5

I'm looking for a long time to a way to compile and run a custom Wireshark dissector, without needing to recompile the entire wireshark project. Many places on the Web, require developers to write their plugins and link to Wireshark.

However, I have found that some people were able to write the dissector and make it run using the plugin system from Wireshark, whose paths are found in Wireshark Help/About section.

Despite these people showing success writing dissectors in Lua and in C++, I have tried many tutorials, but I'm really lost.

Could someone help me with the steps to make a very simple Wireshark dissector on Ubuntu 16.04 64bit?

Fernando
  • 1,477
  • 2
  • 14
  • 33
  • 1
    I'm a bit confused about the term _dissector_. That's not familiar. Do you have a link what that exactly refers to? I know that it's possible to write all kind of package parser plugins, that may applied for specific protocols. – user0042 Sep 18 '17 at 20:17
  • Possible duplicate of [How can I add a custom protocol analyzer to wireshark?](https://stackoverflow.com/questions/4904991/how-can-i-add-a-custom-protocol-analyzer-to-wireshark) – user0042 Sep 18 '17 at 20:20
  • dissector is a wireshark lingo: it's a packet analyser plugin. – Jean-François Fabre Sep 18 '17 at 20:33

1 Answers1

8

There are three ways to write a custom dissector for Wireshark:

  1. C++
  2. Lua
  3. Wireshark Generic Dissector

Several years ago, I needed to write a dissector for a custom protocol my company uses. I compared the three options and learned a bit about them. C++ is the fastest execution but most difficult to learn and use. Lua and WSGD are about the same in execution speed. Lua dissector is built-in to Wireshark, however, I found that it is more difficult to learn because you need to learn a language (Lua) and then how to write dissectors in the language. WSGD is a language designed specially for writing dissectors. It is more like a structure definition that a flow-control language. The WSGD website has documentation and examples. It is hard to find documentation and examples for Lua and how writing dissectors in it.

In 2015 Graham Bioice presented "Writing a Wireshark Dissector Using WSGD, Lua and C" at Sharkfest. It's a very through presentation on the topic, although it was too late to help me. You can get the slide deck and see the presentation at:

For the reasons I listed above, I choose WSGD. I have written several thousand lines to create dissectors for three custom protocols in WSGD. I highly recommend it. The WSGD website is http://wsgd.free.fr

Wayne Goode
  • 213
  • 3
  • 6