Appearance
Appearance
已用 Wireshark SVN 45134 验证
Taps 是一种从每个 frame 获取数据的机制。它们可以被定义为使用 display filter。
此 tap 旨在作为由 tshark 运行的脚本使用。它统计 trace 期间出现的 HTTP 数据包数量。要在名为 mylan.pcap 的 trace 文件上运行此 tap,并假设 tshark 位于 path 中,可以执行命令 tshark -X lua_script:simple_http.lua -r mylan.pcap
-- simple_http.lua-- implements a very simple tap in Lua-- this is going to be our counterhttp_packets = 0-- this is going to be our taptap_http = nil-- first we declare the tap called "http tap" with the filter it is going to usetap_http = Listener.new(nil,"http")-- this function will get called at the end(3) of the capture to print the summaryfunction tap_http.draw() debug("http packets:" .. http_packets)end-- this function is going to be called once each time the filter of the tap matchesfunction tap_http.packet() http_packets = http_packets + 1end-- this function will be called at the end of the capture runfunction tap_http.reset() http_packets = 0end-- text_window_tap.lua-- an example of a tap that registers a menu-- and prints to a text windowinstances = 0 -- number of instances of the tap created so farfunction mytap_menu() instances = instances + 1 local td = {} -- the tap data, locally accessible by every function of the tap -- beware not to use a global for taps with multiple instances or you might -- find it been written by more instances of the tap, not what we want. -- each tap will have its own private instance of td. td.win = TextWindow.new("My Tap " .. instances) -- the window we'll use td.text = "" -- the text of the tap td.instance = instances -- the instance number of this tap -- this tap will be local to the menu_function that called it local tap = Listener.new() -- callback to remove the tap when the text window closes function remove_tap() if tap and tap.remove then tap:remove() end end -- make sure the tap doesn't hang around after the window was closed td.win:set_atclose(remove_tap) -- this function will be called for every packet function tap.packet(pinfo,tvb,tapdata) local text = "packet " .. pinfo.number td.text = td.text .. "\n" .. text -- debug("packet " .. pinfo.number, tapdata.instance) end -- this function will be called once every few seconds to redraw the window function tap.draw() td.win:set(td.text) -- debug("draw", tapdata.instance) endend-- last we register the menu-- the first arg is the menu name-- the 2nd arg is the function to be called-- the third argument is the menu to hold this new menuregister_menu("Lua Tap Test",mytap_menu,MENU_TOOLS_UNSORTED)-- debug("registered")Imported from https://wiki.wireshark.org/Lua/Taps on 2020-08-11 23:16:13 UTC