11.9. Saving Capture Files
The classes/functions defined in this module are for using a Dumper object to
make Wireshark save a capture file to disk. Dumper represents Wireshark’s built-in
file format writers (see the wtap_name_to_file_type_subtype function).
(The wtap_filetypes table is deprecated, and should
only be used in code that must run on Wireshark 3.4.3 and earlier 3.4
releases or in Wireshark 3.2.11 and earlier 3.2.x releases.)
To have a Lua script create its own file format writer, see the chapter titled
"Custom file format reading/writing".
11.9.1.1. Dumper.new(filename, [filetype], [encap])
Creates a file to write packets.
Dumper:new_for_current() will probably be a better choice, especially for file types other than pcapng.
Arguments
- filename
-
The name of the capture file to be created.
- filetype (optional)
-
The type of the file to be created - a number returned by
wtap_name_to_file_type_subtype(). Defaults to pcapng.
(The wtap_filetypes table
is deprecated, and should only be used
in code that must run on Wireshark 3.4.3 and earlier 3.4.x releases
or in Wireshark 3.2.11 and earlier
3.2.x releases.)
- encap (optional)
-
The encapsulation to be used in the file to be created - a number entry from the
wtap_encaps table.
Defaults to per-packet encapsulation for pcapng
(which doesn’t have file-level encapsulation;
this will create IDBs on demand as necessary)
and Ethernet encapsulation for other file types.
Returns
The newly created Dumper object
Closes a dumper.
Errors
-
Cannot operate on a closed dumper
Writes all unsaved data of a dumper to the disk.
11.9.1.4. dumper:dump(timestamp, pseudoheader, bytearray)
Dumps an arbitrary packet.
Note: Dumper:dump_current() will fit best in most cases.
Arguments
- timestamp
-
The absolute timestamp the packet will have.
- pseudoheader
-
The
PseudoHeader to use.
- bytearray
-
The data to be saved
11.9.1.5. dumper:new_for_current([filetype])
Creates a capture file using the same encapsulation as the one of the current packet.
Arguments
- filetype (optional)
-
The file type. Defaults to pcapng.
Returns
The newly created Dumper Object
Errors
-
Cannot be used outside a tap or a dissector
11.9.1.6. dumper:dump_current()
Dumps the current packet as it is.
Errors
-
Cannot be used outside a tap or a dissector
A pseudoheader to be used to save captured frames.
11.9.2.1. PseudoHeader.none()
Creates a "no" pseudoheader.
Returns
A null pseudoheader
11.9.2.2. PseudoHeader.eth([fcslen])
Creates an ethernet pseudoheader.
Arguments
- fcslen (optional)
-
The fcs length
Returns
The ethernet pseudoheader
11.9.2.3. PseudoHeader.atm([aal], [vpi], [vci], [channel], [cells], [aal5u2u], [aal5len])
Creates an ATM pseudoheader.
Arguments
- aal (optional)
-
AAL number
- channel (optional)
-
Channel
- cells (optional)
-
Number of cells in the PDU
- aal5u2u (optional)
-
AAL5 User to User indicator
- aal5len (optional)
-
AAL5 Len
Returns
The ATM pseudoheader
11.9.2.4. PseudoHeader.mtp2([sent], [annexa], [linknum])
Creates an MTP2 PseudoHeader.
Arguments
- sent (optional)
-
True if the packet is sent, False if received.
- annexa (optional)
-
True if annex A is used.
- linknum (optional)
-
Link Number.
Returns
The MTP2 pseudoheader