当我关闭wireshark时,如何获得wireshark Lua解剖器协议首选项以保存并保留?

eit*_*ama 3 lua wireshark wireshark-dissector

所以我写了我只能称之为很棒的解剖器的东西。它的作用不大,却大大提高了我的工作效率。

我唯一的问题是我暴露了一些首选项,它们不会坚持通过wireshark关闭/启动。

IE :

先决条件:Lua 脚本必须在插件目录中...

  1. 打开wireshark,编辑>首选项>协议>http.queryparameters...
  2. 将 Param1 值设置为“aaa”,单击“确定”。(它会正确影响解剖。)
  3. 关闭wireshark,重新开始,值又是别的了。

我的解剖器:

-- Written by Eitam Doodai
-- trivial postdissector example
-- declare some Fields to be read
full_uri_from_request = Field.new("http.request.full_uri")

-- declare our (pseudo) protocol
http_query_params_proto = Proto("http.query_parameters","HTTP Query Parameters Postdissector")

-- create the fields for our "protocol"
query_param1 = ProtoField.string("http.query_parameters.param1","PARAM1")
query_param2 = ProtoField.string("http.query_parameters.param2","PARAM2")
query_param3 = ProtoField.string("http.query_parameters.param3","PARAM3")

-- add the field to the protocol
http_query_params_proto.fields = {query_param1}
http_query_params_proto.fields = {query_param2}
http_query_params_proto.fields = {query_param3}

-- Add prefs
local p1 = http_query_params_proto.prefs
p1.value1 = Pref.string ("Param1 Value", "123", "Param key to extract")
p1.value2 = Pref.string ("Param2 Value", "456", "Param key to extract")
p1.value3 = Pref.string ("Param3 Value", "789", "Param key to extract")

-- create a function to "postdissect" each frame
function http_query_params_proto.dissector(buffer,pinfo,tree)
        -- obtain the current values the protocol fields
        local full_uri_value = full_uri_from_request()
        if full_uri_value then
                local value = tostring(full_uri_value)
                local subtree = tree:add(http_query_params_proto,"Query Param1")
                local subtree = tree:add(http_query_params_proto,"Query Param2")
                local subtree = tree:add(http_query_params_proto,"Query Param3")
                _, _, query_param1_str = string.find(value,p1.value1 .. "=([^&]+)")
                _, _, query_param2_str = string.find(value,p1.value2 .. "=([^&]+)")
                _, _, query_param3_str = string.find(value,p1.value3 .. "=([^&]+)")
                if query_param1_str then
                        subtree:add(query_param1,query_param1_str)
                end

                if query_param2_str then
                        subtree:add(query_param2,query_param2_str)
                end
                if query_param3_str then
                        subtree:add(query_param3,query_param3_str)
                end
        end
end

-- register our protocol as a postdissector
register_postdissector(http_query_params_proto)
Run Code Online (Sandbox Code Playgroud)

had*_*iel 5

如果您打开了一个控制台并从命令行启动了wireshark,在您更改了一项http.query_parameters.param设置后,保存并关闭了wireshark,然后重新启动它,您将看到如下内容:

...preferences line 1829: No such preference "http.query_parameters.value2" (applying your preferences once should remove this warning)
Run Code Online (Sandbox Code Playgroud)

这是一个问题:wireshark 打印出它在保存的首选项文件中找到的首选项,它不理解/不知道。

编辑:不要打开关于此的错误。问题是您使用了一个已经存在的协议名称,并带有首选项:“ http”。换句话说,由于您基本上是在命名首选项http.query...,wireshark 认为它应该属于http协议模块,但真正的 http模块对此一无所知,因此,wireshark 在下次尝试从首选项文件中读取时会打印该错误.

长话短说:更改 Proto 和字段等的名称,以免与真正的协议名称冲突。