This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

use Wireshark’s Lua interpreter stand alone

0

When I just want to quickly test some bits of Lua code that doesn't involve capturing traffic or analyzing a pcap, is there a way I can evoke the Lua interpreter embedded in Wireshark?

I know I can down load Lua itself, but it doesn't have all the Wireshark specific stuff like the new UInt64 objects. It doesn't even have bit op.

When I use the Lua "evaluate" option under tools, it doesn't print out anything even if I have a print statement. And I can't even find Lua in the menu anymore in the new Wireshark 1.11.3.

So far I've been trying out my code bits by doing the command tshark -X lua_script: myScriptname

I will see the output from my script and then I quickly end the command as I'm not interested in the capturing on Ethernet that happens right afterwards.

Is there an easier way?

And I assume the answer may be different on what OS you use. I use both Mac and Windows.

Thanks so much.

asked 06 Mar '14, 15:05

YXI's gravatar image

YXI
21182023
accept rate: 0%


3 Answers:

2

It's technically possible to achieve it, by writing a Lua script that creates a console window, accepts user input, and calls loadstring() on the strings/chunks the user inputs. In fact my guess is someone's written a Lua "interpreter" as a Lua script somewhere, that you could use as a baseline to write such a console app.

But I don't do that personally - I just mostly use tshark with the -X lua_script: command switch. Basically I just keep a file open in my text editor called "test.lua", and use: tshark -r empty.pcap -X lua_script:test.lua to run my test script. Then all I have to do is up-arrow and run that command again and again, as I modify+save my test.lua file in my editor. And I use an empty pcap file so I don't have to ctrl-c to stop tshark, but instead just tell it to read that empty one in (using the -r switch), which keeps it silent.

In the more recent 1.11 nightly builds you can also pass arguments to your Lua script through the commandline, which was mostly added to help create some testsuites to test the Lua functions. But I rarely use that feature other than for those testsuites.

answered 06 Mar '14, 15:18

Hadriel's gravatar image

Hadriel
2.7k2939
accept rate: 18%

Thanks. The empty pcap file is a great idea!

(06 Mar '14, 20:02) YXI

0

Oh, and I suppose I should point out, lest someone go try and write a Lua interpreter-window script, that you wouldn't be able to do some things in it anyway... because some things are only allowed by wireshark when it's loading scripts itself.

For example creating new protocol dissectors (ie, the Proto class/object), or creating protocol field extractors, or creating menus, etc. Those things have to happen at a specific time, and they happen right after Wireshark loads the Lua scripts but before anything else, and never again.

answered 06 Mar '14, 15:42

Hadriel's gravatar image

Hadriel
2.7k2939
accept rate: 18%

0

Heh, you actually answered this question yourself in another topic - the "Evaluate" menu item under Tools->Lua appears to do what you want. For example, you can have it print to your shell using:

print("hello world")

Or have it print to the Console dialog window created by Tools->Lua->Console using the logging facilities, such as:

message("hello world")

answered 06 Mar '14, 21:59

Hadriel's gravatar image

Hadriel
2.7k2939
accept rate: 18%

For Windows, message() works. print() still doesn't work, even when I have a console window open, or start Wireshark from a shell.
For some reason, I got the QT version on my mac and the GTK+ version on my windows. So can't try this on the mac.

(07 Mar '14, 13:14) YXI

On the Mac, it should be in /usr/local/bin, so you can start the GTK version from a terminal shell using /usr/local/bin/wireshark, vs. the Qt version using /usr/local/bin/wireshark-qt. Or at least that's how it is on my Mac. If it put it somewhere else, do a which wireshark.

(07 Mar '14, 14:34) Hadriel

From the nightly build a couple of weeks ago, I got:

Windows: Both wireshark(GTK+) and qtshark under C:\Program Files\wireshark

Mac: Only wireshark under /usr/local/bin, and it is the qt version. I guess Mac download didn't come with the GTK+ version.

(13 Mar '14, 10:01) YXI

Huh, yeah it looks like you're right - I just tried the latest nightly build and it only installed the Qt one, and in its package file it only has the Qt one. Hmmm... might be a bug.

(13 Mar '14, 10:19) Hadriel

Filed bug 9881 - we'll see if it's really a bug or by design.

(13 Mar '14, 10:23) Hadriel

Wasn't it all those Mac users complaining about how ugly the GTK build looked that was one of the reasons for the switch to QT :-)

They get to live the new life first.

(13 Mar '14, 10:27) grahamb ♦

Well the GTK one really is ugly on a Mac (and doesn't use normal Mac keyboard shortcuts, etc.). The Qt one is a breath of fresh air. :)

Unfortunately, the Qt one is still very limited - it's missing tons of stuff, and some stuff it appears to have doesn't work yet. So as a Mac user I feel like a second class citizen if 1.11 Windows builds have all the features, whereas Mac builds don't.

Since the nightly 1.11 builds are meant to be the bleeding edge development builds eventually leading to 1.12... maybe all 1.11 builds should be Qt-only?

(13 Mar '14, 12:00) Hadriel
showing 5 of 7 show 2 more comments