Wireshark中Lua dissector端口分配及协议识别技术咨询

Got it, let's walk through building your Lua dissector for Wireshark to identify this custom vendor protocol. Here's a practical, step-by-step approach tailored to your scenario:

Since all traffic uses the same IP address, with separate UDP ports for sending and receiving, we'll use IP + port combination to target your protocol (this avoids conflicts with other protocols that might use the same ports but different IPs). First, jot down:

• The target IP address (e.g., 192.168.1.100)
• The UDP port used for sending (let's call this SEND_PORT)
• The UDP port used for receiving (let's call this RECV_PORT)

Start with a basic skeleton that registers your protocol and binds it to the right traffic. Here's a working example you can adapt:

-- Create a protocol object (name = internal ID, description = display name)
local my_vendor_proto = Proto("vendorproto", "Vendor Custom 3-Process Protocol")

-- Define fields to parse (customize these based on your actual packet structure)
local proto_fields = {
    msg_type = ProtoField.uint8("vendorproto.msg_type", "Message Type", base.DEC),
    payload_length = ProtoField.uint16("vendorproto.payload_len", "Payload Length", base.DEC),
    session_id = ProtoField.uint32("vendorproto.session_id", "Session ID", base.HEX),
    payload = ProtoField.bytes("vendorproto.payload", "Raw Payload")
}
my_vendor_proto.fields = proto_fields

-- The core dissector function that parses packets
function my_vendor_proto.dissector(buffer, pinfo, tree)
    -- Set the protocol column in Wireshark to your protocol's name
    pinfo.cols.protocol = my_vendor_proto.name

    -- Skip empty packets
    if buffer:len() == 0 then return end

    -- Add a top-level node to the packet details tree
    local proto_tree = tree:add(my_vendor_proto, buffer())

    -- Parse fields (adjust offsets and lengths to match your packet format)
    proto_tree:add(proto_fields.msg_type, buffer(0, 1))
    proto_tree:add(proto_fields.payload_length, buffer(1, 2))
    proto_tree:add(proto_fields.session_id, buffer(3, 4))
    -- Use the payload length field to grab the rest of the data
    local payload_len = buffer(1, 2):uint()
    proto_tree:add(proto_fields.payload, buffer(7, payload_len))
end

-- Helper function to check if a packet matches our IP + port criteria
local function matches_target_traffic(pinfo, target_port)
    local TARGET_IP = "X.X.X.X" -- Replace with your actual target IP
    -- Check if either source/dest IP is the target, and port matches
    return (pinfo.src == TARGET_IP or pinfo.dst == TARGET_IP) 
           and (pinfo.src_port == target_port or pinfo.dst_port == target_port)
end

-- Bind our dissector to the send port, with IP filtering
local udp_table = DissectorTable.get("udp.port")
local original_send_dissector = udp_table:get_dissector(SEND_PORT)
udp_table:add(SEND_PORT, function(buffer, pinfo, tree)
    if matches_target_traffic(pinfo, SEND_PORT) then
        my_vendor_proto.dissector(buffer, pinfo, tree)
    else
        -- Fall back to the original dissector if traffic doesn't match
        original_send_dissector:call(buffer, pinfo, tree)
    end
end)

-- Repeat for the receive port
local original_recv_dissector = udp_table:get_dissector(RECV_PORT)
udp_table:add(RECV_PORT, function(buffer, pinfo, tree)
    if matches_target_traffic(pinfo, RECV_PORT) then
        my_vendor_proto.dissector(buffer, pinfo, tree)
    else
        original_recv_dissector:call(buffer, pinfo, tree)
    end
end)

1. Save the script as vendorproto.lua and move it to Wireshark's personal plugins folder (find this via Help > About Wireshark > Folders > Personal Plugins).
2. Restart Wireshark, load your capture file or start a live capture.
3. Filter for vendorproto (the internal ID you set) to see if packets are being correctly identified.
4. If something's off, use the Lua Console (Tools > Lua Console) to print debug info (add print("Packet length:", buffer:len()) to the dissector function, for example).

• If you have the vendor's packet specification, update the proto_fields and parsing offsets to match the actual structure (e.g., add enum labels for message types with base.DEC, {[1] = "Login", [2] = "Data"}).
• If you don't have a spec, use Wireshark's Follow UDP Stream feature to analyze raw packet bytes. Look for fixed headers, length fields, or unique byte patterns you can use to refine parsing.
• For the 3-process setup: If each process uses distinct message types or session IDs, add logic to highlight these in the packet details (e.g., add a comment to the tree like proto_tree:add("Process: Login Service") if msg_type == 1).

If you want flexibility (e.g., letting users set the target IP/port without editing the script), add Wireshark preferences using my_vendor_proto.prefs—this makes the dissector more user-friendly for future tweaks.

内容的提问来源于stack exchange，提问作者user1977050