Questions tagged [wireshark-dissector]
A protocol dissector for Wireshark is what translates the bytes of a network package into human readable form. Use this tag when asking about writing a Wireshark protocol dissector. Also include the appropriate language tag.
315
questions
0
votes
0
answers
4
views
Why Wireshark is not displaying RTPS sub-messages in the 'Info' column?
I want to analyze the RTPS traffic in Wireshark.
I am running two applications that are transmitting and receiving a DDS (Data Distribution Service) topic in the same computer.
I can only see INFO_TS,...
0
votes
0
answers
30
views
parsing a wireshark file, parsing the payload and storing specific packets in the wireshark format
I am parsing a large wireshark packets using pyshark similar to:
import pyshark
import struct
import binascii
cap = pyshark.FileCapture('C:/1-work/wire/capture_11_9_23.pcapng',use_json=True)
I am ...
0
votes
0
answers
55
views
Lua sub-dissector for rtcp inside a proprietary protocol
I am new to lua script. I am working on dissecting a proprietary protocol. Inside the protocol bytes there are 8 bytes related to rtcp, like, rtcp version, padding, reception report count, packet ...
0
votes
0
answers
31
views
Error loading wrapper for shared library in lua plugin
I’m attempting to write a C wrapper for a shared library that would expose it to lua so that it can be called by a lua plugin.
I recreated the error with minimal code, using the following four files:
/...
0
votes
1
answer
82
views
Lua script does not print results to wireshark console
So, I have written the following Lua script for my work but it does not show any output in the WireShark console for TCP at 443.
local plugin = {}
function plugin.init() --I have initialized the ...
0
votes
0
answers
41
views
Dissector table doesn't exist while registering subdissector for ZMTP
I'm trying to create an "out-of-tree" dissector plugin for my protocol:
My protocol messages are encapsulated into ZMTP frames, so I'm using this Lua dissector.
Regarding subdissectors, we ...
1
vote
0
answers
38
views
How Can Call Sub Dissector in Wireshark on Lua
In wireshark there is message payload which is actually IEEE 802.11 association request. And i want to show this message as association request format. Normally association request frame parsed in ...
0
votes
1
answer
90
views
What is the best way to extract only hex value for all fields to JSON with Wireshark/TShark
I want to get information I have with Wireshark (the GUI), the information I want are for each packets its layers with all fields and their hexadecimal values. I want to get it to transform each ...
0
votes
1
answer
76
views
Wireshark Lua Dissector - Getting Unparsed data before dissector
I'm writing a dissector in lua for Wireshark and the only identifier for these packets are in the data that hasn't been parsed yet. I'm just not sure how to get this yet, usually it is in the tvb ...
0
votes
1
answer
140
views
Understanding an "attempt to index global 'ftypes' (a nil value)" Lua error
I was attempting to use the ZMTP Wireshark Dissector with my current copy of Wireshark (v4.0.6) which uses Lua 5.2.4 on my Ubuntu 20.04 machine to dissect zeromq.
I put the lua file in the proper ...
0
votes
0
answers
87
views
Wireshark--Transmission Control Protocol, Src Port: 51589, Dst Port: 443, Seq: 599, Ack: 6627, Len: 0
I am getting a red message in wireshark mentioning the following:
Transmission Control Protocol, Src Port: 51589, Dst Port: 443, Seq: 599, Ack: 6627, Len: 0
Any idea what does that mean?The ones in ...
0
votes
0
answers
134
views
How do I decode Photon traffic from Wireshark
I am using wireshark with a photon dissector I found on github to try and decode data coming out of a game that I am playing. Currently, I can get small amounts of data out of the UDP port, but there ...
1
vote
0
answers
1k
views
Encryption alert (Alert (21))from the Server and connection resets
I am working on TLS 1.2 Cipher TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, After send the application data server throw an error message Encryption alert (21).
I observed on the wire shark log there is no ...
0
votes
1
answer
485
views
How to add an array of fields as a ProtoField in Lua Dissector
I'm writing a Lua Dissector for Wireshark. The packets I'm trying to dissect have the following format:
V_SPEED
N_ITERATION
SEG_LEN[N_ITERATION] --> This means there are N_ITERATION SEG_LEN in my ...
0
votes
0
answers
17
views
Use a file as a Capture filter Wireshark
Is it possible to use a file containing filters as a filter itself? Instead of having to write each filter -f ...... -f ....... have a file that contains all the filters I wish to use to capture? What ...
0
votes
1
answer
98
views
Wireshark Lua API: How to maintain a packetfile specific var?
