Wireshark · Wireshark-users: [Wireshark-users] LUA-script in Tshark

[Gisle Vanem <gisle.vanem@xxxxxxxxx>]

Hello list.

I use this .lua-script:
  https://github.com/VE3NEA/Afedri-Dissector/blob/master/afedri.lua

to dissect traffic to/from my newly acquired short-wave radio.
First I used windump to generate a 4GByte capture (10 minutes
of control + data on port 50000). Then wanting to see the details
of these Afedri protocols, I started Tshark in verbose mode (-V):
  tshark -X afedri.lua -V -O Afedri,Afedri-iq -c20 -r recording-1.pcap | less

But I get lines like:

  Frame 1-3: the 3-way TCP handshake. Why does tshark print this when I
     used the '-O' option.

  Frame 4: 63 bytes on wire (504 bits), 63 bytes captured (504 bits)
  Ethernet II, Src: ASUSTekC_81:2e:ea (e0:3f:49:81:2e:ea), Dst: e6:1f:35:31:35:30 (e6:1f:35:31:35:30)
  Internet Protocol Version 4, Src: 10.0.0.10, Dst: 10.0.0.50
  Transmission Control Protocol, Src Port: 51974, Dst Port: 50000, Seq: 1, Ack: 1, Len: 9
  Afedri Protocol Data

  Frame 5: 63 bytes on wire (504 bits), 63 bytes captured (504 bits)
  Ethernet II, Src: e6:1f:35:31:35:30 (e6:1f:35:31:35:30), Dst: ASUSTekC_81:2e:ea (e0:3f:49:81:2e:ea)
  Internet Protocol Version 4, Src: 10.0.0.50, Dst: 10.0.0.10
  Transmission Control Protocol, Src Port: 50000, Dst Port: 51974, Seq: 1, Ack: 10, Len: 9
  Afedri Protocol Data
  ....


All-though I get details for the data-protocol (which use UDP):
  Frame 20: 1070 bytes on wire (8560 bits), 1070 bytes captured (8560 bits)
  Ethernet II, Src: e6:1f:35:31:35:30 (e6:1f:35:31:35:30), Dst: ASUSTekC_81:2e:ea (e0:3f:49:81:2e:ea)
  Internet Protocol Version 4, Src: 10.0.0.50, Dst: 10.0.0.10
  User Datagram Protocol, Src Port: 50000, Dst Port: 50000
  Afedri Protocol Data
      header: 0x8404 (16-Bit data, large packet)
      sequence number: 58371 (0xE403)
      I/Q data, 256 2x16-bit samples
           (  -176,    -40)(   169,      3)(   110,   -131)(  -110,   -133)
           (    24,    192)(   129,   -142)(  -115,      4)(    81,    138)
           (   131,    -88)(  -216,   -141)(  -105,    115)(    95,    -78)
           (    89,   -187)(    -6,    115)(   119,    -58)(  -119,    -55)
           ...

I'd like more packet details, but only for protocols specified with
'-O'. Is this an issue with the Afedri.lua script, Tshark or did I use
the script wrong? Is this possible?

PS. The page at https://wiki.wireshark.org/Lua
    specifies one has to use '-X lua_script:file'. That prefix seems
    not needed.

--
--gv