This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Greetings,

I’m having trouble extracting ipv6 fields (e.g. ipv6.src) using tshark and Lua.

There’s no problem with tshark because it successfully extracts ipv6.src etc. (e.g. tshark –r %1 -e ip.src -e ipv6.src -Tfields -E separator=, ). Rather, the problem arises when tshark is fed a Lua script (e.g. tshark -q -r %1 -X lua_script:LuaScript.lua)

The essence of the Lua script is shown below:

...
ip_src_extractor = Field.new("ip.src")

ipv6_src_extractor = Field.new("ipv6.src")
   ...
local tap = Listener.new(pinfo, tvb, ip)
…
    local ip_src_f = ip_src_extractor()

    local ipv6_src_f = ipv6_src_extractor()

    local foo_tbl = {
        …
        [“ip”] = { [“src”] = ip_src_f, … },
        [“ipv6”] = { [“src”] = ipv6_src_f, … },
        …
    }
…
end --tap

For ipv6 packets, nothing gets written into foo_tbl.ipv6.src and its content remains nil. Other fields (are extracted successfully and no problem extracting ipv4 fields.

So, unless there’s another step required for ipv6 I’m led to believe the problem rests with the Lua API (?)

It appears that the link below is related (?): https://ask.wireshark.org/questions/23519/ipv6-dissecting-throws-lua-ft-not-yet-supported-error-why

There's no evidence of a bug being raised. If it is a real issue (not due to method) it seems a fairly big shortcoming.

Thanks and Regards,

KDR

asked 23 Sep '16, 00:15

KDR's gravatar image

KDR
6112
accept rate: 0%

Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×431
×51
×26

question asked: 23 Sep '16, 00:15

question was seen: 1,180 times

last updated: 23 Sep '16, 00:15

p​o​w​e​r​e​d by O​S​Q​A