Hi,
I started to use MATE to link packets to each other in Wiresharl/Tshark
and do some analysis on the set. I was able to get some things working
aleady and I think it is a great plugin. I do have some questions
though. When I look at the information on the Wiki I am a bit confused
by the two syntax formats.
The first format is like:
Pdu dns_pdu Proto dns Transport ip {
Extract addr From ip.addr;
Extract dns_id From dns.id;
Extract dns_resp From dns.flags.response;
};
The second format is like:
Action=Transform; Name=start_cond; attr1=aaa; attr2=bbb; .msg_type=start;
Action=Transform; Name=start_cond; attr3=www; attr2=bbb; .msg_type=start;
Action=Transform; Name=start_cond; attr5^a; .msg_type=stop
Action=Transform; Name=start_cond; attr6$z; .msg_type=stop;
Action=PduDef; Name=pdu; ...
Action=PduTransform; For=pdu; Name=start_cond;
Action=GopDef; Name=gop; ...
Action=GopStart; For=gop; msg_type=start;
Action=GopStart; For=gop; msg_type=stop;
At this time I find the first format much more clear, but most of
the examples use the second format.
Are the two totally interchangeable?
If so, how should I translate one to the other? Any general rules on that?
If not, which of the two is the "richest"? Is one just a replacement to
the other?
Another question is how MATE and LUA relate to each other, I know LUA is
far more extensive in its possibilities, but is it also possible to easily
write LUA scripts for the things MATE is good at? Ie, would learning to
write LUA scripts make learning to write MATE scripts obsolete?
Cheers,
Sake
