wireshark自定义解析协议插件

--   自定义一个协议
  local demo_protocol=Proto("demo"," my protocol")
--    定义协议字段


  local demo_len=ProtoField.uint16("demo_len","demo len",base.HEX)
  local demo_Id=ProtoField.uint8("demo_Id","demo Id",DEC)
  local demo_message=ProtoField.uint32("demo_message","demo Message",DEC)
  local demo_data=ProtoField.bytes("demo_data","demo data")
--将字段绑定到协议中  
  demo_protocol.fields={
     demo_len,
demo_Id,
demo_message,
demo_data
  
  }
  
--  调用dissector函数，这个函数被wireshark调用  
  function demo_protocol.dissector(buff,pinfo,tree)


--   设置UI信息，pinfo显示的信息  
pinfo.cols.protocol:set("demotest")
pinfo.cols.info:set("the protocol")


local buf_len=buff:len()
 
local treeroot=tree:add(demo_protocol,buff(0,buff_len),"自定义解析协议报文")
    local offset=0
    local usDemoType=buff(offset,2):le_uint()
       if usDemoType<1 then
          treeroot:add(demo_len,buff(offset,2))
  else
  pinfo.col.protocol:set("Invalia MessageType(".. demo test protocol  ..")")
  return
      end    
         treeroot:add(demo_Id,buff(4,2))
           treeroot:add(demo_message,buff(6,2))
           treeroot:add(demo_data,buff(0,buf_len-10))
end   
     local tcp_port_table=DissectorTable.get("tcp.port")
           tcp_port_table:add(6000,demo_protocol)