Build Information:
Wireshark 2.0.4 (v2.0.4-0-gdd7746e from master-2.0)
Copyright 1998-2016 Gerald Combs <[email protected]> and contributors.
License GPLv2+: GNU GPL version 2 or later
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with Qt 5.3.2, with libpcap, without POSIX capabilities, with
libz 1.2.5, with GLib 2.36.0, with SMI 0.4.8, with c-ares 1.10.0, with Lua 5.2,
with GnuTLS 2.12.19, with Gcrypt 1.5.0, with MIT Kerberos, with GeoIP, with
QtMultimedia, without AirPcap.
Running on Mac OS X 10.11.5, build 15F34 (Darwin 15.5.0), with locale C, with
libpcap version 1.5.3 - Apple version 54, with libz 1.2.5, with GnuTLS 2.12.19,
with Gcrypt 1.5.0.
Intel(R) Core(TM) i7-4870HQ CPU @ 2.50GHz (with SSE4.2)
Built using llvm-gcc 4.2.1 (Based on Apple Inc. build 5658) (LLVM build
2336.9.00).
TShark (Wireshark) 2.0.4 (v2.0.4-0-gdd7746e from master-2.0)
Copyright 1998-2016 Gerald Combs <[email protected]> and contributors.
License GPLv2+: GNU GPL version 2 or later
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with libpcap, without POSIX capabilities, with libz 1.2.5,
with GLib 2.36.0, with SMI 0.4.8, with c-ares 1.10.0, with Lua 5.2, with GnuTLS
2.12.19, with Gcrypt 1.5.0, with MIT Kerberos, with GeoIP.
Running on Mac OS X 10.11.5, build 15F34 (Darwin 15.5.0), with locale
en_US.UTF-8, with libpcap version 1.5.3 - Apple version 54, with libz 1.2.5,
with GnuTLS 2.12.19, with Gcrypt 1.5.0.
Intel(R) Core(TM) i7-4870HQ CPU @ 2.50GHz (with SSE4.2)
Built using llvm-gcc 4.2.1 (Based on Apple Inc. build 5658) (LLVM build
2336.9.00).
--
I have written a post dissector in Lua for Wireshark/tshark. In the post
dissector, I needed to fetch some information using a Python api, so it writes
a python file that does so to /tmp/, then runs it using os.execute(). The
python file writes its output to /tmp/foo, and then the dissector reads in
/tmp/foo to get the information I need.
In tshark, this process works perfectly, and it displays everything I need.
After running tshark, I can check /tmp/ and see both the python file there, as
well as the foo file that the python file writes.
In wireshark, lua writes the python file, but when it runs the python file, the
python file doesn't write its output to /tmp/foo. That is, after loading the
lua plugins, there is no new foo file in /tmp/, only the python file itself.