Foo Protocol Example (Wireshark Lua)

-- ###########################################################################
-- # proto_foo.lua
--
-- Consider the Foo Protocol, which consists of only the Foo Packet defined as:
--
--  Byte Offset     Len Desc
--  0           4   32-bit unsigned integer
--  4           8   ASCII string (zero-padded)
--  12          5   byte array
--  17          4   IPv4 address
--
-- Foo operates on UDP port 3456, but this port is configurable from Foo's preferences.
-- This Wireshark Lua script implements this example protocol.
-- ###########################################################################
local _curport = nil        -- current port under which this protocol is registered
local MIN_LEN = 21      -- min buffer length (21 = 4+8+5+4)
local DEFAULT_PORT = 3456

-- 1. Declare the protocol with the Proto() function.
local proto_foo = Proto("foo", "Foo Protocol")

-- 2. Declare the protocol's fields with the ProtoField.XXX() functions.
proto_foo.fields.num    = ProtoField.uint32("foo.num", "Unsigned integer (32-bit)")
proto_foo.fields.str    = ProtoField.stringz("foo.str", "Null-terminated string")
proto_foo.fields.bytes  = ProtoField.bytes("foo.bytes", "Byte array")
proto_foo.fields.ip     = ProtoField.ipv4("foo.ip", "IPv4 address")

-- 3. (OPTIONAL) Declare the protocol's preferences with the Pref.XXX() functions.
proto_foo.prefs.port = Pref.uint("Port", DEFAULT_PORT, "UDP port number")

-- 4. Declare the protocol's dissector function
function proto_foo.dissector(buf, pinfo, tree)

    if buf:len() >= MIN_LEN then
        local offset = 0
        local f = proto_foo.fields
        local subtree = tree:add(proto_foo, buf())
        subtree:add(f.num   , buf(offset, 4)); offset = offset + 4
        subtree:add(f.str   , buf(offset, 8)); offset = offset + 8
        subtree:add(f.bytes , buf(offset, 5)); offset = offset + 5
        subtree:add(f.ip    , buf(offset, 4)); offset = offset + 4
    end
end

-- 5. (OPTIONAL) Declare the protocol's init function. If this function is omitted,
-- perform the protocol registration outside of it.
function proto_foo.init()

    -- 6. Register the protocol with a DissectorTable (TCP port in this case)
    local dt = DissectorTable.get("tcp.port")
    if _curport then dt:remove(_curport, proto_foo) end
    dt:add(proto_foo.prefs.port, proto_foo)
    _curport = proto_foo.prefs.port
end

-- XXX: do init here if proto_foo.init() does not exist. This file can
-- only ever be loaded once (no way to undeclare a Proto), so no need
-- to remove this dissector from a previously registered dissector table.
--DissectorTable.get("udp.port"):add(proto_foo.prefs.port, proto_foo)