Ask Your Question

Revision history [back]

Testing Lua Dissectors

Hello Wireshark users,

What I am about to post is not really a question but more of a request for help. (I hope this is not against the rule of this forum). So far my workflow when writing a new dissector has been the following:

  1. Write a draft
  2. Open a capture in Wireshark and see if it works
  3. Fix the issues in the script
  4. Close Wireshark
  5. Go back to 2.

Obviously, this is pretty painful. I am aware that you can debug your code while running Wireshark. However, I feel like opening and closing Wireshark over and over again to reload the dissector is still a pain. This is why I have been working on Wirebait over the past few weeks. It is a small Lua library which enables you to run/debug your dissectors on the fly without the need for Wireshark. You can use a .pcap file or a made up hexadecimal string to feed your dissector.

I am now using Wirebait to test my dissectors as I am writing them, but I would like to get feedback from other Wireshark users. I would be looking to answer the following questions:

  • Does it even work with your dissectors and setup?
  • Are there ways to make it more useful?

Getting started is really quick, you download the wirebait.lua file in your Lua path, add a code snippet at the top of your dissector file, and now you can run your dissector directly (without Wireshark). I would appreciate any form of feedback/contribution.