-- Open a file for read an test that it worked fh,err = io.open(conf_file_name) if err then return err; end -- Failed -- line by line local tagname local lines_count = 0; while true do line = fh:read() if line == nil and lines_count == 0 then fh:close() return 1 end -- Failed if line == nil then fh:close() break end lines_count = lines_count + 1; words = string.gmatch(line, '([^,]+)') i = 0 for word in words do if (i == 0) then --tagname = tostring(tonumber (word, 16)) tagname = word end if (i == 1) then tagnames[tagname] = word end if (i == 2) then descriptions[tagname] = word end if (i == 3) then datatypes[tagname] = word end --[[ if (i == 4) then sizes[tagname] = word i = 0 break end--]] i= i+1 end end return 0 --Success end
f.tlvbody = ProtoField.uint8 ("myproto.tlvbody","----TlvBody----") -- A initialization routine local packet_counter function MYPROTO.init () packet_counter = 0 status = get_config ("C:\\Program Files\\Wireshark\\plugins\\tags.conf") end -- The dissector function function MYPROTO.dissector (buffer, pinfo, tree) -- Adding fields to the tree local subtree = tree:add (MYPROTO, buffer()) local offset = 0 pdu_len = buffer:len() subtree:add (f.packet, buffer(0,pdu_len)) if (pdu_len < 16) then subtree:add (f.error, "PDU too small. PDU length = 0x"..tonumber(pdu_len, 16).." bytes") subtree:add (f.packet_dump, buffer(0,pdu_len)) return end
subtree:add (f.pdu_size, pdu_len)
local Tlv_Len = buffer (offset, 4)
if (pdu_len ~= Tlv_Len:uint()) then
subtree:add (f.error, "TLV length is bigger than the payload.".." Payload = "..pdu_len..", TLV length = "..tonumber(tostring(Tlv_Len), 16)) subtree:add (f.packet_dump, buffer(0,pdu_len)) return end subtree:add (f.Tlv_Len, Tlv_Len) -- subtree:append_text (", TLV_LEN: " .. Tlv_Len:uint()) offset = offset + 4 local cmd_id = buffer (offset, 4) subtree:add (f.cmd_id, cmd_id) offset = offset + 4 local status = buffer (offset, 4) subtree:add (f.status, status) offset = offset + 4 local sequence = buffer (offset, 4) subtree:add (f.sequence, sequence) offset = offset + 4 n=1 if (offset == Tlv_Len:uint()) then subtree:add (f.error, "TLS body is empty") subtree:add (f.packet_dump, buffer(0,pdu_len)) return end
while (offset < Tlv_Len:uint())
do -- TLV must be at least 6 bytes if (Tlv_Len:uint() < (offset + 6)) then subtree:add (f.error, "TLS body is too small to decode") subtree:add (f.packet_dump, buffer(0,pdu_len)) return end subtree:add(f.tlvbody,n) n = n+1 tag = buffer(offset, 2) subtree:add (f.tag,tag) offset = offset + 2 local length = buffer (offset, 4) subtree:add (f.length, length) length = length:uint() offset = offset + 4 -- TLV length must be less than remaining bytes in the PDU if ((pdu_len - offset) < length) then subtree:add (f.error, "TLV length is too big "..pdu_len - offset.." "..offset.." "..length) subtree:add (f.packet_dump, buffer(0,pdu_len)) return end value = buffer(offset, length) subtree:add (f.value,value)
offset = offset + length
subtree:add (f.tagnames, tagnames ["0x"..tag]) subtree:add (f.descriptions, descriptions["0x"..tag]) subtree:add (f.datatypes, datatypes["0x"..tag]) -- local tt= tostring(value) if (datatypes["0x"..tag] == "TLV_TYPE_INT_SIZE_1") then subtree:add (f.parsedvalueuint8, value) end if (datatypes["0x"..tag] == "TLV_TYPE_INT_SIZE_4") then subtree:add (f.parsedvalueuint32, value) end if (datatypes["0x"..tag] == "TLV_TYPE_C_OCTSTR") then subtree:add (f.parsedvaluestring, value) end if (datatypes["0x"..tag] == "TLV_TYPE_INT_SIZE_8") then subtree:add (f.parsedvalueuint64, value) end
-- subtree:add (f.sizes, sizes["0x"..tag])
end end
-- Register the dissector
local tcp_table = DissectorTable.get ("tcp.port") tcp_table:add (8080, MYPROTO) -- Create a new postdissector MYPOST = Proto ("mypost", "My Post Dissector")