Questions tagged [wireshark-dissector]

A protocol dissector for Wireshark is what translates the bytes of a network package into human readable form. Use this tag when asking about writing a Wireshark protocol dissector. Also include the appropriate language tag.

Filter by
Sorted by
Tagged with
0 votes
0 answers
4 views

Why Wireshark is not displaying RTPS sub-messages in the 'Info' column?

I want to analyze the RTPS traffic in Wireshark. I am running two applications that are transmitting and receiving a DDS (Data Distribution Service) topic in the same computer. I can only see INFO_TS,...
Chandru Mouli's user avatar
0 votes
0 answers
30 views

parsing a wireshark file, parsing the payload and storing specific packets in the wireshark format

I am parsing a large wireshark packets using pyshark similar to: import pyshark import struct import binascii cap = pyshark.FileCapture('C:/1-work/wire/capture_11_9_23.pcapng',use_json=True) I am ...
Sal Navidi's user avatar
0 votes
0 answers
55 views

Lua sub-dissector for rtcp inside a proprietary protocol

I am new to lua script. I am working on dissecting a proprietary protocol. Inside the protocol bytes there are 8 bytes related to rtcp, like, rtcp version, padding, reception report count, packet ...
Roni Samara's user avatar
0 votes
0 answers
31 views

Error loading wrapper for shared library in lua plugin

I’m attempting to write a C wrapper for a shared library that would expose it to lua so that it can be called by a lua plugin. I recreated the error with minimal code, using the following four files: /...
jerome's user avatar
  • 1
0 votes
1 answer
82 views

Lua script does not print results to wireshark console

So, I have written the following Lua script for my work but it does not show any output in the WireShark console for TCP at 443. local plugin = {} function plugin.init() --I have initialized the ...
Dark Vedar's user avatar
0 votes
0 answers
41 views

Dissector table doesn't exist while registering subdissector for ZMTP

I'm trying to create an "out-of-tree" dissector plugin for my protocol: My protocol messages are encapsulated into ZMTP frames, so I'm using this Lua dissector. Regarding subdissectors, we ...
Unda's user avatar
  • 1,837
1 vote
0 answers
38 views

How Can Call Sub Dissector in Wireshark on Lua

In wireshark there is message payload which is actually IEEE 802.11 association request. And i want to show this message as association request format. Normally association request frame parsed in ...
Abdurrahman Uslu's user avatar
0 votes
1 answer
90 views

What is the best way to extract only hex value for all fields to JSON with Wireshark/TShark

I want to get information I have with Wireshark (the GUI), the information I want are for each packets its layers with all fields and their hexadecimal values. I want to get it to transform each ...
Picot's user avatar
  • 75
0 votes
1 answer
76 views

Wireshark Lua Dissector - Getting Unparsed data before dissector

I'm writing a dissector in lua for Wireshark and the only identifier for these packets are in the data that hasn't been parsed yet. I'm just not sure how to get this yet, usually it is in the tvb ...
Sam Spencer's user avatar
0 votes
1 answer
140 views

Understanding an "attempt to index global 'ftypes' (a nil value)" Lua error

I was attempting to use the ZMTP Wireshark Dissector with my current copy of Wireshark (v4.0.6) which uses Lua 5.2.4 on my Ubuntu 20.04 machine to dissect zeromq. I put the lua file in the proper ...
Jason's user avatar
  • 3
0 votes
0 answers
87 views

Wireshark--Transmission Control Protocol, Src Port: 51589, Dst Port: 443, Seq: 599, Ack: 6627, Len: 0

I am getting a red message in wireshark mentioning the following: Transmission Control Protocol, Src Port: 51589, Dst Port: 443, Seq: 599, Ack: 6627, Len: 0 Any idea what does that mean?The ones in ...
user4540741's user avatar
0 votes
0 answers
134 views

How do I decode Photon traffic from Wireshark

I am using wireshark with a photon dissector I found on github to try and decode data coming out of a game that I am playing. Currently, I can get small amounts of data out of the UDP port, but there ...
Rasmus Hornung's user avatar
1 vote
0 answers
1k views

Encryption alert (Alert (21))from the Server and connection resets

I am working on TLS 1.2 Cipher TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, After send the application data server throw an error message Encryption alert (21). I observed on the wire shark log there is no ...
Ahamed Fayaz.'s user avatar
0 votes
1 answer
485 views

How to add an array of fields as a ProtoField in Lua Dissector

I'm writing a Lua Dissector for Wireshark. The packets I'm trying to dissect have the following format: V_SPEED N_ITERATION SEG_LEN[N_ITERATION] --> This means there are N_ITERATION SEG_LEN in my ...
laultimapregunta's user avatar
0 votes
0 answers
17 views

Use a file as a Capture filter Wireshark

Is it possible to use a file containing filters as a filter itself? Instead of having to write each filter -f ...... -f ....... have a file that contains all the filters I wish to use to capture? What ...
Juan's user avatar
  • 1
0 votes
1 answer
98 views

Wireshark Lua API: How to maintain a packetfile specific var?

