所以我写了一篇我只能称之为真棒解剖器的文章。它没有做太多,但它大大提高了我的工作效率。
我唯一的问题是我暴露了一些偏好,他们不会通过wireshark关闭/开始。
即。 :
先决条件:Lua脚本必须在插件目录中...
我的解剖员:
-- Written by Eitam Doodai
-- trivial postdissector example
-- declare some Fields to be read
full_uri_from_request = Field.new("http.request.full_uri")
-- declare our (pseudo) protocol
http_query_params_proto = Proto("http.query_parameters","HTTP Query Parameters Postdissector")
-- create the fields for our "protocol"
query_param1 = ProtoField.string("http.query_parameters.param1","PARAM1")
query_param2 = ProtoField.string("http.query_parameters.param2","PARAM2")
query_param3 = ProtoField.string("http.query_parameters.param3","PARAM3")
-- add the field to the protocol
http_query_params_proto.fields = {query_param1}
http_query_params_proto.fields = {query_param2}
http_query_params_proto.fields = {query_param3}
-- Add prefs
local p1 = http_query_params_proto.prefs
p1.value1 = Pref.string ("Param1 Value", "123", "Param key to extract")
p1.value2 = Pref.string ("Param2 Value", "456", "Param key to extract")
p1.value3 = Pref.string ("Param3 Value", "789", "Param key to extract")
-- create a function to "postdissect" each frame
function http_query_params_proto.dissector(buffer,pinfo,tree)
-- obtain the current values the protocol fields
local full_uri_value = full_uri_from_request()
if full_uri_value then
local value = tostring(full_uri_value)
local subtree = tree:add(http_query_params_proto,"Query Param1")
local subtree = tree:add(http_query_params_proto,"Query Param2")
local subtree = tree:add(http_query_params_proto,"Query Param3")
_, _, query_param1_str = string.find(value,p1.value1 .. "=([^&]+)")
_, _, query_param2_str = string.find(value,p1.value2 .. "=([^&]+)")
_, _, query_param3_str = string.find(value,p1.value3 .. "=([^&]+)")
if query_param1_str then
subtree:add(query_param1,query_param1_str)
end
if query_param2_str then
subtree:add(query_param2,query_param2_str)
end
if query_param3_str then
subtree:add(query_param3,query_param3_str)
end
end
end
-- register our protocol as a postdissector
register_postdissector(http_query_params_proto)
答案 0 :(得分:3)
如果您打开控制台并从命令行启动wireshark,在更改其中一个http.query_parameters.param
设置后,保存并关闭wireshark,然后重新启动它,您会看到如下内容:
...preferences line 1829: No such preference "http.query_parameters.value2" (applying your preferences once should remove this warning)
这是一个问题:wireshark打印出它在保存的偏好文件中找到的偏好,它不理解/不知道。
编辑:不要打开关于此的错误。问题是您使用了已存在的带有首选项的协议名称:“http
”。换句话说,因为你基本上命名了首选项http.query...
,所以wireshark认为它应该属于http
协议模块,但是真正的 http
模块没有我对此一无所知,所以wireshark会在下次尝试从首选项文件中读取错误时打印出错误。
长话短说:更改Proto和字段等的名称,以免与真正的协议名称冲突。