ntop / wireshark-ntop

Extensions for Wireshark

wireshark-ntop

This repository contains open source extensions for Wireshark.

Here you can find:

• The ntopdump extcap module: it can be used to open a PF_RING interface (also those that are not listed in ifconfig) or to extract traffic from a n2disk dumpset.
• The remotentopdump extcap module: it can be used to capture traffic from a PF_RING interface on a remote machine, or extract traffic from a remote n2disk dumpset in Wireshark.
• The ndpi plugin: it shows L7 protocol information provided by nDPI to complement internal protocol decoding. In order to do this, the ndpiReader application is used to provide Wireshark nDPI protocol dissection, and the ndpi plugin interprets nDPI information.
• The sflow_tap Wireshark Lua plugin (in this folder): it shows summaries of sFlow agents flow and counter samples.
• The Hardware Flow Offload Dissector dissector: it can dissect messages produced by the hardware flow offload engine when flows are computed in hardware.

Enjoy!

wireshark-ntop's Issues

Error While Loading sflow_tap.lua

Hello There,

1. Below is my system details

   • Wireshark Version 1.10.14
   • CentOS Linux release 7.5.1804 (Core)

2. I am placing the sflow_tap.lua into /usr/lib64/wireshark/plugins/1.10.14

3. Upon launching Wireshark I got the following error,

Lua: Error during loading:
 [string "/usr/lib64/wireshark/plugins/1.10.14/sflow_tap.lua"]:179: bad argument #1 to 'new' (Field_new: a field with this name must exist)

4. Can anyone help?

Thank you very much!

Rgds,
YeongWei

debug statements uncommented in release code

Is there a utility file that should be loaded or just comment them out?

Lua: Error during execution of Menu callback:
 ...rs\admin\AppData\Roaming\Wireshark\plugins\sflow_tap.lua:516: attempt to call global 'debug' (a table value)

   debug(string.format("creating tap with filter: '%s'", listener_filter))
   local tap_sflow = Listener.new(nil, listener_filter)