View difference between Paste ID: ZjTDB2XY and KxH8psCv
SHOW: | | - or go back to the newest paste.
1
-- ###########################################################################
2-
-- ################
2+
3
--
4-
-- ################
4+
-- Consider the Foo Protocol, which consists of only the Foo Packet defined as:
5-
local _curport = nil	-- current port under which this protocol is registered
5+
-- 
6
--  Byte Offset		Len	Desc
7
--  0			4	32-bit unsigned integer
8
--  4			8	ASCII string (zero-padded)
9
--  12			5	byte array
10
--  17			4	IPv4 address
11
-- 
12
-- Foo operates on UDP port 3456, but this port is configurable from Foo's preferences. 
13-
proto_foo.fields.num = ProtoField.uint32("foo.num", "Unsigned integer (32-bit)")
13+
-- This Wireshark Lua script implements this example protocol.
14-
proto_foo.fields.str = ProtoField.stringz("foo.str", "Null-terminated string")
14+
-- ########################################################################### 
15-
proto_foo.fields.bytes = ProtoField.bytes("foo.bytes", "Byte array")
15+
local _curport = nil		-- current port under which this protocol is registered
16-
proto_foo.fields.ip = ProtoField.ipv4("foo.ip", "IPv4 address")
16+
17
local DEFAULT_PORT = 3456
18
19
-- 1. Declare the protocol with the Proto() function.
20
local proto_foo = Proto("foo", "Foo Protocol")
21
22
-- 2. Declare the protocol's fields with the ProtoField.XXX() functions.
23
proto_foo.fields.num 	= ProtoField.uint32("foo.num", "Unsigned integer (32-bit)")
24
proto_foo.fields.str 	= ProtoField.stringz("foo.str", "Null-terminated string")
25
proto_foo.fields.bytes 	= ProtoField.bytes("foo.bytes", "Byte array")
26
proto_foo.fields.ip 	= ProtoField.ipv4("foo.ip", "IPv4 address")
27
28
-- 3. (OPTIONAL) Declare the protocol's preferences with the Pref.XXX() functions.
29
proto_foo.prefs.port = Pref.uint("Port", DEFAULT_PORT, "UDP port number")
30
31
-- 4. Declare the protocol's dissector function
32
function proto_foo.dissector(buf, pinfo, tree)
33
	
34
	if buf:len() >= MIN_LEN then
35
		local offset = 0
36
		local f = proto_foo.fields
37
		local subtree = tree:add(proto_foo, buf())
38
		subtree:add(f.num	, buf(offset, 4)); offset = offset + 4
39
		subtree:add(f.str	, buf(offset, 8)); offset = offset + 8
40
		subtree:add(f.bytes	, buf(offset, 5)); offset = offset + 5
41
		subtree:add(f.ip	, buf(offset, 4)); offset = offset + 4
42
	end	
43
end
44
	
45
-- 5. (OPTIONAL) Declare the protocol's init function. If this function is omitted,
46
-- perform the protocol registration outside of it. 
47
function proto_foo.init()
48
49
	-- 6. Register the protocol with a DissectorTable (TCP port in this case)
50
	local dt = DissectorTable.get("tcp.port")
51
	if _curport then dt:remove(_curport, proto_foo) end
52
	dt:add(proto_foo.prefs.port, proto_foo)
53
	_curport = proto_foo.prefs.port
54
end
55
56
-- XXX: do init here if proto_foo.init() does not exist. This file can
57
-- only ever be loaded once (no way to undeclare a Proto), so no need
58
-- to remove this dissector from a previously registered dissector table.
59
--DissectorTable.get("udp.port"):add(proto_foo.prefs.port, proto_foo)