This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

LUA \ Listener - Get ALL IEEE C37.118 within TCP\UDP

Hello,

i am writing my first LUA script in order to display information about each Synchrophasor (IEEE C37.118) packet. I wrote this but the problem is that, not all the synchrophasor packet are seen. I think that only the first synchrophaseur packet is "seen".

How write the function "function tap.packet(pinfo,tvb)" in order to pass through all synchrophasor packet ?

Thanks

local g_fracSec = Field.new("synphasor.fracsec")
local g_soc = Field.new("synphasor.soc")
local function menuable_tap()
    -- Declare the window we will use
    local tw = TextWindow.new("IEEE C37.118 Performances")
    -- this is our tap
    local tap = Listener.new(nill, "synphasor");
    function remove()
            -- this way we remove the listener that otherwise will remain running indefinitely
            tap:remove();
    end
    -- we tell the window to call the remove() function when closed
    tw:set_atclose(remove)
    -- this function will be called once for each packet
    function tap.packet(pinfo,tvb)
            local soc = g_soc()
            local fracSec = g_fracSec()
            tw:append(tostring(soc) .. "\n");
            tw:append(tostring(fracSec) .. "\n");
    end
    -- this function will be called once every few seconds to update our window
    function tap.draw(t)
    end
    -- this function will be called whenever a reset is needed
    -- e.g. when reloading the capture file
    function tap.reset()
            tw:clear()
    end
end

alt text

abc

asked 15 Mar '16, 13:26

SebastienRolle
6●2●2●4
accept rate: 0%

edited 15 Mar '16, 14:04

sindy
6.0k●4●8●51

I've never written a Lua tap, but from the description it seems to me that the function tap.packet is called once per captured frame (there used to be some confusion between "packet" and "frame" so the documentation may mean a frame when talking about a packet). Αs a captured frame may contain more than one C37.118 PDU, you'd have to process these PDUs one by one, which may eventually mean full redissection.

(15 Mar '16, 14:28) sindy

Or, to be more precise after reading the relevant wiki page:

the first argument to listener.new() must be one of supported tap types (actually, PDU types). Empty parameter or nil (not nill) means that the tap handling function will be called once per captured frame.
the second parameter is a filter (in display filter format), yet it is unclear whether the filter would take into account a single PDU or the whole frame.

I am afraid that synphasor (IEEE C37.118) is not a supported tap type, so to obtain the individual values (or counts), your tap function will have to take the tvb and parse it. But before taking that adventure, try to change

local tap = Listener.new(nill, "synphasor");

local tap = Listener.new("synphasor");

You may be lucky in terms that the documentation would be out of date and all known PDU types could be used as taps.

(15 Mar '16, 14:52) sindy

Hm, you are not lucky.

local mytable = Listener.list()
for i, v in ipairs(mytable) do print(i, v) end

shows that synphasor is not an eligible tap type in 2.0.2.

(15 Mar '16, 15:32) sindy

I am not lucky,local tap = Listener.new("synphasor"); not work (as you mentioned). So i need to parse the tvb.... :(

Thanks for all the need yoy gave me. Sébastien

(15 Mar '16, 16:15) SebastienRolle