Creating Lua dissector in Wireshark for non-Ethernet data

Question

I'm trying to create dissector in Wireshark using Lua script for non-Ethernet data. For example, I captured I2C bus data, converted it to .pcap file format, which can be opened by Wireshark. Each record has one byte of address and few bytes of data. How can I handle this in Lua for dissecting data?

Christopher Maynard Christopher Maynard · Accepted Answer · 2017-07-07T15:20:55

If you look at the packet-i2c.c source file, you will see on line 258 that you need to register your dissector with the "i2c.message" table, similar to how it was described in the How to register a Lua dissector for 802.1Q Ethernet payload question over at Wireshark's Q&A site. So, in your case, something like:

-- Protocol
local p_i2cfoo = Proto("i2cfoo", "I2C FOO Protocol")

-- Fields
local f_i2cfoo_addr = ProtoField.uint8("i2cfoo.addr", "Address", base.DEC)
local f_i2cfoo_val16 = ProtoField.uint16("i2cfoo.val16", "Value 16", base.HEX)
local f_i2cfoo_val32 = ProtoField.uint32("i2cfoo.val32", "Value 32", base.HEX)

p_i2cfoo.fields = { f_i2cfoo_addr, f_i2cfoo_val16, f_i2cfoo_val32 }

-- Dissection
function p_i2cfoo.dissector(buf, pinfo, tree)
    local i2cfoo_tree = tree:add(p_i2cfoo, buf(0,-1))

    pinfo.cols.protocol:set("I2CFOO")
    pinfo.cols.info:set("Hello World!")

    i2cfoo_tree:add(f_i2cfoo_addr, buf(0, 1))
    i2cfoo_tree:add(f_i2cfoo_val16, buf(1, 2))
    i2cfoo_tree:add(f_i2cfoo_val32, buf(3, 4))
end

-- Registration
local i2c_table = DissectorTable.get("i2c.message")
i2c_table:add(0, p_i2cfoo)

Creating Lua dissector in Wireshark for non-Ethernet data

1 Answers