Ask Your Question

Testing Lua Dissectors [closed]

asked 2018-03-24 23:11:48 +0000

MarkoPaul0 gravatar image

Hello Wireshark users,

What I am about to post is not really a question but more of a request for help. (I hope this is not against the rule of this forum). So far my workflow when writing a new dissector has been the following:

  1. Write a draft
  2. Open a capture in Wireshark and see if it works
  3. Fix the issues in the script
  4. Close Wireshark
  5. Go back to 2.

Obviously, this is pretty painful. I am aware that you can debug your code while running Wireshark. However, I feel like opening and closing Wireshark over and over again to reload the dissector is still a pain. This is why I have been working on Wirebait over the past few weeks. It is a small Lua library which enables you to run/debug your dissectors on the fly without the need for Wireshark. You can use a .pcap file or a made up hexadecimal string to feed your dissector.

I am now using Wirebait to test my dissectors as I am writing them, but I would like to get feedback from other Wireshark users. I would be looking to answer the following questions:

  • Does it even work with your dissectors and setup?
  • Are there ways to make it more useful?

Getting started is really quick, you download the wirebait.lua file in your Lua path, add a code snippet at the top of your dissector file, and now you can run your dissector directly (without Wireshark). I would appreciate any form of feedback/contribution.


edit retag flag offensive reopen merge delete

Closed for the following reason not a real question by MarkoPaul0
close date 2018-03-26 16:10:01.778804


I would recommend posting this to the wireshark-dev mailing list (and possibly even to the wireshark-users mailing list as well). I would be willing to bet that more people will see it on the mailing list than here, and it's probably a better place to discuss it than the Q&A site anyway.

cmaynard gravatar imagecmaynard ( 2018-03-26 01:05:46 +0000 )edit

Small world it seems :), and again very helpful information. I agree with you this is not the right place, I simply wasn't aware of that mailing list. I'll take your advice and try emailing the devs. I should probably take down that question as well.

MarkoPaul0 gravatar imageMarkoPaul0 ( 2018-03-26 01:27:24 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2018-03-25 10:15:47 +0000

ZirconiumX gravatar image

Wireshark has a button (Analyze->Reload Lua Plugins; Ctrl-Shift-L) to reload all Lua plugins without opening and closing Wireshark. It's much more convenient than opening/closing the GUI every time.

edit flag offensive delete link more


I had never come to hear about that feature when it came out, and there is no doubt it makes the process easier. It is still not that great if you want to keep on testing different scenarios as you are writing your dissector.

MarkoPaul0 gravatar imageMarkoPaul0 ( 2018-03-25 16:23:32 +0000 )edit

Question Tools


Asked: 2018-03-24 23:11:48 +0000

Seen: 2,781 times

Last updated: Mar 25 '18