Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- do
- -- For each dest port we see a packet destined for, store the private "sequence #"
- -- we extracted from the UDP packet, so we can deduce which sequence number should
- -- be next
- local port_seq = {}
- -- create the dissector
- local udprecv = Proto("udprecv", "Dissector for our UDPrecv Receive Tester")
- -- Put one time initialization code here
- function udprecv.init()
- end
- -- field definitions for our protocol that tell wireshark
- -- how to parse and display the useful chunks of data
- local f = udprecv.fields
- f.seq = ProtoField.uint64("udprecv.seq", "seq")
- -- The dissector function is called for each captured packet for protocol
- -- that we subscribed
- function udprecv.dissector(buffer, pinfo, tree)
- -- Adding fields to the tree
- local subtree = tree:add(udprecv, buffer())
- -- find the chunk of buffer that holds our private "seq #", which starts at 8 bytes
- -- from the beginning of the packet, and is 8 bytes long
- local seq = buffer(8, 8)
- if not pinfo.visited then
- local port_str = tostring(pinfo.dst_port)
- if not port_seq[port_str] then
- -- we've never seen this port before, so add it to port_seq, initializing
- -- to our private "sequence number" that we've extracted from the packet
- port_seq[port_str] = seq
- else
- -- we've seen traffic to this port before, so take the last "sequence number"
- -- we saw, increment by one, and compare it with the sequence # we just
- -- extracted from the packet
- warn(port_seq[port_str])
- local expected = port_seq[port_str] + 1;
- if seq ~= expected then
- warn("not sequential")
- -- pinfo.cols.info = "SEQ: "..seq.." is Invalid!"
- else
- info("it was equal")
- end
- -- Regardless of what we found, set the current sequence number received
- -- for this UDP port
- port_seq[port_str] = { seq }
- end
- end
- subtree:add(f.seq, seq)
- end
- -- subscribe for UDP packets on ports 30300-30303
- local udp_table = DissectorTable.get("udp.port")
- for i,port in ipairs{30300,30301,30302,30303} do
- udp_table:add(port,udprecv);
- end
- end
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement