Wireshark · Wireshark-dev: Re: [Wireshark-dev] Lua script: get to HTTP GET / POST body [sort-of-SOLVED]

[varname <varname@xxxxxxxxx>]

varname wrote:
> I hope this hasn't been answered somewhere before (I did my best
> searching the various sources of information (wiki, mailinglists, user
> guide)), but I'm trying to get to the body of a HTTP GET and / or POST
> inside a Lua script for wireshark.

to answer my own question:

to get to the body of a HTTP response from a Lua script, you can do the 
following (in fi a tap for HTTP packets):

____________________________________________________________

-- this is for text-based bodies (text/html, etc)
http_data_text_f = Field.new("data-text-lines")

-- for media-based bodies (media/*)
http_media_f = Field.new("media")

...

http_body  = http_data_text_f()
http_media = http_media_f()

...

[do whatever you want]
____________________________________________________________


I found the field names looking through the epan/dissectors/* files (the 
'filters' parameter to the 'proto_register_protocol' function in the 
'proto_register_*' functions?). Others probably also work (like 
image/gif, image/jpeg, etc).

Data is returned as userdata; I haven't figured out yet how to do any 
further processing on it in Lua.

Lengths of bodies and media fields seem to work out with what regular 
wireshark reports, YMMV.

regards