Wireshark mailing list archives
Lua Field API and multiple occurences
From: Holger Freyther <holger () freyther de>
Date: Sat, 5 Apr 2014 06:31:26 +0000 (UTC)
Good Morning, I am currently writing an analysis script in Lua for GSM Abis RSL. For releasing a radio channel there is a "RF Channel Release" command and a "RF Channel Release ACK" response. I want to calculate the time that passed between these two. Currently I am doing: local tap = Listener.new("ip", "gsm_abis_rsl.msg_type == 0x2e || gsm_abis_rsl.msg_type == 0x33 ") local ip_src_field = Field.new("ip.src") local ip_dst_field = Field.new("ip.dst") local frame_field = Field.new("frame.number") local time_field = Field.new("frame.time_epoch") local rsl_field = Field.new("gsm_abis_rsl.msg_type") local cbits_field = Field.new("gsm_abis_rsl.ch_no_Cbits") local ts_field = Field.new("gsm_abis_rsl.ch_no_TN") local connections = {} tap.packet(pinfo,tvb,ip) if rsl == "46" then handle_release(....) elseif rsl == "51" then handle_release_ack(...) end end My issue is that using this approach I can miss RSL packets. The equipment we have is using TCP/IP to transport the rsl messages and there is a small header (16 bit length, one byte tag) in front of each of the RSL messages. What happens from time to time is that inside a single frame and TCP packet there are multiple RSL messages. And when this happens rsl_field() will only give me value of the first RSL message. Is there a way to get all the values? holger ___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe
Current thread:
- Lua Field API and multiple occurences Holger Freyther (Apr 04)
- Re: Lua Field API and multiple occurences Hadriel Kaplan (Apr 05)