I am referring to a thread already answered last summer - http://ask.wireshark.org/questions/4639/extracting-soap-xml-payload?sort=votes&page=1 I got this script working reading off of a pcap with:
Now, I am having a problem running the Lua script on a live capture (here's a sample pcap). In the Lua file, I have
When I run this, I get a stream of data on the screen, but the listener is not picking up anything, and the file is not created. Can anyone help? |
The filter -- tap uses dfilter for tcp data and ignores retransmissions local tap = Listener.new(nil, "tcp &&
creates the <soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:web="http://www.webserviceX.NET/"> <soap:Header/> <soap:Body> <web:ConversionRate> <web:FromCurrency>USD</web:FromCurrency> <web:ToCurrency>CAD</web:ToCurrency> </web:ConversionRate> </soap:Body> </soap:Envelope> -- #6 --------------------------------------------------- <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><ConversionRateResponse xmlns="http://www.webserviceX.NET/"><ConversionRateResult>0.991</ConversionRateResult></ConversionRateResponse></soap:Body></soap:Envelope> -- #8 --------------------------------------------------- <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://www.webserviceX.NET/"> <soapenv:Header/> <soapenv:Body> <web:ConversionRate> <web:FromCurrency>CAD</web:FromCurrency> <web:ToCurrency>EUR</web:ToCurrency> </web:ConversionRate> </soapenv:Body> </soapenv:Envelope> -- #10 --------------------------------------------------- <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><soap:Body><ConversionRateResponse xmlns="http://www.webserviceX.NET/"><ConversionRateResult>0.7711</ConversionRateResult></ConversionRateResponse></soap:Body></soap:Envelope> -- #12 --------------------------------------------------- Thanks, that works great! How would you get this to run off of the network and not a pcap file? Just remove the pcap file? It doesn't seem to work, it will show traffic, but not record anything in the XML file.
(15 Mar '12, 04:29)
pilotgurl86
|
Sorry I had a typo - the last command line is supposed to be;
tshark -R "tcp and data" -X lua_script:/tmp/luaListenr.lua -i lo