在Wireshark可以使用wireshark支持的lua语言进行定制或扩充。
注：本文所测试脚本以Wireshar2.0.4为准
#
工作中经常会遇到需要将某些UDP报文固定解析为RTP协议，这个操作通过在init.lua中扩充分析器
local rtp_dissector = Dissector.get("rtp")
DissectorTable.get("udp.port"):add(40002,rtp_dissector)
对于某些优先生效的解析协议，需要通过wireshar首选项里面的协议配置进行修改，以避免此段配置脚本不生效
如果固定将rtp协议中某些payload解析为某些协议，则可以进一步扩充DissectorTable.get("rtp.pt")
#监听器listner
在wireshark的帮助文档里面有如何使用lua写一个监听器的模板。监听器可以根据过滤报文采取某些动作。例如，将需要将报文流，写入到文件中，则可以依据此模板文件进行扩充
-- This program will register a menu that will open a window with a count of occurrences
-- of every address in the capture
local function menuable_tap()
-- Declare the window we will use
local tw = TextWindow.new("Address Counter")
-- This will contain a hash of counters of appearances of a certain address
local ips = {}
--
customized get the input filter content.取得和过滤显示报文一样的条件，以适应变化
local filter = "rtp"
if string.len(get_filter()) > 0 then
filter = get_filter()
end
-- for get field info from each packet
local udp_data = Field.new("udp")
-- this is our tap
local tap = Listener.new(
"ip",filter);
function remove()
-- this way we remove the listener that otherwise will remain running indefinitely
tap:remove();
end
-- we tell the window to call the remove() function when closed
tw:set_atclose(remove)
-- this function will be called once for each packet
function tap.packet(pinfo,tvb)
local src = ips[tostring(pinfo.src)] or 0
local dst = ips[tostring(pinfo.dst)] or 0
ips[tostring(pinfo.src)] = src + 1
ips[tostring(pinfo.dst)] = dst + 1
--customized each packet to write,get field data pinfo是包的一些信息 tvb是报文数据信息.获得udp信息域获得一些基础偏移量，以利于计算
local udpFieldInfo = udp_data()
local offset = udpFieldInfo.offset
--根据应用协议所需要的偏移进行偏移计算，以取到相应的数据
local wirte_content = tvb:raw(offset)
--根据某些规则写入
end
-- this function will be called once every few seconds to update our window
function tap.draw(t)
tw:clear()
for ip,num in pairs(ips) do
tw:append(ip .. "\t" .. num .. "\n");
end
end
-- this function will be called whenever a reset is needed
-- e.g. when reloading the capture file
function tap.reset()
tw:clear()
ips = {}
end
end
-- using this function we register our function
-- to be called when the user selects the Tools->Test->Packets menu
register_menu("Test/Packets", menuable_tap, MENU_TOOLS_UNSORTED)
