Wireshark · Wireshark-users: Re: [Wireshark-users] The best method to extract the subset of HTTP fields from the live traffic

[Abhik Sarkar <sarkar.abhik@xxxxxxxxx>]

Hi,

From your question, it seems the data you wish to extract are not known fields. However, it's not clear what you are after. If it's non-standard HTTP headers you are after, it's possible for them to be added as fields (which will then appear in pinfo).

If that works, you could either continue with your LUA tap, or you could also check the option of running tshark with the "-T fields" option and extracting specific fields (with -e) you want. See the manpage for more info.

Hope this helps.

Abhik.

On 6 January 2016 at 20:01, Vitaly Repin <vitaly.repin@xxxxxxxxx> wrote:

Hello,

I am trying to extract specififc subset of HTTP fields from the live
stream and I need wireshark experts' advices on the best way to do
this.

It looks like the following options exist:

1) Output packets in pdml format. Extract the fields I need from the
output data.

2) Use lua scripting to extract the data using the lua functions

It seems to me the second method is better in terms of performance
(pdml output contains huge amount of data which I do not need) and it
should be also simpler in development.

I have written tap in lua but I was able to extract only the fields
delivered through pinfo structure. The question is - how to parse tvb
structure?

Can I accees parsed tvb somehow? Should I get http dissector from
DissectorTable.get("tcp.port"):get_dissector(80) and apply it to the
tvb? Could you point me to example?

Or may be the simplest way is to create post-dissector or chained
dissector and do not to use tap at all?

Thanks in advance!

--
WBR & WBW, Vitaly
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe