Adding a custom dissector to wireshark

answered 2020-02-11 20:41:05 +0000

flag of United Kingdom of Great Britain and Northern Ireland

23790 ●4 ●950 ●227 https://www.wireshark.org

See the Developers Guide, Section 10 - Introduction to Lua.

Comments

Thanks @grahamb, had a look there! I loaded the Lua script explicitly by passing -X lua_script:<script_name> to wireshark while starting it.

I guess my issue is that when I load a pcap file and select a packet and hit "Decode as", I do not see my custom dissector. I checked also in Analyze --> Enabled Protocols for my custom protocol to no avail.

Any thoughts on what might be the issue? Do I need to rebuild wireshark in order to load the dissector?

Note that I built wireshark from source (it is the latest stable release).

P.S.: I double-checked the plugins directory in Help --> About --> Folders and ensured that the Lua script exists in both the Personal and Global plugins directory.

bobsaccamano ( 2020-02-11 21:20:41 +0000 )edit

As it's a custom build, have you included Lua support? Post the contents of the Help -> About Wireshark, Wireshark tab.

grahamb ( 2020-02-12 07:09:00 +0000 )edit

Turns out Lua was not enabled as wireshark 3.2.1 requires Lua version >= 5.1. So I installed Lua 5.2 from source and rebuilt wireshark with the correct paths (LUA_LIBRARY, LUA_INCLUDE_DIR etc.). it now finds the Lua installation, however complains that the header lua.h is missing.

So I checked the location of the Lua install and turns out my build has not copied the libs and headers in the configured path. I will now install Lua as Debian package and recheck.

Below the contents of Wireshark About:

3.2.1 (Git commit bf38a67724d0)

Compiled (64-bit) with Qt 5.9.5, with libpcap, without POSIX capabilities,
without libnl, with GLib 2.56.4, with zlib 1.2.11, without SMI, without c-ares,
without Lua, without GnuTLS, with Gcrypt 1.8.1, without Kerberos, without
MaxMind DB resolver, without nghttp2, without brotli, with LZ4, without
Zstandard, without Snappy ...

(more)

bobsaccamano ( 2020-02-12 14:17:23 +0000 )edit

Not sure about lua, but quite often on Ubuntu you need the -dev package to get the libs and headers.

grahamb ( 2020-02-12 14:35:18 +0000 )edit

Did install the -dev package but wireshark build fails with the same error. Rebuilt wireshark with the correct Lua install paths and it now works. Thanks again for your help. Much appreciated!

bobsaccamano ( 2020-02-12 15:15:32 +0000 )edit

add a comment

Adding a custom dissector to wireshark

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Adding a custom dissector to wireshark edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Adding a custom dissector to wireshark