Wireshark

  • Riverbed Technology
  • WinPcap
the world's foremost network protocol analyzer
  • Wireshark
    • About
    • Download
    • Blog
  • Get Help
    • Ask a Question
    • FAQs
    • Documentation
    • Mailing Lists
    • Online Tools
    • Wiki
    • Bug Tracker
  • Develop
    • Get Involved
    • Developer's Guide
    • Browse the Code
    • Latest Builds

Wireshark-users: Re: [Wireshark-users] loading user specified decodes

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next


From: Zoran Bošnjak <Zoran.Bosnjak@xxxxxxxxxxxxxxxxxx>
Date: Fri, 5 Sep 2008 15:07:23 +0200

My script loads with no errors, but it does nothing. What is wrong?

The script gets executed for sure. If I print out "asterix" variable, it says "Asterix", which is OK,
but after wireshark starts the user specific decode table is empty.

Here is my script (set_asterix.lua)
-- register asterix to handle specific ports do
    local udp_port_table = DissectorTable.get("udp.port")
    local asterix = udp_port_table:get_dissector(5000)
    udp_port_table:add(2061, asterix)
    udp_port_table:add(2062, asterix)
end

I do:
$./wireshark -X lua_script:set_asterix.lua

Another question is, how do I get a dissector by it's name, not by port?

Zoran
 

-----Original Message-----
From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Luis EG Ontanon
Sent: Thursday, August 28, 2008 11:42 AM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] loading user specified decodes

yes Lua can help you for this:
the very first example in http://wiki.wireshark.org/Lua/Examples does it.

On Thu, Aug 28, 2008 at 10:56 AM, Zoran Bošnjak <Zoran.Bosnjak@xxxxxxxxxxxxxxxxxx> wrote:
> How do I load "user specified decodes" table when starting wireshark?
> Tshark has "-d udp.port==<port>,<proto>" option. Is there any equivalent in wireshark?
> A lua script can be started automaticly... Does lua script have access to load this table?
>
> Zoran
> _______________________________________________
> Wireshark-users mailing list
> Wireshark-users@xxxxxxxxxxxxx
> https://wireshark.org/mailman/listinfo/wireshark-users
>



--
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
https://wireshark.org/mailman/listinfo/wireshark-users

  • Prev by Date: [Wireshark-users] New dissector IEC 60870-5-104
  • Next by Date: Re: [Wireshark-users] TCP Window Sizes
  • Previous by thread: Re: [Wireshark-users] New dissector IEC 60870-5-104
  • Next by thread: [Wireshark-users] Wireshark Window Size
  • Index(es):
    • Date
    • Thread

Wireshark and the "fin" logo are registered trademarks of the Wireshark Foundation