在Wireshark中爲非以太網數據創建Lua解析器

Question

我試圖在Wireshark中使用Lua腳本爲非以太網數據創建解剖器。例如，我捕獲I2C總線數據，將其轉換爲可由Wireshark打開的.pcap文件格式。每條記錄都有一個字節的地址和幾個字節的數據。我如何在Lua中處理這個問題以解剖數據？

Answer 1

如果你看一下packet-i2c.c源文件，你會看到258線，你需要用「i2c.message」表，類似於它是如何在How to register a Lua dissector for 802.1Q Ethernet payload問題在以上的Wireshark的說明註冊您的解剖Q &一個網站。所以，在你的情況下，像這樣：

-- Protocol 
local p_i2cfoo = Proto("i2cfoo", "I2C FOO Protocol") 

-- Fields 
local f_i2cfoo_addr = ProtoField.uint8("i2cfoo.addr", "Address", base.DEC) 
local f_i2cfoo_val16 = ProtoField.uint16("i2cfoo.val16", "Value 16", base.HEX) 
local f_i2cfoo_val32 = ProtoField.uint32("i2cfoo.val32", "Value 32", base.HEX) 

p_i2cfoo.fields = { f_i2cfoo_addr, f_i2cfoo_val16, f_i2cfoo_val32 } 

-- Dissection 
function p_i2cfoo.dissector(buf, pinfo, tree) 
    local i2cfoo_tree = tree:add(p_i2cfoo, buf(0,-1)) 

    pinfo.cols.protocol:set("I2CFOO") 
    pinfo.cols.info:set("Hello World!") 

    i2cfoo_tree:add(f_i2cfoo_addr, buf(0, 1)) 
    i2cfoo_tree:add(f_i2cfoo_val16, buf(1, 2)) 
    i2cfoo_tree:add(f_i2cfoo_val32, buf(3, 4)) 
end 

-- Registration 
local i2c_table = DissectorTable.get("i2c.message") 
i2c_table:add(0, p_i2cfoo)