Programming Wireshark With Lua

Programming Wireshark With Lua

From BruCON 2017

Revision as of 21:11, 5 July 2017 by Tom.Gilis (talk | contribs) (Protected "Programming Wireshark With Lua" ([Edit=Allow only administrators] (indefinite) [Move=Allow only administrators] (indefinite)))

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

In this 2 hour workshop, you will learn how to program Wireshark with the Lua programming language.

Wireshark can be extended using the C and Lua programming languages. In this workshop, we will look into Lua taps and dissectors to help you analyze traffic that "pure" Wireshark does not understand. Wireshark dissectors are often designed to analyze a network protocol.

You will learn how to install Lua dissectors and program your own. Say you are reversing a botnet, then you can develop your own dissector that analyses the custom network protocol that the botnet uses to communicate between the C&C and the clients. But custom dissectors can help you even with known network protocols. For example, Didier will teach you the inner workings of a simple custom dissector he developed in Lua to display TCP flags like Snort.