SEARCH
TOOLBOX
LANGUAGES
Difference between revisions of "Programming Wireshark With Lua"

Difference between revisions of "Programming Wireshark With Lua"

From BruCON 2017

Jump to: navigation, search
(Created page with "In this 2 hour workshop, you will learn how to program Wireshark with the Lua programming language. Wireshark can be extended using the C and Lua programming languages. In...")
 
m (Protected "Programming Wireshark With Lua" ([Edit=Allow only administrators] (indefinite) [Move=Allow only administrators] (indefinite)))
 
(No difference)

Latest revision as of 20:11, 5 July 2017

In this 2 hour workshop, you will learn how to program Wireshark with the Lua programming language.

Wireshark can be extended using the C and Lua programming languages. In this workshop, we will look into Lua taps and dissectors to help you analyze traffic that "pure" Wireshark does not understand. Wireshark dissectors are often designed to analyze a network protocol.

You will learn how to install Lua dissectors and program your own. Say you are reversing a botnet, then you can develop your own dissector that analyses the custom network protocol that the botnet uses to communicate between the C&C and the clients. But custom dissectors can help you even with known network protocols. For example, Didier will teach you the inner workings of a simple custom dissector he developed in Lua to display TCP flags like Snort.