Ask Your Question

Is there a simple LUA script as an example for simple pcaps?

asked 2018-05-18 21:24:59 +0000

softfoot gravatar image

Hi, I am very much a newbie to dissectors (though a longtime user of WireShark and LUA).

I have a tool that records a simple serial protocol (3 to 7 bytes - the first byte being a device address the rest being device data) as a pcap file. There are NO UDP/TCP/USB headers.

I have played about with a couple of LUA dissectors, but they assume the data is preceded by a UDP/TCP header and work well with the appropriate pcap file.

Is there an example of a LUA script that I might use to figure out how to do this?

TIA Dave

edit retag flag offensive close merge delete


What's the link layer type of your pcap file?

cmaynard gravatar imagecmaynard ( 2018-05-21 13:57:25 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2018-10-17 00:28:59 +0000

cmaynard gravatar image

Sorry for the very late response here. I had asked about the link layer type but never received a response and then I forgot all about this question. I stumbled across this question again today, so I'll attempt to answer it now.

If you're able to write a pcap file, then you must set the Data Link Type (or DLT for short) to one of the user-defined types, 147-162. Here I'll assume you use DLT 150. If you already have a pcap capture file and need to change the encapsulation type, you can do so with editcap. For example:

editcap -T user3 -input.pcap output.pcap

If instead you have a text file, then you can use text2pcap to convert the file into a pcap file with the appropriate DLT type. For example, let's say your protocol is foo and your foo.txt file contains the following data representing 8 bytes - 1 byte for address and 7 bytes of device data:

000000 31 31 32 33 34 35 36 37

You can convert the data to a pcap file using something like so:

text2pcap -l 150 foo.txt foo.pcap

If you load that foo.pcap file into Wireshark, you should see the packet details pane initially depicted as:

Frame 1: 8 bytes on wire (64 bits), 8 bytes captured (64 bits)
User encapsulation not handled: DLT=150, check your Preferences->Protocols->DLT_USER
Data (8 bytes)

Now you need to tell Wirehsark how this DLT should be dissected. To do that, navigate the GUI to Edit -> Preferences -> Protocols -> DLT_USER and then click on the Edit button next to the Encapsulations Table. Add a new DLT lookup with the +, select "User 3 (DLT=150)" with the payload protocol set to foo and click OK. You should now see your data dissected according to your Lua dissector.

For more information about how to dissect anything, refer to the Wireshark wiki page on How To Dissect Anything.

Of course up until now, I've assumed that you have a foo.lua file written, but in case you don't, below is a very simple one that should help you get started:

local p_foo = Proto("foo", "FOO")

local pf = {
    address = ProtoField.uint8("foo.address", "Address", base.DEC),
    data = ProtoField.bytes("", "Data", base.NONE)
p_foo.fields = pf

function p_foo.dissector(buf, pinfo, tree)
    local foo_tree = tree:add(p_foo, buf(0,-1))


    foo_tree:add(pf.address, buf(0, 1))
    foo_tree:add(, buf(1, buf:len()-1))

Now that you have a Lua dissector written and the DLT registered, you should see something like so:

Frame 1: 8 bytes on wire (64 bits), 8 bytes captured (64 bits)
DLT=150, Payload: foo (FOO)
    Address: 49
    Data: 31323334353637

There are many Lua resources available to help you further, and I'll direct you to my answer to a question over on Stack Overflow that lists many of them. Don't forget about ... (more)

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools



Asked: 2018-05-18 21:24:59 +0000

Seen: 201 times

Last updated: Oct 17