How wireshark dissect correctly with two lua dissectors on the same port

Question

I'm writting lua scripts as wireshark(1.12.4) plugin to dissect my private protocols,I have two protocols,and I write single lua script for each of them,both lua script seems like follow:

local my_pro = Proto("MyPro","My Protocol")
local my_pro_field_1 = ProtoField.uint16("MyPro.filed_1","Field 1",base.HEX)
local my_pro_field_2 = ProtoField.uint16("MyPro.filed_2","Field 2",base.HEX)
my_pro.fields = {my_pro_field_1,my_pro_field_2}

local data_dis = Dissector.get("data")

function my_pro.dissector(buf,pkt,root)
    if (buf(0,2):uint() ~= 1 or buf(2,2):uint() ~= 1) then
        data_dis:call(buf,pkt,root)
        return false
    end
    pkt.cols.protocol = "My Protocol"
    local tree = root:add(my_pro,buf(0,buf:len()))
    tree:add_le(my_pro_field_1,buf(0,2))
    tree:add_le(my_pro_field_2,buf(2,2))
    return true
end
local tcp_encap_table = DissectorTable.get("tcp.port")
tcp_encap_table:add(80,my_pro)

The problem is: The two protocol use the same port,as I add both of these scripts to the wireshark's init.lua,only one of them take effect. So,how can I get these two protocol dissector work correctly in the mean time? Any solution is good but the port can't be changed.

mjs mjs · Accepted Answer · 2015-03-23T13:50:22

If the port definitely can't be changed (which would be strange, since this appears to be running on port 80, which is the IANA-assigned port for http) you have two real choices.

1) From the wireshark packet list, use the "decode-as" option to manually select the protocol you want for each tcp stream - although this may modify for all streams in the capture.

2) Add an extra dissector layer, that takes the payload from the tcp.data, detects which of your protocols it is, and then passes the data on to your real dissectors.

A third option, is just to combine your separate dissectors into one. Assuming each tcp stream will only have one or other protocol in it, figure out in the first packet which protocol it is, and then decode as that.

How wireshark dissect correctly with two lua dissectors on the same port

1 Answers