Snippet of my dissector: local proto = Proto("myproto", "my proto") local n_visited = 0 function proto.dissector(tvbuf, pinfo, tree) -- ... -- ... if not pinfo....
pynexj's user avatar
  • 19.5k
1 vote
1 answer
264 views

Wireshark Lua API: How to get TCP header info?

I'm writing a dissector (to be added to DissectorTable.get("tcp.port")) for a TCP-based application. I've gone through the Wireshark API doc but could not find out how to get TCP header's ...
pynexj's user avatar
  • 19.5k
-1 votes
1 answer
228 views

Export Dissected Pcap file to text file using command line

I am quite new to wireshark. Gone through the wireshark manual for the command line options but still cannot find the right flag or command lines to export the dissected pcap file to text file using ...
Zahier Arbaai's user avatar
0 votes
1 answer
215 views

How to access a previously extracted field in a chained Lua dissector?

I'm new to Lua and I'm trying to write a dissector that would decrypt an encrypted MQTT payload. Wireshark already has an MQTT dissector that extracts the payload, which at the moment looks like ...
jerry's user avatar
  • 3
0 votes
1 answer
134 views

How to only dissect one attribute of a Zigbee Cluster Library frame in a Wireshark Lua dissector

this is my first time asking and I am new to Lua, so please correct me if I am doing something wrong General Problem: I want to write a Lua dissector for wireshark that only dissects one attribute of ...
Ducksenz's user avatar
0 votes
1 answer
156 views

Custom wireshark disector shows value but fieldname is not visible using lua

I am testing some network packets of my Organisation's product. We already have custom plugins. I am trying to add some some more fields into those existing plugins (like conversion of 2 byte code to ...
Srikanth Chilivery's user avatar
0 votes
0 answers
528 views

Decrypt TLS in Wireshark with (pre-)master key

I have been following the documentation about decrypting TLS using (pre-master) key, stored in (the RSA Session-ID:xxxx Master-Key:yyyy format) but it still won't decrypt it properly. I am using TLSv1....
Radim Vansa's user avatar
  • 5,726
0 votes
1 answer
103 views

tshark returns 0 results for filter icmp.no_resp but wireshark returns 12 resutls with the same filter

I am trying to do packet capture analysis with tshark on about 30000 files looking for a needle in the haystack.The files containing interesting needles contain icmp failures. I wrote a script which ...
There is more than one Zuul's user avatar
0 votes
1 answer
242 views

how to only print Lua output with tshark

I am using a Lua script with tshark and when I run it with -V I get the protocol decode output. When I try anything else to limit output to just the Lua decoded data I am not having any luck. i.e. ...
aley's user avatar
  • 1
0 votes
2 answers
124 views

SQL Parameters missing when using tshark against PostgreSQL v12 traffic

I'm attempting to spy on non-SSL PostgreSQL traffic using tshark using the following command: # tshark -f 'tcp dst port 5432' -O PGSQL \ -d 'tcp.port==5432,pgsql' -T fields -e pgsql.query I am ...
Patrick Rynhart's user avatar
0 votes
1 answer
314 views

Profinet LUA dissector without ports to extract specific bits

How can I make a Lua dissector/post-dissector/chained dissector that would get attached under the PROFINET IO Cyclic Service Data Unit and for example extract only the last 3 bits of the 5th byte, ...
maximusboscus's user avatar
0 votes
1 answer
645 views

Pyshark read all values from a packet as dictionary

I'm trying to read all parameters within the packet. Using cap[0].layer._all_fields able to get fields of particular layer/protocol. Looking for something similar say cap[0]._all_fields
chandan's user avatar
  • 93
1 vote
0 answers
102 views

sFlow display filters for source/destination ASN in wireshark

I have capture files containing sFlow data that I am trying to filter based on the "Extended gateway data" contained within. The documentation at https://www.wireshark.org/docs/dfref/s/...
FliesLikeABrick's user avatar
2 votes
0 answers
202 views

Wireshark LUA dissector to capture Profisafe packets across two way communication

There are two devices , IODevice and IOController.The Profisafe data consists of 13 byte.The profinet data telegram structure consists of 60 bytes. The profisafe data for IODevice -> IOController ...
shakingwindow's user avatar
1 vote
1 answer
625 views

Displaying the bits values of a number in Wireshark Postdissector

I am writing a wireshark dissector of a custom protocol using LUA.For this custom protocol,there are no underlying TCP port or UDP port hence i have written a postdissector. I am able to capture the ...
shakingwindow's user avatar
0 votes
1 answer
225 views

Capturing Profisafe packets using Lua Wireshark dissector

I am writing a Lua script to capture profisafe packets on wireshark.It is above the profinet layer in the stack.The wireshark dissect the profinet packets but does not dissect the profisafe. For other ...
Gopala Krishna's user avatar
-1 votes
1 answer
198 views

Wireshark shows plain number in place of longitude and latitude values

I am facing issue with coordinate calculation (Longitude and Latitude). I have a pcap file when I open it with Wireshark I am getting the packet as shown below - Latitude: 52.5125915 (52°30'45.33"...
Shah9il's user avatar
  • 61
0 votes
0 answers
618 views

Lua error "attempt to call global" on Wireshark dissector when using loadstring()

