advice on LUA dissector

asked 2018-02-20 12:56:17 +0000

BMWE gravatar image

updated 2018-03-05 18:59:54 +0000

I'd be glad to have your advice on this.

I have following scenario:

4 kind of udp protocols: 1. port 2000 for both src and dest 2. Src port 2001 and dest port 2002 3. src port 2002 and dest port 2003 4. Src port 2003 and dest port 2004

Protocols 2&3 are same but the name (i.e I'd like to identify the differnce by name in info field).

All my protocols are described in xml file which I'm parsing into lua structure. The XML file contains enums definition, structs (for example like tcp flags in tcp header) and messages. All protocols have few messages. All the messages starts with some common header (0xAA 0xBB 0xCC), which is also defined as struct, and ends with checksum.

Currently when parsing the protocol, I'm parsing each part (enums, structs, messeges) to be as standalone (yes, of course there is a dependence between all the three).

I'd like to have your advice how to implement it: Each protocol in single file and having an additional file which checks the ports and calls the relevant dissector? How about the common header - shall it be declared as a struct in one of the protocols or it is better to declare it already as part of each protocol fields. May be some additional solution? Any other advises would also be welcomed

edit retag flag offensive close merge delete


As you speak of ports are you asking how to get a lua dissector to dissect messages on an udp or Tcp port? If not we have no clue what protocol your vendor is using.

Anders gravatar imageAnders ( 2018-02-20 21:49:57 +0000 )edit

It is udp.

BMWE gravatar imageBMWE ( 2018-02-20 21:51:54 +0000 )edit

As your protocols share ports (protocol 3 has 2003 as destination and protocol 4 has it as source), I'm afraid you'll have to register a single dissector to all four UDP ports (2001..2004) and let the dissector itself choose the appropriate code branch based on source and destination port.

sindy gravatar imagesindy ( 2018-03-06 13:21:30 +0000 )edit