Wireshark自定义协议RPUDPDL(UDP下载)插件 (lua版)

 

rpudpdl-proto.lua

-- reference "Wireshark User's Guide - Chapter 11. Lua Support in Wireshark"

-- RP UDP Download protocol
do
-- Proto
   local p_rpudpdl = Proto("rpudpdl","RecordPlayer UDP Download")

-- ProtoField
   local f_sn = ProtoField.uint32("rpudpdl.sn","sn")
   local f_ssid = ProtoField.uint32("rpudpdl.ssid","ssid")
   local f_datasize = ProtoField.uint32("rpudpdl.datasize","Data SIZE",base.DEC)
   local f_msgtype = ProtoField.int32("rpudpdl.msgtype","Msg Type",base.DEC, {
                                         [1] = "probe",
                                         [2] = "request",
                                         [3] = "stream-property",
                                         [4] = "frame-data",
                                         [5] = "ack",
                                         [6] = "send-data-end",
                                         [7] = "check-param",
                                         [8] = "probe-ack",
                                         [9] = "udp-packet",
                                         [10] = "resend",
                                         [11] = "refuse"
                                                                           })
   local f_data = ProtoField.bytes("rpudpdl.data", "Data")

   p_rpudpdl.fields = { f_sn, f_ssid, f_datasize, f_msgtype, f_data}

   local data_dis = Dissector.get("data")

   local function rpudpdl_dissector(tvb, pinfo, root)
      local tvb_len = tvb:len()
      if tvb_len < 16
      then
         return false
      end

      local v_sn = tvb(0,4)
      local v_ssid = tvb(4,4)
      local v_datasize = tvb(8,4)
      local v_msgtype = tvb(12,4)

      pinfo.cols.protocol = "rpudpdl"
      pinfo.cols.info = "RP UDP Download"

      local t = root:add(p_rpudpdl , tvb(0, 16))
      t:add(f_sn, v_sn)
      t:add(f_ssid, v_ssid)
      t:add(f_datasize, v_datasize)
      t:add(f_msgtype, v_msgtype)

      if tvb_len > 16
      then
         local data_len = tvb:len() - 16
         local d = root:add(tvb(16, data_len), "Data")
         d:append_text("("..data_len.." bytes)")
         d:add(tvb(16, data_len),"Data:")
         d:add(tvb(16, 0), "[Length: "..data_len.."]")

         local msgtype = v_msgtype:uint()
         if msgtype == 3
         then
            d:add(tvb(16, 4), "Duaration")
         end
      end

      return true
   end

   function p_rpudpdl.dissector(tvb, pinfo, root)
      if rpudpdl_dissector(tvb, pinfo, root)
      then
         --valid rpudpdl diagram
      else
         data_dis:call(tvb,pinfo,root)
      end
   end

   local udp_encap_table = DissectorTable.get("udp.port")
   udp_encap_table:add(1730, p_rpudpdl)
end

效果图如下：