Ask Your Question

How can I get current display filter in Lua script with Tshark

asked 2024-04-02 14:47:25 +0000

marcgk gravatar image

updated 2024-04-02 14:50:30 +0000


I'm writing a script in Lua I want to use with Tshark. With this script I want to process a pcap file I feed to Tshark with the '-r' option. In the script I use a tap (listener) to process the packets.

The problem I have is that I want the script to process only the packets that comply with the filter I set with the '-Y' option (or the '-f' option, but that doesn't work in combination with '-r'). In Wireshark I can use the 'get_filter()' function to get the current display filter and give that as an argument to the '' function. But 'get_filter()' doesn't work in Tshark.

Of course I can set the filter hardcoded in the script, but that isn't what I want.

So, is there a way to process only packets that comply with the filter? Some ideas I had, but I don't know if they are possible:

1) Read the display filter value in Lua directly (as 'get_filter()' does in Wireshark)?

2) Read the complete command given at the command line (including -y ....') and parse this command line in Lua to get the filter value?

3) For every packet coming in through 'Listener.packet()' check if it complies with the display filter by checking some value from 'Pinfo'?

4) Can I use the 'get_preference(preference)' function?

5) Some other options?

edit retag flag offensive close merge delete

Comments get_filter() is part of the Gui functions. We could add an "Errors" section like new_dialog() - "GUI not available".

C:\>type get_filter.lua
print("get_filter: " .. get_filter())

C:\>tshark -r test.pcap -Y icmp -X lua_script:get_filter.lua
tshark: Lua: Error during loading:
get_filter.lua:1: get_filter: GUI not available
stack traceback:
        [C]: in function 'get_filter'
        get_filter.lua:1: in main chunk

Could you pass it in as a command line argument to the lua script?
tshark man page:

lua_scriptnum:argument tells TShark to pass the given argument to the lua script identified by 'num', which is the number indexed order of the 'lua_script' command.

Wiki example using command line arguments: Extract field values

get_filter() added in 7725: Add get_filter method to Wireshark's Lua interface

Chuckc gravatar imageChuckc ( 2024-04-02 15:29:26 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2024-04-03 14:15:06 +0000

marcgk gravatar image

I found two ways that seem to work:

1) pipe the output of one tshark ('-w -')to the input of a second tshark ('-r -'). The filtering can then be done in the first tshark with the '-Y <filter>' option and the script can be run in the second tshark.

2) Run tshark with '-2 -R <filter>'

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2024-04-02 14:47:25 +0000

Seen: 49 times

Last updated: Apr 03