Skip to content
Search

Wireshark:PacketDissection

lastmod 2024-11-05created 2024-11-0111 edits

Wireshark Packet Dissection (dis-section).

Categories

Examples

  • plcGateway#Wireshark Dissector - Packet analysis for the PLC communication middleware developed by Waidep.

LUA Script

First check whether Lua scripts are supported. Click "Help > About Wireshark" in the menu and check for "with Lua X.X.X".

Wireshark_-_About.png

Server packet analysis

See Tcpdump#Server packet analysis.

How to apply a script

First check the folder to upload scripts to. In the "Help > About Wireshark" menu, click the "Folders" tab to see the upload-related folders as follows.

Wireshark_-About-_Folders.png

If the folder does not exist, create it.

Write the script, copy it to that folder, then select "Analyze > Reload Lua Plugins" from the menu.

Wireshark_-Menu-Analyze-_Reload_Lua_Plugins.png

If there are already filtered packets, reloading takes quite a while.

Afterwards, the "Plugins" tab in the "Help > About Wireshark" menu shows the loaded lua scripts.

Wireshark_-About-_Plugins.png

You can also check by clicking "Analyze > Enabled Protocols" in the menu.

subtree

Setting endianness

Adding with the usual subtree:add adds it as Big-endian. 

subtree:add(somefield, buffer(94, 2))

Adding with subtree:add_le adds it as Little-endian. 

subtree:add_le(somefield, buffer(94, 2))

How to apply a filter

For example, when #Proto and #ProtoField are applied as follows: 

local plcGateway_p2s_proto = Proto("plcGateway_p2s", "DDRM plcGateway PLC -> Server Packet")

local f_pass_no = ProtoField.uint16("plcGateway_p2s.pass_no", "Pass No", base.DEC)
local f_camera_no = ProtoField.uint16("plcGateway_p2s.camera_no", "Camera No", base.DEC, {
    [1] = "Front Camber",
    [3] = "Rear Camber",
    [4] = "Front Turn",
    [5] = "Rear Turn"
})

You can apply filters such as plcGateway_p2s or plcGateway_p2s.pass_no == 1.

How to register a default port

To add a #Proto to the tap port table, add it as follows. (You can add several if needed. 

-- Register the dissector to TCP port
local tcp_table = DissectorTable.get("tcp.port")
tcp_table:add(30000, plcGateway_s2p_proto)  -- Default to all TCP ports; adjust as needed (aaa)
tcp_table:add(30002, plcGateway_s2p_proto)  -- Default to all TCP ports; adjust as needed (bbb)

See also

Favorite site

Guide

author Zer0 sitemap