Wireshark - Revision history

Camille: /* Display Filter */

2024-06-07T09:45:51Z

Display Filter

Camille: /* Adding dissectors */

2023-10-03T12:42:45Z

Adding dissectors

Camille at 12:13, 3 October 2023

2023-10-03T12:13:17Z

Camille at 12:10, 3 October 2023

2023-10-03T12:10:24Z

Camille: Created

2023-10-03T10:24:12Z

Created

New page

[https://www.wireshark.org/ Wireshark] is an incredible tool to analyze network traffic.

=== Adding dissectors ===
A dissector is a protocol analyzer. It can be written in LUA.

You can put your lua scripts in

* Linux: <code>$HOME/.config/wireshark</code>
* Windows: <code>%AppData%\Wireshark\plugins</code> or <code>%ProgramFiles%\Wireshark\plugins</code> (folders are shown in Help–>About Wireshark–>Folders)

For Linux, you need to add a <code>init.lua</code> script that will load them with <code>dofile("myfile.lua")</code>, in Windows it loads all present in the folder.

In recent versions of Wireshark, LUA [https://bitop.luajit.org bitop] can be used directly.

=== Useful dissectors ===

==== ST2026 ====
[[:File:ST2022 Dissector.zip|ST2022_Dissector.lua]]

Select the "RTP Payload type" 96 to <code>ST2022-6</code> for ProMPEG FEC.

==== ULPFEC (<nowiki>RFC 5109</nowiki>) ====
[[:File:Ulpfec.zip|ulpfec.lua]]

Select the "RTP Payload type" 96 to <code>ULPFEC</code> for RFC 5109 FEC.

==== MPEG-TS Dump ====
[[:File:Mpeg packets dump.zip|mpeg_packets_dump.zip]]

Use Tools->Dump MPEG TS Packets to export the MPEG-TS stream to a file.

@@ Line 27: / Line 27: @@
 *<code>tcp.flags.push==1</code>
 *<code>vlan && udp</code>
 ===Decoding===

@@ Line 28: / Line 28: @@
 *<code>vlan && udp</code>
-=== Decoding ===
+===Decoding===
 To choose a decoder, right-click on one packet, and choose "Decode as...".
@@ Line 36: / Line 36: @@
 ===Adding dissectors===
-A dissector is a protocol analyzer. It can be written in LUA.
+A dissector is a protocol analyzer. It can be written in [https://www.lua.org/ LUA].
 You can put your lua scripts in

@@ Line 1: / Line 1: @@
 [https://www.wireshark.org/ Wireshark] is an incredible tool to analyze network traffic.
-=== Capture filtering ===
+===Capture filtering===
 See [https://wiki.wireshark.org/CaptureFilters CaptureFilters]. Syntax is different from display filters.
@@ Line 10: / Line 10: @@
 Typical filters are:
-* <code>tcp and port 80</code>
+*<code>tcp and port 80</code>
-* <code>udp and (port 8000 or port 8002)</code>
+*<code>udp and (port 8000 or port 8002)</code>
-* <code>host 232.128.12.3</code>
+*<code>host 232.128.12.3</code>
-* <code>igmp</code>
+*<code>igmp</code>
-* <code>icmp</code>
+*<code>icmp</code>
-=== Display Filter ===
+===Display Filter===
 See [https://wiki.wireshark.org/DisplayFilters DisplayFilters]. Syntax is different from capture filters.
@@ Line 23: / Line 23: @@
 Typical filters are :
-* <code>ip.addr==192.168.1.12</code>
+*<code>ip.addr==192.168.1.12</code>
-* <code>tcp.port==80</code>
+*<code>tcp.port==80</code>
-* <code>tcp.flags.push==1</code>
+*<code>tcp.flags.push==1</code>
-* <code>vlan && udp</code>
+*<code>vlan && udp</code>
 ===Adding dissectors===
@@ Line 61: / Line 68: @@
 Use Tools->Dump MPEG TS Packets to export the MPEG-TS stream to a file.
-===== UltraVox 2.1 (Shoutcast 2) =====
+=====UltraVox 2.1 (Shoutcast 2)=====
 [[:File:Uvox21.zip|uvox21.lua]]
 For TCP stream, use <code>UVOX21</code>.
-===== ADTS =====
+=====ADTS=====
 [[:File:Adts.zip|adts.lua]]
 For UDP/TCP stream, use <code>ADTS</code>.

@@ Line 1: / Line 1: @@
 [https://www.wireshark.org/ Wireshark] is an incredible tool to analyze network traffic.
-=== Adding dissectors ===
+=== Capture filtering ===
 A dissector is a protocol analyzer. It can be written in LUA.
 You can put your lua scripts in
-* Linux: <code>$HOME/.config/wireshark</code>
+*Linux: <code>$HOME/.config/wireshark</code>
-* Windows:  <code>%AppData%\Wireshark\plugins</code> or <code>%ProgramFiles%\Wireshark\plugins</code> (folders are shown in Help–>About Wireshark–>Folders)
+*Windows:  <code>%AppData%\Wireshark\plugins</code> or <code>%ProgramFiles%\Wireshark\plugins</code> (folders are shown in Help–>About Wireshark–>Folders)
 For Linux, you need to add a <code>init.lua</code> script that will load them with <code>dofile("myfile.lua")</code>, in Windows it loads all present in the folder.
@@ Line 13: / Line 40: @@
 In recent versions of Wireshark, LUA [https://bitop.luajit.org bitop] can be used directly.
-=== Useful dissectors ===
+====Useful dissectors====
-==== ST2026 ====
+=====ST2026=====
 [[:File:ST2022 Dissector.zip|ST2022_Dissector.lua]]
-Select the "RTP Payload type" 96 to <code>ST2022-6</code> for ProMPEG FEC.
+Select the "RTP Payload type" to <code>ST2022-6</code> for ProMPEG FEC.
-==== ULPFEC (<nowiki>RFC 5109</nowiki>) ====
+=====ULP-FEC (<nowiki>RFC 5109</nowiki>)=====
 [[:File:Ulpfec.zip|ulpfec.lua]]
-Select the "RTP Payload type" 96 to <code>ULPFEC</code> for RFC 5109 FEC.
+Select the "RTP Payload type" to <code>ULPFEC</code> for RFC 5109 FEC.
-==== MPEG-TS Dump ====
+=====MPEG-TS Dump=====
 [[:File:Mpeg packets dump.zip|mpeg_packets_dump.zip]]
 Use Tools->Dump MPEG TS Packets to export the MPEG-TS stream to a file.