Scripting wireshark with lua

December 09, 2009 at 06:44 AM | categories: tips | View Comments

While attempting to wrap some wireshark processing with a bash script, I discovered that I didn't need to write complex bash code at all, because wireshark has a built-in scripting language. Even better, it's a common scripting language: lua. It looks like Debian and its derivatives ship wireshark with lua support, but for everything else, you'll have to rebuild the package to enable it. There's a great page of examples and the api is really simple. And for those cases where you don't want to use the wireshark GUI, lua scripts work just fine with tshark.

If lua is overkill for the task at hand, tshark also offers decent control over what shows up in the output. If you want to see all HTTP requests and their request URI and method, without any other information about the packet, this tshark command will do the trick:

tshark -T fields -e http.request.method -e http.request.uri -R 'http'