I am analyzing a very large PCAP containing many HTTP transactions, some of which interest me. I use tsharkwith Lua script to request all packages matching filter.
tshark -X lua_script:filter.lua -r some.pcap -q
So far so good. However, I am looking specifically at the value of the TCP stream packet number, which goes by name tcp.streaminside Wireshark. Can you tell me what changes I need filter.luato print?
do
local function init_listener()
local tap = Listener.new("http","http contains someKeyValue && tcp.port eq 1234")
function tap.reset()
end
function tap.packet(pinfo,tvb,ip)
print("Found my packet ... now what?")
end
function tap.draw()
end
end
init_listener()
end
Documentation of that pinfo, tvband ipis inappropriate.
source
share