This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

What's the Lua to get a specific octet out of the destination IP address of a packet?

asked 14 Feb '12, 01:32

Leena's gravatar image

Leena
51171821
accept rate: 0%

edited 15 Feb '12, 06:06

helloworld's gravatar image

helloworld
3.1k42041

By "check", do you mean "get the value of"?

Where is this IP from? The source IP address of a packet? A buffer? An Address variable?

(14 Feb '12, 09:35) bstn

I get the ip address from wireshark using lua and then I want to be free in making any process I want in each octet in the destination ip address with Lua.

(14 Feb '12, 23:34) Leena

The packet's IP destination is contained in pinfo.dst, which is an Address, which only gives the string representation of the IP address. You can use Lua patterns (similar to regular expressions) to parse the individual octets from the IP address, as shown in the following example:

function tap.packet(pinfo, buffer)
    local ip = tostring(pinfo.dst)
    local o1,o2,o3,o4 = ip:match("(%d%d?%d?)%.(%d%d?%d?)%.(%d%d?%d?)%.(%d%d?%d?)" )
    print(o1,o2,o3,o4)
end

Note that the values (o1, o2, etc.) are of string type. Use number conversion if necessary (i.e., tonumber(o1), tonumber(o2), etc.).

permanent link

answered 15 Feb '12, 14:58

helloworld's gravatar image

helloworld
3.1k42041
accept rate: 28%

Thanks very much Helloworld, you always helps me a lot.

(15 Feb '12, 23:00) Leena

Please accept the answer by clicking on the "tick" if it solves your issue.

(16 Feb '12, 03:31) grahamb ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×431

question asked: 14 Feb '12, 01:32

question was seen: 4,888 times

last updated: 16 Feb '12, 03:31

p​o​w​e​r​e​d by O​S​Q​A