64 lines
1.8 KiB
Markdown
64 lines
1.8 KiB
Markdown
|
# Lua Dissectors for Airstream PyShark
|
||
|
|
|
||
|
|
This directory contains example Lua dissectors that can be used with Wireshark/tshark to decode custom protocols in PyShark.
|
||
|
|
|
||
|
|
## Installation
|
||
|
|
|
||
|
|
1. Copy the Lua dissector files to your Wireshark plugins directory:
|
||
|
|
- **Linux/Mac**: `~/.local/lib/wireshark/plugins/` or `~/.config/wireshark/plugins/`
|
||
|
|
- **Windows**: `%APPDATA%\Wireshark\plugins\`
|
||
|
|
|
||
|
|
2. Restart Wireshark/tshark or reload Lua plugins (Ctrl+Shift+L in Wireshark)
|
||
|
|
|
||
|
|
3. The dissectors will automatically be available to PyShark
|
||
|
|
|
||
|
|
## Example Custom Protocol Dissector
|
||
|
|
|
||
|
|
The `example_custom_protocol.lua` demonstrates:
|
||
|
|
- Creating a custom protocol dissector
|
||
|
|
- Defining protocol fields
|
||
|
|
- Parsing packet structure
|
||
|
|
- Registering for specific UDP ports
|
||
|
|
- Heuristic dissection
|
||
|
|
|
||
|
|
## Using with PyShark
|
||
|
|
|
||
|
|
Once installed, PyShark will automatically use these dissectors:
|
||
|
|
|
||
|
|
```python
|
||
|
|
import pyshark
|
||
|
|
|
||
|
|
# Capture with custom dissector
|
||
|
|
capture = pyshark.FileCapture('capture.pcap')
|
||
|
|
for packet in capture:
|
||
|
|
if hasattr(packet, 'custom'):
|
||
|
|
print(f"Custom packet: {packet.custom.msg_type}")
|
||
|
|
```
|
||
|
|
|
||
|
|
## Creating Your Own Dissectors
|
||
|
|
|
||
|
|
1. Copy `example_custom_protocol.lua` as a template
|
||
|
|
2. Modify the protocol name, fields, and parsing logic
|
||
|
|
3. Register for appropriate ports or use heuristic detection
|
||
|
|
4. Place in Wireshark plugins directory
|
||
|
|
|
||
|
|
## Benefits for Airstream
|
||
|
|
|
||
|
|
Custom Lua dissectors enable:
|
||
|
|
- Decoding proprietary protocols (IENA, Chapter 10, etc.)
|
||
|
|
- Adding metadata extraction
|
||
|
|
- Protocol-specific statistics
|
||
|
|
- Enhanced filtering capabilities
|
||
|
|
|
||
|
|
## Testing Dissectors
|
||
|
|
|
||
|
|
Test your dissector in Wireshark GUI first:
|
||
|
|
1. Open a capture file
|
||
|
|
2. Check if protocol appears in packet list
|
||
|
|
3. Verify field extraction in packet details
|
||
|
|
4. Use display filters like `custom.msg_type == 1`
|
||
|
|
|
||
|
|
Then use with airstream_pyshark.py:
|
||
|
|
```bash
|
||
|
|
./airstream_pyshark.py -p capture.pcap --filter "custom"
|
||
|
|
```
|