Ask Your Question
0

802.11 lua dissector

asked 2020-04-22 14:35:59 +0000

Hello all,

I'm trying to create a lua dissector for a proprietary protocol. The packets I'm interested in are 802.11 wifi packets. These packets must have a certain value for the Organization Code and Protocol ID of the LLC.

By following a tutorial for TCP, I already created a protocol to which I added all the fields. But I can't find a way to adapt this to the wifi packets I'm interested in. I'd like to replace the "data" by the information of my protocol.

Thanks in advance.

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2020-04-23 18:41:15 +0000

cmaynard gravatar image

If by Protocol ID of the LLC, you mean the llc.type field, then maybe something like the following could help?

local legrandnono = Proto("legrandnono", "legrandnono dissector")

local pf = {
    data = ProtoField.bytes("legrandnono.data", "legrandnono Data", base.NONE)
}

-- Register protocol fields
legrandnono.fields = pf

-- Assume an OUI of 00:00:00 and LEGRANDNONO_ETYPE Ethertype represents a legrandnono packet
local LEGRANDNONO_ETYPE     = 0xa861
local LEGRANDNONO_OUI       = 0

local etypetable = DissectorTable.get("ethertype")
local etype_orig = etypetable:get_dissector(LEGRANDNONO_ETYPE)
local data_dis = Dissector.get("data")
local llc_oui = Field.new("llc.oui")

function legrandnono.dissector(tvbuf, pinfo, tree)

    local llc_oui_ex = llc_oui()
    if llc_oui_ex == nil or llc_oui_ex.value ~= LEGRANDNONO_OUI then
        if etype_orig ~= nil then
            etype_orig:call(tvbuf, pinfo, tree)
        else
            data_dis:call(tvbuf, pinfo, tree)
        end
        return
    end

    pinfo.cols.protocol:set("legrandnono")

    local legrandnono_tree = tree:add(legrandnono, tvbuf(0, tvbuf:len()))
    legrandnono_tree:add(pf.data, tvbuf(0, tvbuf:len()), tvbuf:len())
end

etypetable:add(LEGRANDNONO_ETYPE, legrandnono)
edit flag offensive delete link more

Comments

That won't work if the OUI isn't 00:00:00; for that, we'd need a way to call llc_add_oui() from Lua code.

Guy Harris gravatar imageGuy Harris ( 2020-04-23 21:55:16 +0000 )edit

In the absence of such a change, then a post-dissector implementation might suffice, as long as you don't mind the un-dissected generic data being present in the tree. For example:

local legrandnono = Proto("legrandnono", "legrandnono dissector")

local pf = {
    data = ProtoField.bytes("legrandnono.data", "legrandnono Data", base.NONE)
}

-- Register protocol fields
legrandnono.fields = pf

-- Assume an OUI of 12:34:56 and LEGRANDNONO_PID represents a legrandnono packet
local LEGRANDNONO_PID       = 0xa861
local LEGRANDNONO_OUI       = 1193046   -- 12:34:56

local data_data = Field.new("data.data")
local llc_oui = Field.new("llc.oui")
local llc_pid = Field.new("llc.pid")

function legrandnono.dissector(tvbuf, pinfo, tree)

    local llc_oui_ex = llc_oui()
    local llc_pid_ex = llc_pid()
    if llc_pid_ex == nil or llc_oui_ex == nil or data_data() == nil or
        llc_pid_ex.value ~= LEGRANDNONO_PID or llc_oui_ex.value ~= LEGRANDNONO_OUI then
        return
    end

    pinfo.cols.protocol:set("legrandnono")

    local data_tvb = data_data().range()
    local legrandnono_tree = tree:add(legrandnono, data_tvb(0, data_tvb:len()))

    legrandnono_tree:add(pf.data, data_tvb(0 ...
(more)
cmaynard gravatar imagecmaynard ( 2020-04-24 00:04:37 +0000 )edit

Thanks for your help ! My dissector works well !

legrandnono gravatar imagelegrandnono ( 2020-05-01 08:22:45 +0000 )edit

You're welcome. Note that my answer was not meant to be a long-term definitive solution but merely one that can work in the absence of the recommended solution by @guy-harris, namely that, "we'd need a way to call llc_add_oui() from Lua code."

If that change is something you'd like to see, then I would suggest that you open a bug report at https://bugs.wireshark.org/bugzilla/, requesting this capability.

cmaynard gravatar imagecmaynard ( 2020-05-04 15:02:42 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2020-04-22 14:35:59 +0000

Seen: 108 times

Last updated: May 01