-- 自定义一个协议
local demo_protocol=Proto("demo"," my protocol")
-- 定义协议字段
local demo_len=ProtoField.uint16("demo_len","demo len",base.HEX)
local demo_Id=ProtoField.uint8("demo_Id","demo Id",DEC)
local demo_message=ProtoField.uint32("demo_message","demo Message",DEC)
local demo_data=ProtoField.bytes("demo_data","demo data")
--将字段绑定到协议中
demo_protocol.fields={
demo_len,
demo_Id,
demo_message,
demo_data
}
-- 调用dissector函数,这个函数被wireshark调用
function demo_protocol.dissector(buff,pinfo,tree)
-- 设置UI信息,pinfo显示的信息
pinfo.cols.protocol:set("demotest")
pinfo.cols.info:set("the protocol")
local buf_len=buff:len()
local treeroot=tree:add(demo_protocol,buff(0,buff_len),"自定义解析协议报文")
local offset=0
local usDemoType=buff(offset,2):le_uint()
if usDemoType<1 then
treeroot:add(demo_len,buff(offset,2))
else
pinfo.col.protocol:set("Invalia MessageType(".. demo test protocol ..")")
return
end
treeroot:add(demo_Id,buff(4,2))
treeroot:add(demo_message,buff(6,2))
treeroot:add(demo_data,buff(0,buf_len-10))
end
local tcp_port_table=DissectorTable.get("tcp.port")
tcp_port_table:add(6000,demo_protocol)
local demo_protocol=Proto("demo"," my protocol")
-- 定义协议字段
local demo_len=ProtoField.uint16("demo_len","demo len",base.HEX)
local demo_Id=ProtoField.uint8("demo_Id","demo Id",DEC)
local demo_message=ProtoField.uint32("demo_message","demo Message",DEC)
local demo_data=ProtoField.bytes("demo_data","demo data")
--将字段绑定到协议中
demo_protocol.fields={
demo_len,
demo_Id,
demo_message,
demo_data
}
-- 调用dissector函数,这个函数被wireshark调用
function demo_protocol.dissector(buff,pinfo,tree)
-- 设置UI信息,pinfo显示的信息
pinfo.cols.protocol:set("demotest")
pinfo.cols.info:set("the protocol")
local buf_len=buff:len()
local treeroot=tree:add(demo_protocol,buff(0,buff_len),"自定义解析协议报文")
local offset=0
local usDemoType=buff(offset,2):le_uint()
if usDemoType<1 then
treeroot:add(demo_len,buff(offset,2))
else
pinfo.col.protocol:set("Invalia MessageType(".. demo test protocol ..")")
return
end
treeroot:add(demo_Id,buff(4,2))
treeroot:add(demo_message,buff(6,2))
treeroot:add(demo_data,buff(0,buf_len-10))
end
local tcp_port_table=DissectorTable.get("tcp.port")
tcp_port_table:add(6000,demo_protocol)