Snippet of my dissector:
local proto = Proto("myproto", "my proto")
local n_visited = 0
function proto.dissector(tvbuf, pinfo, tree)
-- ...
-- ...
if not pinfo....
1
vote
1
answer
264
views
Wireshark Lua API: How to get TCP header info?
I'm writing a dissector (to be added to DissectorTable.get("tcp.port")) for a TCP-based application. I've gone through the Wireshark API doc but could not find out how to get TCP header's ...
-1
votes
1
answer
228
views
Export Dissected Pcap file to text file using command line
I am quite new to wireshark. Gone through the wireshark manual for the command line options but still cannot find the right flag or command lines to export the dissected pcap file to text file using ...
0
votes
1
answer
215
views
How to access a previously extracted field in a chained Lua dissector?
I'm new to Lua and I'm trying to write a dissector that would decrypt an encrypted MQTT payload. Wireshark already has an MQTT dissector that extracts the payload, which at the moment looks like ...
0
votes
1
answer
134
views
How to only dissect one attribute of a Zigbee Cluster Library frame in a Wireshark Lua dissector
this is my first time asking and I am new to Lua, so please correct me if I am doing something wrong
General Problem:
I want to write a Lua dissector for wireshark that only dissects one attribute of ...
0
votes
1
answer
156
views
Custom wireshark disector shows value but fieldname is not visible using lua
I am testing some network packets of my Organisation's product. We already have custom plugins. I am trying to add some some more fields into those existing plugins (like conversion of 2 byte code to ...
0
votes
0
answers
528
views
Decrypt TLS in Wireshark with (pre-)master key
I have been following the documentation about decrypting TLS using (pre-master) key, stored in (the RSA Session-ID:xxxx Master-Key:yyyy format) but it still won't decrypt it properly. I am using TLSv1....
0
votes
1
answer
103
views
tshark returns 0 results for filter icmp.no_resp but wireshark returns 12 resutls with the same filter
I am trying to do packet capture analysis with tshark on about 30000 files looking for a needle in the haystack.The files containing interesting needles contain icmp failures. I wrote a script which ...
0
votes
1
answer
242
views
how to only print Lua output with tshark
I am using a Lua script with tshark and when I run it with -V I get the protocol decode output. When I try anything else to limit output to just the Lua decoded data I am not having any luck. i.e.
...
0
votes
2
answers
124
views
SQL Parameters missing when using tshark against PostgreSQL v12 traffic
I'm attempting to spy on non-SSL PostgreSQL traffic using tshark using the following command:
# tshark -f 'tcp dst port 5432' -O PGSQL \
-d 'tcp.port==5432,pgsql' -T fields -e pgsql.query
I am ...
0
votes
1
answer
314
views
Profinet LUA dissector without ports to extract specific bits
How can I make a Lua dissector/post-dissector/chained dissector that would get attached under the PROFINET IO Cyclic Service Data Unit and for example extract only the last 3 bits of the 5th byte, ...
0
votes
1
answer
645
views
Pyshark read all values from a packet as dictionary
I'm trying to read all parameters within the packet. Using cap[0].layer._all_fields able to get fields of particular layer/protocol. Looking for something similar say cap[0]._all_fields
1
vote
0
answers
102
views
sFlow display filters for source/destination ASN in wireshark
I have capture files containing sFlow data that I am trying to filter based on the "Extended gateway data" contained within. The documentation at https://www.wireshark.org/docs/dfref/s/...
2
votes
0
answers
202
views
Wireshark LUA dissector to capture Profisafe packets across two way communication
There are two devices , IODevice and IOController.The Profisafe data consists of 13 byte.The profinet data telegram structure consists of 60 bytes.
The profisafe data for IODevice -> IOController ...
1
vote
1
answer
625
views
Displaying the bits values of a number in Wireshark Postdissector
I am writing a wireshark dissector of a custom protocol using LUA.For this custom protocol,there are no underlying TCP port or UDP port hence i have written a postdissector.
I am able to capture the ...
0
votes
1
answer
225
views
Capturing Profisafe packets using Lua Wireshark dissector
I am writing a Lua script to capture profisafe packets on wireshark.It is above the profinet layer in the stack.The wireshark dissect the profinet packets but does not dissect the profisafe.
For other ...
-1
votes
1
answer
198
views
Wireshark shows plain number in place of longitude and latitude values
I am facing issue with coordinate calculation (Longitude and Latitude). I have a pcap file when I open it with Wireshark I am getting the packet as shown below -
Latitude: 52.5125915 (52°30'45.33"...
