CODEWITHSUNDEEP
linuxwiresharkpacket-capturetsharkwireshark-dissector
Shen Li
Shen Li

Reputation: 411

How to apply and override preferences with tshark?

I am writing a plugin for wireshark-1.9.2. We do not have GUI on the server, so we use tshark. My question is how to add and apply new preferences with tshark?

My $HOME/.wireshark/preferences file contains only one line:

ls_payload_display_len: 20

When I run tshark, I get a warning: 

Syntax error in preference ls_payload_display_len (applying your preferences once should remove this warning)

I can access the value of the preference in the dissector code with function prefs_register_uint_preference(...). But I cannot override it with the -o option when start tshark:

tshark: Invalid -o flag "ls_payload_display_len:80"

So, the two questions are:

  1. How do I apply my preferences file with tshark, so that the syntax error warning won't show again?
  2. How do I override preferences values with the -o option of tshark?

Thanks.

Upvotes: 1

Views: 2438

Answers (1)

user862787
user862787

Reputation:

It appears that for an attempt to set a non-existent preference, Wireshark and TShark don't report it as a non-existent preference, they report it as a "Syntax error in preference" in the preferences file and as an "Invalid -o flag" on the command line.

prefs_register_uint_preference() takes, as its first argument, a pointer to a module_t, so you must have referenced a preferences module. The prefs_register_module() call takes a name argument, so the module has a name; the full name for your preference includes the module name, so, if your preference module's name is "my_protocol", your preference's name would be "my_protocol.ls_payload_display_len", and you would have to use that full name in the preferences file and on the command line, e.g. 

my_protocol.ls_payload_display_len: 20

and

tshark -o my_protocol.ls_payload_display_len:80

Upvotes: 1

Related Questions