'
' QFIELD.vbs - Print all instances of a given field in a capture file
'
Set Sout = WScript.Stdout
 
' -----------------------
' Check usage & arguments
' -----------------------
if WScript.Arguments.Count <> 3 then
	Sout.Writeline   "Usage: qfield <filename> LAYER FIELD"
	WScript.Quit
end if
 
ArgFile     = WScript.Arguments.Item(0)
LayerName   = WScript.Arguments.Item(1)
FieldName   = WScript.Arguments.Item(2)
 
 
Set UnsniffDB = CreateObject("Unsniff.Database")
UnsniffDB.Open(ArgFile)
 
Set PacketStore    = UnsniffDB.PacketIndex
 
For Each Packet in PacketStore
	Set ProtocolLayers = Packet.Layers
	For Each  Layer In ProtocolLayers
		If Layer.Name = LayerName Then
			Set Fld = Nothing
			Set Fld = Layer.FindField (FieldName)
			If Not Fld Is Nothing  Then
				PrintField Fld
			End If
		End If
	Next
Next
 
UnsniffDB.Close()
 
Sub PrintField (Field)
 
	Sout.Write     Field.Name & _
		       " ( " & Field.Value & " )" & _
		       " [  s: " & Field.SizeBits & _
		       "    o: " & Field.OffsetBits & " ]" & vbCrLf
 
	If Field.SubFieldCount > 0 Then
		For Each SubField in Field.SubFields
			PrintField SubField
		Next
	End If
End Sub