Wireshark-dev: [Wireshark-dev] Lua script: get to HTTP GET / POST body

From: varname <varname@xxxxxxxxx>
Date: Sat, 20 Feb 2010 18:30:28 +0100
Hi,

I hope this hasn't been answered somewhere before (I did my best
searching the various sources of information (wiki, mailinglists, user
guide)), but I'm trying to get to the body of a HTTP GET and / or POST
inside a Lua script for wireshark.

As I'm a complete starter with Lua and scripting Wireshark, I'd
appreciate it if someone could provide me with some pointers. In
particular:

 - do I need to implement a Tap Listener or a (post)-dissector (in a
Lua script)?
 - after I've figured that out, is there any Field I can access that
contains the body data?
 - does the fact that the body could be multiple tcp packets long
influence any of this, or should the HTTP dissector take care of
reassembly?

Using a capture filter (on content-type and response code) I managed
to get my tap listener to be called only after a successful match, but
didn't see how to get to the body of the response. I thought about
using a (post)dissector but am at a bit of a loss again as to how to
get to the body.

I found this [1] thread from sept 2008 where Roasio asks the same
question, but it seems to end in "does not work, but should".

Regards,


[1] http://www.wireshark.org/lists/wireshark-dev/200809/msg00018.html