WireShark Lua Example

最新推荐文章于 2024-05-22 01:33:34 发布

原创最新推荐文章于 2024-05-22 01:33:34 发布 · 182 阅读

1 ·

CC 4.0 BY-SA版权

文章标签：

#Lua #Go

WireShark 专栏收录该内容

21 篇文章

订阅专栏

本文介绍 Wireshark 中使用 Lua 脚本进行协议注册、文件转储、列编辑、对话框创建及包计数等功能的具体实现方法。

From: http://wiki.wireshark.org/Lua/Examples

Using Lua to register protocols to more ports

-- register http to handle ports 4888-4891
do
        local tcp_port_table = DissectorTable.get("tcp.port")
        local http_dissector = tcp_port_table:get_dissector(80)
        for port in {4888,4889,4890,4891} do
                tcp_port_table:add(port,http_dissector)
        end
end

dumping to multiple files

-- Create a file named by_ip/''ip_addess''.cap with all ip traffic of each ip host. (works for tshark only)
-- Dump files are created for both source and destination hosts
do
        local dir = "by_ip"
        local dumpers = {}
        local function init_listener()
                local tap = Listener.new("ip")
                -- we will be called once for every IP Header.
                -- If there's more than one IP header in a given packet we'll dump the packet once per every header
                function tap.packet(pinfo,tvb,ip)
                        local ip_src, ip_dst = tostring(ip.ip_src), tostring(ip.ip_dst)
                        local src_dmp, dst_dmp
                        src_dmp = dumpers[ip_src]
                        if not src_dmp then
                                src_dmp = Dumper.new_for_current( dir .. "/" .. ip_src .. ".pcap" )
                                dumpers[ip_src] = src_dmp
                        end
                        src_dmp:dump_current()
                        src_dmp:flush()
                        dst_dmp = dumpers[ip_dst]
                        if not dst_dmp then
                                dst_dmp = Dumper.new_for_current( dir .. "/" .. ip_dst .. ".pcap"  )
                                dumpers[ip_dst] = dst_dmp
                        end
                        dst_dmp:dump_current()
                        dst_dmp:flush()
                end
                function tap.draw()
                        for ip_addr,dumper in pairs(dumpers) do
                                 dumper:flush()
                        end
                end
                function tap.reset()
                        for ip_addr,dumper in pairs(dumpers) do
                                 dumper:close()
                        end
                        dumpers = {}
                end
        end
        init_listener()
end

editing columns

$/!\$ Inacurate and outdated, to be refactored to reflect current state of WSLUA API.

-- The following exaple inverts the src and dst columns in wireshark extracting the values with FieldExtractor
do
    local ip_src = FieldExtractor.new("ip.src")
    local ip_dst = FieldExtractor.new("ip.dst")
    local stupid_joke_tap = Tap.new("stupid_joke")
    stupid_joke_tap:use_fields(ip_src,ip_dst)
    stupid_joke_tap:register()
        function per_packet.stupid_joke(pinfo)
                col_src = pinfo:col.src
                col_dst = pinfo:col.dst
                col_src:set(ip_dst:get())
                col_dst:set(ip_src:get())
        end
end

dialogs an TextWindows

$/!\$ Inacurate and outdated, to be refactored to reflect current state of WSLUA API.

--  This Example will add a menu "Lua Dialog Test" that when selected will pop a dialog prompting the user for input that when accepted will pop a window with a result.

if gui_enabled() then
   local splash = TextWindow.new("Hello!");
   splash:set("This time wireshark has been enhanced with an useles feature.\n")
   splash:append("Go to Statistics->Useless Feature and check it out!")
end
function dialog_menu()
    function dialog_func(person,eyes,hair)
        local win = TextWindow.new("The Person");
        win:set(person)
        win:append(" with " .. eyes .." eyes and")
        win:append(" " .. hair .. " hair.");
    end

    new_dialog("Dialog Test",dialog_func,"A Person","Eyes","Hair")
end
register_menu("Useless Feature",dialog_menu)

Packet counter

do
    packets = 0;
    local function init_listener()
        local tap = Listener.new("frame","ip.addr == 10.0.0.0/8")
        function tap.reset()
            packets = 0;
        end
        function tap.packet(pinfo,tvb,ip)
            packets = packets + 1
        end
        function tap.draw()
            print("Packets to/from 10.0.0./8",packets)
        end
    end
    init_listener()
end