Wireshark · Wireshark-users: Re: [Wireshark-users] Lua scripting (obtaining protocol fields)

["Dan Siemon" <dan.siemon@xxxxxxxxx>]

On 9/11/07, Luis EG Ontanon <luis.ontanon@xxxxxxxxx> wrote:

Does this work?

dnsRespNameExtractor = Field.new(" dns.resp.name")

function tap.packet(pinfo, tvb, userdata)
      local table = {dnsRespNameExtractor()}


end

No, that just prints the name in the response.  What I require is the returned result value. For example in a response for www.google.com I need to obtain the returned IP addresses. Or CNAMEs etc.

Hopefully I'm not just missing it but the Wireshark display filter reference doesn't appear to show a way to get this information.
http://www.wireshark.org/docs/dfref/d/dns.html
 

On 9/11/07, Luis EG Ontanon <luis.ontanon@xxxxxxxxx > wrote:
> On 9/11/07, Dan Siemon <dan.siemon@xxxxxxxxx> wrote:
> > However, I haven't been able to figure out how I can get access to parts of
> > the packet data that are not covered by the display filter syntax. The
> > particular example I am working on now involves obtaining the answers in a
> > DNS response packet.
>
> dnsExtractor = Field.new(" dns")
>
> function tap.packet(pinfo, tvb, userdata)
>        local dns_tvb = Tvb.new_real(dnsExtractor())
>        local id = dns_tvb(0,2):get_uint() -- tvbrange:get_uint()
> end
>
> but that means redissecting dns...
>
> BTW:
>  For which fields the dns dissector does not have display filter fields?
>
>
> if there are multiple instances of a field in a given packet you can
> get a table with them all this way:
>
> xxxs_table = {xxxExtractor()}
>
> or you can:
>
> value1, value2 =  xxxExtractor();
>
>
> --
> This information is top security. When you have read it, destroy yourself.
> -- Marshall McLuhan
>


--
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users