Rootconf 2019

On infrastructure security, cloud architecture, cloud optimization and distributed systems

Shooting the trouble down to the Wireshark Lua plugin

Submitted by Shakthi Kannan (@shakthimaan) on Wednesday, 27 February 2019

videocam_off

Technical level

Intermediate

Section

Full talk of 40 mins duration

Status

Confirmed & Scheduled

View proposal in schedule

Vote on this proposal

Login to vote

Total votes:  +2

Abstract

Wireshark is a Free (Libre) and Open Source protocol analyzer used for troubleshooting networks, and analysis of communication protocols. The Lua programming language support has been included in Wireshark for scripting, prototyping and packet dissection. At Aerospike, a NoSQL database company, we have implemented a Wireshark Lua plugin to help us solve issues at the wire level. In this talk, I will be sharing the experiences and knowledge gained in creating a Lua dissector plugin. This includes code structure, layout, snippets, prototyping, testing, use cases and documentation.

Outline

  • Objectives
  • Lua and Wireshark Lua
  • Usage and Example
  • Debugging and Linting
  • Literate Programming
  • Markdown Structure
  • lit2lua
  • Protocol Dissection Pattern
  • Dissector Table
  • Wireshark User Interface
  • Info, Message and Heartbeat Protocol
  • Hot key Report
  • Testing
  • Demo
  • Future Work
  • References

Source Code: https://github.com/aerospike/aerospike-wireshark-plugin

Requirements

None

Speaker bio

Shakthi Kannan is a Free Software enthusiast who plays a Senior DevOps Engineer role at Aerospike, Bengaluru. He has developed the Aerospike Wireshark Lua plugin that is used for troubleshooting and network analysis. He is an avid promoter of Free (Libre) and Open Source Software, and blogs at shakthimaan.com. He holds a Masters degree in Information Technology from Rochester Institute of Technology.

Links

Slides

http://shakthimaan.com/downloads/Shooting-the-trouble-down-to-the-Wireshark-Lua-plugin.pdf

Comments

  • 1
    Kushal Das (@kushaldas) a month ago

    Hi,

    Can you please also add examples of simpler protocol which everyone uses? Say how to disect DNS packets (queries/answers).

  • 1
    Shakthi Kannan (@shakthimaan) Proposer a month ago (edited a month ago)

    The protocols like DNS are already built into Wireshark and are implemented in C. Please refer https://wiki.wireshark.org/DNS. This talk demontrates how you can go about writing a Wireshark Lua plugin for a custom protocol for troubleshooting and network packet analysis. The Aerospike Wireshark Lua plugin is available as Free Software at https://github.com/aerospike/aerospike-wireshark-plugin. Based on your feedback, I have changed the talk level to intermediate. Thanks!

Login with Twitter or Google to leave a comment