gRPC Configuration
Is it possible to configure Protobuf Search Paths using only the CLI on Redhat?
Edit: I don't need the solution to be CLI only at this point, see comments below.
Is it possible to configure Protobuf Search Paths using only the CLI on Redhat?
Edit: I don't need the solution to be CLI only at this point, see comments below.
The Protobuf Search Paths Settings are stored in a UAT (config file) that is stored with each Configuration Profile:
Protobuf Search Paths (protobuf_search_paths) (Section 11.21, “Protobuf Search Paths”)
You could use the same profile (-C gRPC_foo
) and modify the config file (protobuf_search_paths
) in the profile before running Wireshark or TShark each time.
Or you could have several/many profiles (gRPC_foo1
, gRPC_foo2
, gRPC_foo3
, gRPC_foo4
) and modify the search path settings for each before. Then run Wireshark/TShark -C gRPC_fooX
as appropriate.
When I check my /home/<username>/.config/wireshark/preferences
file, I don't have a field called protobuf_search_paths
. I have try_dissect_all_length_delimited_field_as_string
, try_dissect_length_delimited_field_as_repeated
, and show_all_possible_field_types
. I went ahead and set all 3 of these to TRUE, but the behavior I'm seeking is still missing.
I read more of your documentation and I think I may need to create a file called protobuf_search_paths in the format of a "User table" as mentioned here in section 11.21 of your manual:
The configuration for the protobuf search paths is a user table, as described in Section 11.7, “User Table”, with the following fields:
Protobuf source directory
This specifies a directory containing protobuf source files. For example, d:/protobuf-3.4.1/include/ and d:/my_proto_files in Windows, or /usr/include/ and /home/alice/my_proto_files in Linux/UNIX.
Load all files
If this option is enabled, Wireshark will load all *.proto files in ...
(more)RHEL 8 and 'wireshark --version' output:
Wireshark 2.6.2 (v2.6.2)
Copyright 1998-2018 Gerald Combs <[email protected]> and contributors.
License GPLv2+: GNU GPL version 2 or later <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with Qt 5.15.2, with libpcap, with POSIX capabilities (Linux),
with libnl 3, with GLib 2.56.4, with zlib 1.2.11, with SMI 0.4.8, with c-ares
1.13.0, without Lua, with GnuTLS 3.6.14, with Gcrypt 1.8.5, with MIT Kerberos,
with MaxMind DB resolver, without nghttp2, without LZ4, without Snappy, without
libxml2, with QtMultimedia, without SBC, without SpanDSP, without bcg729.
Running on Linux 4.18.0-305.19.1.el8_4.x86_64, with Intel(R) Core(TM) i7-7700 ...
(more)Also, I solved my GUI installation issues, so I no longer need to accomplish this using only the command line. I've tried adjusting settings according to the 'edit -> preferences -> protocols -> protobuf' click path in the GUI, but this also has no option for 'protobuf_search_paths'.
GUI installation fix for anyone reading who happens to need that:
sudo dnf install wireshark
sudo dnf makecache
sudo dnf install qt5-qtmultimedia.x86_64
sudo groupadd <username> wireshark
You're still running the very old 2.6.2 version though? That version fell out of support in Oct. 2020 and I'm not certain if it includes support for proto buf paths and this seems to be confirmed as you don't see the field in the GUI. I suspect you'll need to acquire a newer version of Wireshark\tshark.
See the LifeCycle page for more info on versions supported.
https://www.wireshark.org/download.html <--- Here there is no link to download wireshark for RHEL, and sudo dnf install wireshark
gives version 2.6.2, so not sure how I can update to a newer version.
Please start posting anonymously - your entry will be published after you log in or create a new account.
Asked: 2022-06-15 15:50:15 +0000
Seen: 701 times
Last updated: Jul 14 '22
Documentation/Use of new protobuf dissector
Wireshark with Lua on RedHat 8
decode protobuf within a protobuf in lua plugin
[LUA] How to get a field from a decoded protobuf to decode the next protobuf
macOS crash setting protobuf search path
Protobuf decoding for Mqtt messages
Protobuf dissector with nested structures
gRPC traffic dissector with TLSv1.3
Protobuf field malformed packet for last byte of 'repeated fixed32'
Multiple "failed assertion "saved_layers_len < 500"" messages for protobuf protocol