This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

HI,

I have a number of custom lua dissectors all of which contain geo positional data. The location in the packets of the geo positional data is not the same in any of the dissectors. What I am trying to do is take the geo positional data out of the packets and get them to a 3rd party applications that would display the positions all in near real time.

After reading the development documentation I have a possible design that has a few holes that I would like some feedback on.

My though was to create a tap plugin that would grab the positional data then send the data to the 3rd party tool. From the README.tapping this appears to be possible.

Questions:

  1. What is the best way to get my data out of wireshark from the tap to the 3rd party tool? I was thinking about a QUdpSocket but this will take up time from Wireshark’s normal functions. Maybe I could append data to a file for another application to read? Any recommendations?
  2. Can a Tap Plugin have a GUI/Preferences that would allow tap customizations of the fields or protocols that the plugin tap registers to? If this is possible can you point me to an example/documentation/functions that I would use to accomplish this?

Thanks for the help and for making WireShark great.

asked 16 May '16, 08:31

Rob%20B's gravatar image

Rob B
368813
accept rate: 0%

edited 16 May '16, 08:45


Can't you just export the data you need using tshark and -T fields -e field1 -e field2 ...? You can then write the output to a file or pipe it directly to the 3rd party tool if the tool is able to parse it. For example, for normal GeoIP data, you might output something like this:

tshark.exe -r file.pcap -T fields -e frame.number -e ip.src -e ip.geoip.src_city -e ip.geoip.src_country -e ip.dst -e ip.geoip.dst_city -e ip.geoip.dst_country

Just replace the fields with the fields you're interested in from your own Lua dissectors.

permanent link

answered 19 Jul '16, 09:32

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

I ended using this approach.

(22 Jul '16, 15:34) Rob B
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×173
×40

question asked: 16 May '16, 08:31

question was seen: 1,219 times

last updated: 22 Jul '16, 15:34

p​o​w​e​r​e​d by O​S​Q​A