0
votes
0
answers
618
views
Lua error "attempt to call global" on Wireshark dissector when using loadstring()
I'm trying to execute a custom function call dynamically defined using loadstring inside a Wireshark dissector.
When using this method from inside another similar Lua script, it works fine:
function ...
0
votes
1
answer
175
views
Wireshark plugin compiled
Trying to compile wireshark plugin using wireshark-nfc example
(https://code.google.com/archive/p/wireshark-nfc/)
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
#define WS_BUILD_DLL
#...
0
votes
1
answer
250
views
dynamic (based on prev protofield value) Protofield valuestring based
I'm developing a wireshark plugin in lua.
I have a Protofield whose valuestring table changes based on the value of a previous field. I dont see a way to do that cleanly in the lua wireshark plugin I ...
-2
votes
1
answer
1k
views
Wireshark Kerberos decrypt shows error "missing keytype 18"
When trying to decrypt the kerberos by using the keytab file it shows the error "missing keytype 18". The keytab file has the keytype 18.
0
votes
0
answers
476
views
How to verify TLSv1.2 SSL database connection in Python 3.x (sqlalchemy)
Currently I'm using mysql_engine = sqlalchemy.create_engine() in my Python code to connect with a MySQL database, I did some reading online, it says that TLSv1.2 is the default connection version, but ...
0
votes
1
answer
466
views
Unable to Dissect L2TPV3 in Wireshark
I can view L2TPV3 in decode as but dissection not working out while analyzing log in Wireshark.
Expect to see tunneled data mapped and could see in Wireshark.
Anyone came across L2TP decoding on ...
1
vote
1
answer
327
views
Wireshark Lua Dissector Response Request
does someone know how to use the Protofield.framenu for frametype.RESPONSE and frametype.REQUEST for an arrow in wireshark with marks the Sequencenumber between an ACK and DATA?
Thanks a lot!
0
votes
1
answer
329
views
What is the Wireshark lua package path?
Our custom Wireshark dissector, coded in lua, starts with:
-- Create a protocol object
test_protocol = Proto("test", "test protocol")
messageLength_F = ProtoField.uint32("...
0
votes
2
answers
3k
views
Using Wireshark with gRPC
I am trying to dissect TCP packets carrying gRPC payloads with Wireshark.
Although I configured decoding as http2 and provided path to my .proto directory, Wireshark seem to only decrypt TLS data, and ...
0
votes
1
answer
886
views
How to static compile tshark?
I compiled tshark with cmake.
I running command cmake -DBUILD_wireshark=off; make CFLAGS="-static", then i found BUILD_wiresharktshark in build/run, but it's dynamic link, and dependency ...
0
votes
1
answer
176
views
Wireshark : how to force to drop packets with LUA?
I'm am facing to an issue when sniffing on the loopback interface when using a JTAG debug probe, which uses a TCP socket. It completly flood the loopback, and freeze Wireshark after a few seconds.
As ...
0
votes
1
answer
114
views
Wireshark dissect information but not display in the dissect
This may have been explained elsewhere, but not finding it. I have to work within the confines of wireshark 2.4.x.
So I defined some values for data as so.
{ &hf_td_timestamp,
{...
0
votes
2
answers
1k
views
How NBNS packet is getting captured in Wireshark
Could anyone please tell how NBNS packets are getting generated in Wireshark once we start the live capturing for a particular interface. My objective is to get the hostname of the different machines ...
1
vote
1
answer
1k
views
Two Wireshark Dissectors with shared fields
I am writing a wireshark dissector for a custom protocol. The protocol has two variants, which are indistinguishable in general when looking at the dump. So usually the user will simply select the ...
0
votes
0
answers
894
views
How Parse KNX/IP on Wireshark
I have recently purchased a drone and I downloaded the app that is used to control it. I was able to generate packet capture pcap file from the traffic between the drone and the app and saw on ...
0
votes
1
answer
963
views
wireshark custom lua dissector display metaData column
For a wireshark custom lua dissector, id like to be able to display the "append_text" metaData in the wireshark column view.
Makes it easier for other folk to see what's going on
i.e. in ...
0
votes
1
answer
109
views
How to separate data from different files in a single TCP packet?
Say I have transmitted data of 2 files A.bin and B.bin, since a TCP packet can have data from more than one file starting at random position, after wireshark capture, how can I identify which part of ...
-1
votes
1
answer
40
views
How to identify implemented code location in open source project binaries?
There is a c code in wireshark packet-s7comm.c, after building how i will identify which generated binary is having its implementation ?