3

I want to build a Wireshark packet dissector of my own and followed the procedure given at https://www.wireshark.org/docs/wsdg_html_chunked/ChDissectAdd.html .

However, I do not understand how to compile my dissector and place the dll in the plugins folder. I followed this guide https://www.sewio.net/open-sniffer/develop/how-to-compile-your-wireshark-dissector/ till step 2. But couldn't understand what to do at step 3.

I tried running nmake but it shows no such cmd command. I am using the Wireshark installation for Windows.

How can I compile my dissector and run it? Also is it necessary to build Wireshark from Source code in order to run custom packet dissectors?

2 Answers 2

3

five steps to make a c plugin (custom dissector) for wireshark:

1. compile the wireshark source code once

2. Create a source file in "wireshark\plugins\epan\foo" directory (for example named packet-foo.c )

3. Copy another plugin source file and configuration as templates and edit it

4. recompile the wireshark source code

5. start wireshark and test

for detail, you can check my post here show you how to compile the c language plugin for wireshark 3.1 step by step (windows platform 2019-3-20)

2
  • 4
    How can the dissector be compiled separately? "Compile the wireshark source code once" is a lot to ask, especially in a secure environment. Chocolatey Qt (huge), Python, Perl, Git, winflexbison, and dependencies are required; difficult if one must submit a request to install all these packages.
    – kmiklas
    Commented Jun 28, 2019 at 20:26
  • @kmiklas if you want to install minimum dependencies,you can edit options in CMakeOptions.txt,set all BUILD_XXXXX option to off,then cmake as decribed here.Finally,cd into your plugin directory,you would see a .vcxproj file,then run msbuild command.It will only compile the plugin dll and necessary dependencies.
    – 傅继晗
    Commented Mar 2, 2023 at 15:44
2

First, since you're working on the Windows platform, you should be sure to read and follow very carefully the official Win32/64 Step-by-Step Guide section of the Wireshark Developer's Guide.

Second, if you're building a plugin, you should be sure to carefully read the README.plugins file.

You will need to compile the Wireshark sources if you're building a dissector written as a C plugin or builtin, but you won't need to build the Wireshark sources if you write your dissector as a Lua plugin. If you're interested in Lua, you might start at the Wireshark Lua wiki page.

There's also another less well-known method of building a dissector using wsgd. I have no experience with wsgd, but for an introduction to all 3 methods, you may wish to review Graham Bloice's presentation from Sharkfest '15 titled, "Wireshark Dissectors - 3 ways to eat bytes".

1
  • You should be able to compile plugins if the package wireshark-devel or -dev is installed only.
    – None
    Commented Mar 24, 2022 at 3:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.