View source for Programming Wireshark With Lua

From BruCON 2017

You do not have permission to edit this page, for the following reasons:

The action you have requested is limited to users in the group: Users.
This page has been protected to prevent editing or other actions.

You can view and copy the source of this page.

In this 2 hour workshop, you will learn how to program Wireshark with the Lua programming language. 
 
Wireshark can be extended using the C and Lua programming languages. In this workshop, we will look into Lua taps and dissectors to help you analyze traffic that "pure" Wireshark does not understand. Wireshark dissectors are often designed to analyze a network protocol. 

You will learn how to install Lua dissectors and program your own. 
Say you are reversing a botnet, then you can develop your own dissector that analyses the custom network protocol that the botnet uses to communicate between the C&C and the clients. But custom dissectors can help you even with known network protocols. For example, Didier will teach you the inner workings of a simple custom dissector he developed in Lua to display TCP flags like Snort.

Return to Programming Wireshark With Lua.

Retrieved from "https://2017.brucon.org/index.php/Programming_Wireshark_With_Lua"

navigation

SEARCH

TOOLBOX

LANGUAGES

View source for Programming Wireshark With Lua

From BruCON 2017