We have a need to strip out the OUI Identifier out of our DHCP logs, but running into issues with building a LUA passer (see attached). Does anyone have a prebuilt solution they could share? Or look into my LUA log parser? I cannot get the data to send into the findOUI function
-- attached working version, thanks to bill.
Your log line for the eth.dst match is inside the "if deviceType == 1", so we don't know whether that callback is occurring or not. I suspect either the deviceType callback isn't occurring, or "infobloxnios" isn't actually all lowercase. In deviceType try something like,
if string.lower(dtype) == "infobloxnios" then
nw.logInfo("infobloxnios seen")
deviceType = 1
end
(Don't forget to reset deviceType at session begin.)
A different way to go could be not using two callbacks. Instead, remove deviceType. Replace findOUI with,
function lua_ouiParser:findOUI()
local payload = nw.getPayload()
local message = payload:tostring()
local oui = string.match(message, "^.*dhcpd%[%d+%]: DHCPOFFER on [%d%.]+ to (%x%x:%x%x:%x%x):%x%x:%x%x:%x%x")
if oui then
nw.createMeta(self.keys["usb.eth.oui"], oui)
end
end