' ' QFIELD.vbs - Print all instances of a given field in a capture file ' Set Sout = WScript.Stdout ' ----------------------- ' Check usage & arguments ' ----------------------- if WScript.Arguments.Count <> 3 then Sout.Writeline "Usage: qfield LAYER FIELD" WScript.Quit end if ArgFile = WScript.Arguments.Item(0) LayerName = WScript.Arguments.Item(1) FieldName = WScript.Arguments.Item(2) Set UnsniffDB = CreateObject("Unsniff.Database") UnsniffDB.Open(ArgFile) Set PacketStore = UnsniffDB.PacketIndex For Each Packet in PacketStore Set ProtocolLayers = Packet.Layers For Each Layer In ProtocolLayers If Layer.Name = LayerName Then Set Fld = Nothing Set Fld = Layer.FindField (FieldName) If Not Fld Is Nothing Then PrintField Fld End If End If Next Next UnsniffDB.Close() Sub PrintField (Field) Sout.Write Field.Name & _ " ( " & Field.Value & " )" & _ " [ s: " & Field.SizeBits & _ " o: " & Field.OffsetBits & " ]" & vbCrLf If Field.SubFieldCount > 0 Then For Each SubField in Field.SubFields PrintField SubField Next End If End Sub