Wireshark-users: Re: [Wireshark-users] A Working Lua Tap Example

From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Wed, 1 Nov 2006 17:42:32 +0100 (CET)

Hi

On Wed, 1 Nov 2006, Leonard Nielsen wrote:

>
> This is my first functional Lua script. Many of the examples on this site
> do not work with the current version so I hope this will help others who
> want to try Lua. This script creates a CSV file with any HTTP or TDS-RPC
> request that takes over x seconds (x is currently set to 20 seconds). I am
> using this to identify which MS-SQL stored procedure is causing which web
> page to time-out.

Cool, put it up the wiki I would say.

> The http tap was fairly straight forward but the tds tap is a real hack.
> tds_type extractor was returning a "userdata" value instead of an integer
> and the TDS dissector does not create fields with the RPC name or
> parameters. I need to find out how to access the reassembled PDU with the
> tvb function instead of the packet data.
>
> One feature I would like see added to Wireshark's Lua is Unicode string
> support. Here is a link to a web page where Lua Unicode support is working
> http://www.workspacewhiz.com/Other/LuaState/LuaState.html
>
> Is anyone working on improving the tds dissector? It seems like freetds.org
> has all of the information needed to decode the parameters.

Is that MSSQL 2005 TDS traffic you're watching? Then see bug 1101. TDS
Version 9 doesn't have a reference (yet).

Thanx,
Jaap