Difference between revisions of "Programming Wireshark With Lua"
From BruCON 2017
(Created page with "In this 2 hour workshop, you will learn how to program Wireshark with the Lua programming language. Wireshark can be extended using the C and Lua programming languages. In...") |
(No difference)
|
Revision as of 23:18, 1 July 2017
In this 2 hour workshop, you will learn how to program Wireshark with the Lua programming language.
Wireshark can be extended using the C and Lua programming languages. In this workshop, we will look into Lua taps and dissectors to help you analyze traffic that "pure" Wireshark does not understand. Wireshark dissectors are often designed to analyze a network protocol.
You will learn how to install Lua dissectors and program your own. Say you are reversing a botnet, then you can develop your own dissector that analyses the custom network protocol that the botnet uses to communicate between the C&C and the clients. But custom dissectors can help you even with known network protocols. For example, Didier will teach you the inner workings of a simple custom dissector he developed in Lua to display TCP flags like Snort.