在lua中编写wireshark解析器并将其设置在动态端口上

发布于 11-07 17:08 字数 2166 浏览 6 评论 0原文


我有一个按以下方式工作的客户端服务器协议。
客户端发送带有服务器 ID 的 udp 广播(到固定端口)。
服务器接收数据报,如果它与他的 ID 匹配,他就会向客户端发送他正在侦听的端口。
然后客户端打开到该端口的 tcp 连接。
我正在 Lua 中为此编写一个 Wireshark 解析器,我需要动态设置 tcp 连接的端口(我事先不知道服务器侦听的女巫端口)。

我尝试过类似的事情:

-- declare our protocol
myproto_udp_proto = Proto("myproto_UDP","myproto UDP Protocol")
myproto_tcp_proto = Proto("myproto_TCP","myproto TCP Protocol")
-- create a function to dissect it
function myproto_tcp_proto.dissector(buffer,pinfo,tree)
        pinfo.cols.protocol = "myproto TCP"
        local subtree = tree:add(myproto_tcp_proto,buffer(),"myproto TCP Protocol Data")
        if buffer(0,2):uint() == 0xF00D then
            subtree:add(buffer(0,2),"Magic(F00D)")
        else
            subtree:add(buffer(0,2),"Bad Magic")
        end
end
function myproto_udp_proto.dissector(buffer,pinfo,tree)
    pinfo.cols.protocol = "myproto UDP"
    local subtree = tree:add(myproto_udp_proto,buffer(),"myproto UDP Protocol Data")
    if buffer(0,2):uint() == 0xF00D then
        subtree:add(buffer(0,2),"Magic(F00D)")
        local command;
        local port = -1;
        if buffer(2,1):uint() == 01 then
            command = "Searching for server"
        elseif buffer(2,1):uint() == 02 then
            command = "I'm server"
            port = buffer(7,2):uint()
        else
            command = "unknown";
        end
        subtree:add(buffer(2,1),command)
        subtree:add(buffer(3,4),"Server id: " .. buffer(3,4):uint())
        if port ~= -1 then
            subtree:add(buffer(7,2),"Server listening port: " .. buffer(7,2):uint())
            subtree:add(buffer(9,4),"check bytes")
            myproto_tcp_init(port)
        end
    else
        subtree:add(buffer(0,2),"Bad Magic")
    end
end
-- load the udp.port table
udp_table = DissectorTable.get("udp.port")
-- register our protocol to handle udp port 1338
udp_table:add(1338,myproto_udp_proto)

function myproto_tcp_init(port)
    -- load the tcp.port table
    tcp_table = DissectorTable.get("tcp.port")
    -- register our protocol to handle tcp port !DYNAMIC!
    tcp_table:add(port,myproto_tcp_proto)
end

我缺少什么?
提前致谢

I have a client server protocol that works the following way.
Client sends udp broadcast with servers id (to a fixed port).
Server receives the datagram and if its matches his id he sends the client the port that he is listening to.
Then the client opens a tcp connection to that port.
I'm writing a Wireshark dissector in Lua for this thing and I need to setup the port for the tcp connection dynamically (I don't know in advance on witch port the servers listens).

I tried something like that:

-- declare our protocol
myproto_udp_proto = Proto("myproto_UDP","myproto UDP Protocol")
myproto_tcp_proto = Proto("myproto_TCP","myproto TCP Protocol")
-- create a function to dissect it
function myproto_tcp_proto.dissector(buffer,pinfo,tree)
        pinfo.cols.protocol = "myproto TCP"
        local subtree = tree:add(myproto_tcp_proto,buffer(),"myproto TCP Protocol Data")
        if buffer(0,2):uint() == 0xF00D then
            subtree:add(buffer(0,2),"Magic(F00D)")
        else
            subtree:add(buffer(0,2),"Bad Magic")
        end
end
function myproto_udp_proto.dissector(buffer,pinfo,tree)
    pinfo.cols.protocol = "myproto UDP"
    local subtree = tree:add(myproto_udp_proto,buffer(),"myproto UDP Protocol Data")
    if buffer(0,2):uint() == 0xF00D then
        subtree:add(buffer(0,2),"Magic(F00D)")
        local command;
        local port = -1;
        if buffer(2,1):uint() == 01 then
            command = "Searching for server"
        elseif buffer(2,1):uint() == 02 then
            command = "I'm server"
            port = buffer(7,2):uint()
        else
            command = "unknown";
        end
        subtree:add(buffer(2,1),command)
        subtree:add(buffer(3,4),"Server id: " .. buffer(3,4):uint())
        if port ~= -1 then
            subtree:add(buffer(7,2),"Server listening port: " .. buffer(7,2):uint())
            subtree:add(buffer(9,4),"check bytes")
            myproto_tcp_init(port)
        end
    else
        subtree:add(buffer(0,2),"Bad Magic")
    end
end
-- load the udp.port table
udp_table = DissectorTable.get("udp.port")
-- register our protocol to handle udp port 1338
udp_table:add(1338,myproto_udp_proto)

function myproto_tcp_init(port)
    -- load the tcp.port table
    tcp_table = DissectorTable.get("tcp.port")
    -- register our protocol to handle tcp port !DYNAMIC!
    tcp_table:add(port,myproto_tcp_proto)
end

What I'm missing?
Thanks in advance

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。

评论(1

爱你是孤单的心事2024-11-14 17:08:24

这里介绍的机制是有效的。问题在于端口号是从错误的字节中获取的(从缓冲区(4,2)而不是缓冲区(7,2))。

The mechanism presented here works. The problem was that the port number was taken from the wrong bytes (from buffer(4,2) instead of buffer(7,2)).

~没有更多了~
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文