Search code examples
luawiresharkwireshark-dissector

Wireshark Lua Dissector - How to set source and destination

I'm working on a Wireshark Dissector in Lua.

I try to provide wireshark as much information about my custom protocol as possible to make use of the available analysis tools. Therefore I'm trying to set the correct source and destination address for my protocol.

My protocol can be on top of different other protocols such as UDP or IEEE 802.15.4. So it might even be that the package source/destination is already set (UDP).

However I want wireshark to show my addresses, so I tried the following:

myproto = Proto("myproto"), "My Protocol")
myproto_source = ProtoField.uint16("myproto.src", "Source Address", base.HEX)
myproto.fields = { myproto_source }

function myproto.dissector(buffer, pinfo, tree)
    local subtree = tree:add(myproto, buffer(), "My Proto")

    subtree:add(myproto_source, buffer(0,2)

    -- does not work with error:
    -- bad argument #1 to '?' (Address expected, got userdata)
    pinfo.src = myproto_source

    -- does work, but only adds text, wireshark tools rely on pinfo.src
    pinfo.cols.src = tostring(buffer(0,2):uint())
end

udp_table = DissectorTable.get("udp.port")
udp_table:add( 12345, myproto )
wtap_encap_table = DissectorTable.get("wtap_encap")
wtap_encap_table:add(wtap["IEEE802_15_4"], myproto)

So is there maybe a datatype/class "address" that is necessary to set pinfo.src? Or is there a totally different way to set the packet information?

Thanks in advance!

Solution

  • pinfo.src takes an Address object (which is an IP address; not a 16-bit integer). Example usage:

    pinfo.src = Address.ip('1.2.3.4')

    Note that this only sets the text of the "Source" column shown in Wireshark. The underlying packet info cannot be modified, and the IP packet details will continue to show the actual IP address.