5

I'm looking for a long time to a way to compile and run a custom Wireshark dissector, without needing to recompile the entire wireshark project. Many places on the Web, require developers to write their plugins and link to Wireshark.

However, I have found that some people were able to write the dissector and make it run using the plugin system from Wireshark, whose paths are found in Wireshark Help/About section.

Despite these people showing success writing dissectors in Lua and in C++, I have tried many tutorials, but I'm really lost.

Could someone help me with the steps to make a very simple Wireshark dissector on Ubuntu 16.04 64bit?

3
  • 1
    I'm a bit confused about the term dissector. That's not familiar. Do you have a link what that exactly refers to? I know that it's possible to write all kind of package parser plugins, that may applied for specific protocols.
    – user0042
    Sep 18, 2017 at 20:17
  • Possible duplicate of How can I add a custom protocol analyzer to wireshark?
    – user0042
    Sep 18, 2017 at 20:20
  • dissector is a wireshark lingo: it's a packet analyser plugin. Sep 18, 2017 at 20:33

1 Answer 1

8

There are three ways to write a custom dissector for Wireshark:

  1. C++
  2. Lua
  3. Wireshark Generic Dissector

Several years ago, I needed to write a dissector for a custom protocol my company uses. I compared the three options and learned a bit about them. C++ is the fastest execution but most difficult to learn and use. Lua and WSGD are about the same in execution speed. Lua dissector is built-in to Wireshark, however, I found that it is more difficult to learn because you need to learn a language (Lua) and then how to write dissectors in the language. WSGD is a language designed specially for writing dissectors. It is more like a structure definition that a flow-control language. The WSGD website has documentation and examples. It is hard to find documentation and examples for Lua and how writing dissectors in it.

In 2015 Graham Bioice presented "Writing a Wireshark Dissector Using WSGD, Lua and C" at Sharkfest. It's a very through presentation on the topic, although it was too late to help me. You can get the slide deck and see the presentation at:

For the reasons I listed above, I choose WSGD. I have written several thousand lines to create dissectors for three custom protocols in WSGD. I highly recommend it. The WSGD website is http://wsgd.free.fr

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.