varname wrote:
I hope this hasn't been answered somewhere before (I did my best
searching the various sources of information (wiki, mailinglists, user
guide)), but I'm trying to get to the body of a HTTP GET and / or POST
inside a Lua script for wireshark.
to answer my own question:
to get to the body of a HTTP response from a Lua script, you can do the
following (in fi a tap for HTTP packets):
____________________________________________________________
-- this is for text-based bodies (text/html, etc)
http_data_text_f = Field.new("data-text-lines")
-- for media-based bodies (media/*)
http_media_f = Field.new("media")
...
http_body = http_data_text_f()
http_media = http_media_f()
...
[do whatever you want]
____________________________________________________________
I found the field names looking through the epan/dissectors/* files (the
'filters' parameter to the 'proto_register_protocol' function in the
'proto_register_*' functions?). Others probably also work (like
image/gif, image/jpeg, etc).
Data is returned as userdata; I haven't figured out yet how to do any
further processing on it in Lua.
Lengths of bodies and media fields seem to work out with what regular
wireshark reports, YMMV.
regards
