Wireshark-users: [Wireshark-users] Lua scripting (obtaining protocol fields)

From: "Dan Siemon" <dan.siemon@xxxxxxxxx>
Date: Tue, 11 Sep 2007 14:31:59 -0400

I have been experimenting with Lua scripting in Wireshark over the last little while.  I understand how to obtain packet data with the Wireshark display filter syntax. For example:

dnsResponseExtractor = Field.new(" dns.flags.response")

function tap.packet(pinfo, tvb, userdata)
       local resp = dnsResponseExtractor()

However, I haven't been able to figure out how I can get access to parts of the packet data that are not covered by the display filter syntax. The particular example I am working on now involves obtaining the answers in a DNS response packet.

Any pointers or help on how to accomplish this would be appreciated.