I'm trying to execute a custom function call dynamically defined using loadstring inside a Wireshark dissector. When using this method from inside another similar Lua script, it works fine: function ...
dariox's user avatar
  • 303
0 votes
1 answer
175 views

Wireshark plugin compiled

Trying to compile wireshark plugin using wireshark-nfc example (https://code.google.com/archive/p/wireshark-nfc/) #ifdef HAVE_CONFIG_H #include "config.h" #endif #define WS_BUILD_DLL #...
Felix's user avatar
  • 5
0 votes
1 answer
250 views

dynamic (based on prev protofield value) Protofield valuestring based

I'm developing a wireshark plugin in lua. I have a Protofield whose valuestring table changes based on the value of a previous field. I dont see a way to do that cleanly in the lua wireshark plugin I ...
Anirudh Chari's user avatar
-2 votes
1 answer
1k views

Wireshark Kerberos decrypt shows error "missing keytype 18"

When trying to decrypt the kerberos by using the keytab file it shows the error "missing keytype 18". The keytab file has the keytype 18.
Vishnu Gopalakrishnan's user avatar
0 votes
0 answers
476 views

How to verify TLSv1.2 SSL database connection in Python 3.x (sqlalchemy)

Currently I'm using mysql_engine = sqlalchemy.create_engine() in my Python code to connect with a MySQL database, I did some reading online, it says that TLSv1.2 is the default connection version, but ...
wawawa's user avatar
  • 2,955
0 votes
1 answer
466 views

Unable to Dissect L2TPV3 in Wireshark

I can view L2TPV3 in decode as but dissection not working out while analyzing log in Wireshark. Expect to see tunneled data mapped and could see in Wireshark. Anyone came across L2TP decoding on ...
SachinD's user avatar
  • 29
1 vote
1 answer
327 views

Wireshark Lua Dissector Response Request

does someone know how to use the Protofield.framenu for frametype.RESPONSE and frametype.REQUEST for an arrow in wireshark with marks the Sequencenumber between an ACK and DATA? Thanks a lot!
Glupschi's user avatar
  • 215
0 votes
1 answer
329 views

What is the Wireshark lua package path?

Our custom Wireshark dissector, coded in lua, starts with: -- Create a protocol object test_protocol = Proto("test", "test protocol") messageLength_F = ProtoField.uint32("...
DavidA's user avatar
  • 2,127
0 votes
2 answers
3k views

Using Wireshark with gRPC

I am trying to dissect TCP packets carrying gRPC payloads with Wireshark. Although I configured decoding as http2 and provided path to my .proto directory, Wireshark seem to only decrypt TLS data, and ...
Ohad's user avatar
  • 193
0 votes
1 answer
886 views

How to static compile tshark?

I compiled tshark with cmake. I running command cmake -DBUILD_wireshark=off; make CFLAGS="-static", then i found BUILD_wiresharktshark in build/run, but it's dynamic link, and dependency ...
Alex Liu's user avatar
0 votes
1 answer
176 views

Wireshark : how to force to drop packets with LUA?

I'm am facing to an issue when sniffing on the loopback interface when using a JTAG debug probe, which uses a TCP socket. It completly flood the loopback, and freeze Wireshark after a few seconds. As ...
Thom Armax's user avatar
0 votes
1 answer
114 views

Wireshark dissect information but not display in the dissect

This may have been explained elsewhere, but not finding it. I have to work within the confines of wireshark 2.4.x. So I defined some values for data as so. { &hf_td_timestamp, {...
Gary Barnes's user avatar
0 votes
2 answers
1k views

How NBNS packet is getting captured in Wireshark

Could anyone please tell how NBNS packets are getting generated in Wireshark once we start the live capturing for a particular interface. My objective is to get the hostname of the different machines ...
amt1906's user avatar
  • 75
1 vote
1 answer
1k views

Two Wireshark Dissectors with shared fields

I am writing a wireshark dissector for a custom protocol. The protocol has two variants, which are indistinguishable in general when looking at the dump. So usually the user will simply select the ...
Uroc327's user avatar
  • 1,389
0 votes
0 answers
894 views

How Parse KNX/IP on Wireshark

I have recently purchased a drone and I downloaded the app that is used to control it. I was able to generate packet capture pcap file from the traffic between the drone and the app and saw on ...
Muhammad Zian's user avatar
0 votes
1 answer
963 views

wireshark custom lua dissector display metaData column

For a wireshark custom lua dissector, id like to be able to display the "append_text" metaData in the wireshark column view. Makes it easier for other folk to see what's going on i.e. in ...
user3795557's user avatar
0 votes
1 answer
109 views

How to separate data from different files in a single TCP packet?

Say I have transmitted data of 2 files A.bin and B.bin, since a TCP packet can have data from more than one file starting at random position, after wireshark capture, how can I identify which part of ...
user9392307's user avatar
-1 votes
1 answer
40 views

How to identify implemented code location in open source project binaries?

There is a c code in wireshark packet-s7comm.c, after building how i will identify which generated binary is having its implementation ?
neeraj's user avatar
  • 31

1
2 3 4 5
7