Wireshark Lua Dissector: Transform Fixed Field Protocols into Comedy Bytes
In “A Wireshark Lua Dissector for Fixed Field Length Protocols,” Didier Stevens explains how to use a Lua dissector to parse TCP data. With the Wireshark 4.4.0 release, you can now configure fields like Function and Counter via custom columns, reducing the need for dissectors.
Hot Take:
Who knew that Wireshark and Lua could be the peanut butter and jelly of the cybersecurity world? With Wireshark 4.4.0, you can now cut the Lua middleman for some tasks and just configure your way to happiness. Sorry, Lua, you’re still cool, but Wireshark’s got some new tricks up its packet-sniffing sleeve!
Key Points:
- Wireshark 4.4.0 Release Candidate 1 introduces field expressions as custom columns.
- Custom columns can now be configured for specific fields without needing a custom Lua dissector.
- Examples include using field expressions to parse TCP payload bytes directly.
- Displayed column values are hexadecimal, with no direct way to convert to decimal integers.
- Feedback from the community is requested for potential solutions to decimal conversion.
Already a member? Log in here