WireShark Lua Example

From: http://wiki.wireshark.org/Lua/Examples

 

 

Using Lua to register protocols to more ports

 

 

-- register http to handle ports 4888-4891
do
        local tcp_port_table = DissectorTable.get("tcp.port")
        local http_dissector = tcp_port_table:get_dissector(80)
        for port in {4888,4889,4890,4891} do
                tcp_port_table:add(port,http_dissector)
        end
end

 

 

dumping to multiple files

 

 

-- Create a file named by_ip/''ip_addess''.cap with all ip traffic of each ip host. (works for tshark only)
-- Dump files are created for both source and destination hosts
do
        local dir = "by_ip"
        local dumpers = {}
        local function init_listener()
                local tap = Listener.new("ip")
                -- we will be called once for every IP Header.
                -- If there's more than one IP header in a given packet we'll dump the packet once per every header
                function tap.packet(pinfo,tvb,ip)
                        local ip_src, ip_dst = tostring(ip.ip_src), tostring(ip.ip_dst)
                        local src_dmp, dst_dmp
                        src_dmp = dumpers[ip_src]
                        if not src_dmp then
                                src_dmp = Dumper.new_for_current( dir .. "/" .. ip_src .. ".pcap" )
                                dumpers[ip_src] = src_dmp
                        end
                        src_dmp:dump_current()
                        src_dmp:flush()
                        dst_dmp = dumpers[ip_dst]
                        if not dst_dmp then
                                dst_dmp = Dumper.new_for_current( dir .. "/" .. ip_dst .. ".pcap"  )
                                dumpers[ip_dst] = dst_dmp
                        end
                        dst_dmp:dump_current()
                        dst_dmp:flush()
                end
                function tap.draw()
                        for ip_addr,dumper in pairs(dumpers) do
                                 dumper:flush()
                        end
                end
                function tap.reset()
                        for ip_addr,dumper in pairs(dumpers) do
                                 dumper:close()
                        end
                        dumpers = {}
                end
        end
        init_listener()
end

 

 

editing columns

 

Inacurate and outdated, to be refactored to reflect current state of WSLUA API.

 

-- The following exaple inverts the src and dst columns in wireshark extracting the values with FieldExtractor
do
    local ip_src = FieldExtractor.new("ip.src")
    local ip_dst = FieldExtractor.new("ip.dst")
    local stupid_joke_tap = Tap.new("stupid_joke")
    stupid_joke_tap:use_fields(ip_src,ip_dst)
    stupid_joke_tap:register()
        function per_packet.stupid_joke(pinfo)
                col_src = pinfo:col.src
                col_dst = pinfo:col.dst
                col_src:set(ip_dst:get())
                col_dst:set(ip_src:get())
        end
end

 

 

dialogs an TextWindows

 

Inacurate and outdated, to be refactored to reflect current state of WSLUA API.

 

--  This Example will add a menu "Lua Dialog Test" that when selected will pop a dialog prompting the user for input that when accepted will pop a window with a result.

if gui_enabled() then
   local splash = TextWindow.new("Hello!");
   splash:set("This time wireshark has been enhanced with an useles feature.\n")
   splash:append("Go to Statistics->Useless Feature and check it out!")
end
function dialog_menu()
    function dialog_func(person,eyes,hair)
        local win = TextWindow.new("The Person");
        win:set(person)
        win:append(" with " .. eyes .." eyes and")
        win:append(" " .. hair .. " hair.");
    end

    new_dialog("Dialog Test",dialog_func,"A Person","Eyes","Hair")
end
register_menu("Useless Feature",dialog_menu)

 

 

Packet counter

 

 

do
    packets = 0;
    local function init_listener()
        local tap = Listener.new("frame","ip.addr == 10.0.0.0/8")
        function tap.reset()
            packets = 0;
        end
        function tap.packet(pinfo,tvb,ip)
            packets = packets + 1
        end
        function tap.draw()
            print("Packets to/from 10.0.0./8",packets)
        end
    end
    init_listener()
end