Lua open_capture_file in tshark

Question

I want to parse all files in a directory using a Lua tap. The tap is already working, but the problem now is opening snoop files from Lua in tshark. When I try this:

for filename in Dir.open("D:/snoop/","snoop")
do
    local logfile = filename..".csv"
    open_capture_file(filename)
end

I see:

tshark: Lua: Error during loading:
 [string "lua_tap_1.lua"]:88: open_capture_file: GUI not available
Capturing on Microsoft
0 packets captured

Is there anything like open_capture_file() for tshark (not GUI)?

Answer 1

No, there is no Lua function to open a capture file in tshark (as can be seen in the Wireshark User Manual and wiki). Instead, you can use a shell script to pass the files to tshark for Lua tap processing. This would replace the Lua that opens the .snoop files.

For example, this bash script (tested in OSX) passes all .snoop files in the current directory to tshark (one file at a time), where tap.lua processes the file contents.

for x in *.snoop; do tshark -q -Xlua_script:/path/to/tap.lua -r "$x"; done

Parameters:

-q = silences the packet info output from processing the capture file
-Xlua_script = loads a Lua script (unnecessary if file is already in Lua initialization path)
-r = opens a capture file, prints packet info, and then exits

EDIT: No need for -v when -r is provided. In fact, -v prevents -r from doing anything.