help!

(17 Feb '16, 14:22) testname0110
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×832
×431
×46
×8

question asked: 16 Feb '16, 17:35

question was seen: 1,491 times

last updated: 17 Feb '16, 14:22

p​o​w​e​r​e​d by O​S​Q​A