Harvey's profile - activity

Hello, I open the “Enabled Protocols” dialog box, press Disable All then Wireshark shut down... Is there another way to suppress all the Protocols ?

The “Enabled Protocols” dialog box Hello, I open the “Enabled Protocols” dialog box, press Disable All then Wireshark sh

Here it is GIP.lua And some data in case : data_gip then running tshark -r test_210.pcapng -X lua_script:gip.lua -Q >

Thank you for your expertise, it is very interresting for me. I still continue to analyze on my side

for example : (ip.src == 192.168.167.200) && (ip.dst == 192.168.167.205) where IP_SOURCE = 192.168.167.200 an

Here it is GIP.lua And some data in case : data_gip then running tshark -r test_210.pcapng -X lua_script:gip.lua -Q >

Hello grahamb, here it is: capture Frames 32,32,34,36 are not really retransmission I think ¯_(ツ)_/¯

Hello grahamb, here it is: capture Frames 32,32,34,36 are not really retransimmsion I think ¯_(ツ)_/¯

Hello grahamb, here it is: link text Frames 32,32,34,36 are not really retransimmsion I think ¯_(ツ)_/¯

Hello grahamb, I read your comment and took it into account, but my problem here is to understand why the printing is no

sorry I posted too fast. By doing the same test as cmaynard, I got the same problem; In fact I was running the following

Hello I wrote a lua dissector, which displays correcly most of the frames. But for the frames marked as "(suspected) retransmission" , the dissector is not invoke... How can I correct this ?

Hello, I made some definition :

frame_type = ProtoField.int16("TGIP.frame_type" , "frameType" , base.DEC,families)
…
chunk_count = ProtoField.new("TGIP.chunk_count", "chunkCount", ftypes.UINT32)

When it is displayed : ![https://www.dropbox.com/s/93bu0pbuan4moja/Capture.JPG?dl=0]

I don't understand why one fied use "frameType" and the other "TGIP.chunk_count" and not "chunkCount" ?

My lua script works more or less. Now, I want to use it to write some of the extracted data to a XML file. I want to use the same script file, so I decided to test if there is argument send to the script.

1. If yes, this means the script is called from command line with tshark, and then I can write specific data.
2. If no, this means it is call from Wireshark so I wiil not record XML file this time.

My problem is that when I call from command line with :

tshark -r test_210.pcapng -Y tgip -q > test.txt -X lua_script1:arg1 -X lua_script2:arg2

The arguments are not seen by the script, I suppose it is because I don't use -X option. With :

tshark -r test_210.pcapng -X lua_script:Gip.lua -Q  -X lua_script1:arg1 -X lua_script2:arg2

I have an error : Gip.lua:34: bad argument #2 to 'Proto' (Proto_new: there cannot be two protocols with the same description) I suppose it is because the script is all ready loaded, and I call it again with -X.

Do you any idea to solve this ?

print scope Hello, I'm a newbie for lua, even though lua is very powerful, fortunately there is the forum to find some a

Thanks a lot , I had misread the documentation. Your comment on lua_script1 is interresting and relevant. Sure gui_ena

lua_scriptnum:argument My lua script works more or less. Now, I want to use it to write some of the extracted data to a

Because these lines display only raw data, and not "translated" through the dissector. For me these are not really retra

When the preference is set to enable, the TCP dissector correctly reassembles the stream, that's fine !! But unfortunatl

(suspected) retransmission Hello I wrote a lua dissector. For the frames marked as "(suspected) retransmission" , If

lua dissector not called Hello I wrote a lua dissector, which displays correcly most of the frames. But for the frames m

lua dissector not called Hello I wrote a lua dissector, which displays correcly most of the frames. But for the frames m

Thank you very much, it is displayed correctly. I did not pay attention to that.

Disabling Allow subdissector to reassemble TCP stream works fine Do not call subdissectors for error pack

lua dissector not called Hello I wrote a lua dissector, which displays correcly most of the frames. But for the frames m

How ProtoField name are displayed ? Hello, I made some definition : frame_type = ProtoField.int16("TGIP.frame_type" , "