Protobuf decoding for Mqtt messages
i see details about adding protobuf decoding to TCP UDP messages, but is there a way to add protobuf decoding to already dissected mqtt messages?
i see details about adding protobuf decoding to TCP UDP messages, but is there a way to add protobuf decoding to already dissected mqtt messages?
The MQTT dissector has a preference "Message Decoding" to allow dissection of a topic using any other dissector.
The preference setting is comprised of a match operator (Equal To, Contains, ...) the topic string to match against, whether the payload is compressed or not and lastly the dissector to call.
Note that the latter argument has to be the registered name of the dissector, e.g. as shown in the first column of the "Enabled Protocols" dialog.
Thanks a lot Graham for your answer, It is working. I created specific protobuf message's dissectors in a Lua script and assigned them in Mqtt "Message Decoding" preference to different topic strings in Wireshark. Now i can see protobuf decoding for all mqtt messages in Wireshark
Just another question. Can we do it all in a Lua script? Parse mqtt topic strings and map them to different protobuf dissectors without having to go to Wireshark MQTT dissector preference "Message Decoding"?
I am not that expert in Lua script but just curious if it's a possible option as it will give easy working
Please start posting anonymously - your entry will be published after you log in or create a new account.
Asked: 2022-03-10 07:04:00 +0000
Seen: 837 times
Last updated: Mar 14 '22
How to capture UDP traffic and not NBNS traffic?
No HTTP protocols in scan results
How to observe Message Session Relay Protocol packets
Seeking explanation on bytes count in 'Protocol hierarchy'
Documentation/Use of new protobuf dissector
How to determine which processes are sending CLDAP Protocol to DST Port 389
How to decode a protocol that wireshark doesn't recognize?
Not entirely sure what your end goal is here, but the SparkPlugB dissector relies on the MQTT dissector to deliver messages, parses off the SparkPlugB header and then uses the protobuf dissector to dissect the message contents.
What are you trying to do and does the protocol have a name or specification?
Thanks for your comment. No new protocol, basically i am sending protobuf encoded messages on mqtt. i am trying to see protobuf decoding of mqtt messages data in wireshark log itself. Like there is a way to directly link protobuf with UDP messages. Can we do some similar linking between protobuf and Mqtt message data.