-- this is going to be our counter
http_packets = 0
-- this is going to be our tap
tap_http = nil
-- first we declare the tap called "http tap" with the filter it is going to use
tap_http = new_tap("mytap","ip.addr == 10.0.1.3 && http")
-- then we define a function to (re)initialize our counter
-- this one is going to be called every time the capture restarts (2)
function tap_http.init()
http_packets = 0
end
-- this function will get called at the end(3) of the capture to print the summary
function tap_http.draw()
print("http packets:",http_packets)
end
-- this function is going to be called once each time the filter of the tap matches
function tap_http.packet()
http_packets = http_packets + 1
-- We return true to have ethereal printing a report every few seconds
-- if we returned false ethereal would call the draw function never
return true
end
GUI方式
-- text_window_tap.lua
-- an example of a tap that registers a menu
-- and prints to a text window
instances = 0 -- number of instances of the tap created so far
function mytap_menu()
instances = instances + 1
local td = {}
-- the tap data, passed to every function of the tap
-- beware not to use a global for taps with multiple instances or you might
-- find it been written by more instances of the tap, not what we want.
td.win = TextWindow.new("My Tap " .. instances) -- the window we'll use
td.text = "" -- the text of the tap
td.instance = instances -- the instance number of this tap
-- this tap will be local to the menu_function that called it
-- it's called mytap
-- has no filter (filter = nil)
-- and we pass to it the tap data so that it gets passed to the tap's functions
local tap = new_tap("mytap"..instances,nil, td)
-- make sure the tap doesn't hang arround after the window was closed
td.win:at_close(remove_tap,tap)
-- this function will be called for every packet
function tap.packet(pinfo,tvb,tapdata)
local text = "packet " .. pinfo.number
tapdata.text = tapdata.text .. "\n" .. text
-- print("packet " .. pinfo.number, tapdata.instance)
end
-- this function will be called once every few seconds to redraw the window
function tap.draw(tapdata)
tapdata.win:set(tapdata.text)
-- print("draw", tapdata.instance)
end
-- this function will be called before every run of the tap
function tap.init(tapdata)
tapdata.text = ""
-- print("init", tapdata.instance)
end
end
-- last we register the menu
-- the first arg is the menu name
-- the 2nd arg is the function to be called
-- the third argument (defaults to false) tells to re-run the capture once the function is run
register_menu("Lua Tap Test",mytap_menu,true)
-- create a function to dissect it
function trivial_proto.dissector(buffer,pinfo,tree)
pinfo.cols.protocol = "TRIVIAL"
local subtree = tree:add_item(trivial_proto,buffer(),"Trivial Protocol Data"):add_subtree()
subtree:add_item(buffer(0,2),"The first two bytes: " .. buffer(0,2):uint())
end
-- load the udp.port table
udp_table = DissectorTable.get("udp.port")
-- register our protocol to handle udp port 7777
udp_table:add(7777,trivial_proto)
-- create the fields for our "protocol"
src_F = ProtoField.string("trivial.src","Source");
dst_F = ProtoField.string("trivial.dst","Destination");
conv_F = ProtoField.string("trivial.conv","Conversation","A Conversation");
-- add the field to the protocol
trivial_proto.fields = ProtoFieldArray.new(src_F, dst_F, conv_F)
-- create a function to "postdissect" each frame
function trivial_proto.dissector(buffer,pinfo,tree)
-- obtain the current values the protocol fields
local tcp_src = tcp_src_f()
local tcp_dst = tcp_dst_f()
local ip_src = ip_src_f()
local ip_dst = ip_dst_f()
if tcp_src then
local subtree = tree:add_item(trivial_proto,"Trivial Protocol Data"):add_subtree()
local src = ip_src .. ":" .. tcp_src
local dst = ip_dst .. ":" .. tcp_dst
local conv = src .. "->" .. dst
subtree:add_item(src_F,src)
subtree:add_item(dst_F,dst)
subtree:add_item(conv_F,conv)
end
end
-- register our protocol as a postdissector
register_postdissector(trivial_proto)