ashdnazg / pyreshark Goto Github PK

In doc "Writing Dissectors" https://github.com/ashdnazg/pyreshark/wiki/Writing-Dissectors
said:
"You can pass information between different functions by storing it in the Protocol object (accessible through self), just make sure you reset your value when dissecting a new packet, as the same Protocol object is used for dissecting all packets."

But this only works when pass information between function like this: def function(self, packet):
Can't access self.infomation between function whitout paramater like : def function(self):

class Protocol(ProtocolBase):
def init(self):
self._name = "x Protocol"
self._filter_name = "x"
self._short_name = "x"
self._register_under = {"tcp.port": 8000}
self._items = []
self.set_items()

def set_items(self):
    self._items.extend(self.message_header())
    self._items.extend(self.message_body())

def message_header(self):
    return [
        FieldItem("identifier", FT_STRING, "identifier", length=4),
        PyFunctionItem(self.dissect_type, {
            "key_message_type": FieldItem("message_type", FT_UINT16, "message_type", strings=MESSAGE_TYPE, display=BASE_HEX)
        }),            
        FieldItem("length", FT_UINT16, "length")         
    ]

def dissect_type(self, packet):
    packet.read_item("key_message_type")
    (self._message_type,) = struct.unpack("<h", packet.buffer[6:8])

def message_body(self):
   logger.info("I can't see infomatio:" + self._message_type)
    return [
        PyFunctionItem(self.dissect_body, {
        FieldItem("checksum", FT_UINT16, "checksum"),
        })
    ]  

def dissect_body(self, packet):
    logger.info("I can see infomatio:" + self._message_type)

I might be overlooking something extremely simple... but I'm having some trouble setting the next dissector when passing a variable representing a string to the set_next_dissector() function, rather than a string itself. For instance:

self.set_next_dissector('protocol') works, while

self.set_next_dissector(protocol_name) does not, even if protocol_name == 'protocol' .

Any ideas on how to accomplish this with pyreshark? https://www.wireshark.org/docs/wsdg_html_chunked/ChDissectReassemble.html#TcpDissectPdus
Not sure if I'm missing something obvious or not.

I'm having trouble setting the text for a few columns (notably anything to do with source ip's or ports or destinations). I'm able to set other columns, strangely, like "Protocol" and "Info"

plugin.c:44:24: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘attribute’ before ‘const’
WS_DLL_PUBLIC_NOEXTERN const gchar version[] = VERSION;
^
plugin.c:48:24: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘attribute’ before ‘void’
WS_DLL_PUBLIC_NOEXTERN void
^
plugin.c:54:24: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘attribute’ before ‘void’
WS_DLL_PUBLIC_NOEXTERN void
^
$ gcc -v
Using built-in specs.
COLLECT_GCC=/usr/local/bin/gcc
COLLECT_LTO_WRAPPER=/usr/libexec/gcc/x86_64-unknown-linux-gnu/4.8.2/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with: ./configure --disable-gnu-unique-object --disable-multilib --enable-version-specific-runtime-libs --enable-languages=c,c++ --prefix=/usr --program-suffix=48
Thread model: posix
gcc version 4.8.2 (GCC)

The README currently states:

Python 2.7.* or 2.6.* is required, so make sure it is installed.

Any plans to support Python 3?

Some easy first steps would be to

• from __future__ import absolute_import, division, print_function, unicode_literals
• The future package: http://python-future.org/
• Or the six package: https://pythonhosted.org/six/

Hi,

I followed all steps provided in https://code.google.com/p/pyreshark/wiki/BuildingPyreshark . But when I tried to build it calling the make of "wireshark", I'm getting the following error.

Making all in pyreshark
make[3]: Entering directory /home/paavu/wireshark/plugins/pyreshark' CC plugin.lo CC pyreshark.lo CC python_loader.lo CCLD pyreshark.la /usr/bin/python generate_ws_consts.py python/cal/ws_consts.py cp templates/ws_types.py.1_99 python/cal/ws_types.py cp: cannot stat ‘templates/ws_types.py.1_99’: No such file or directory make[3]: *** [ws_types] Error 1 make[3]: Leaving directory/home/paavu/wireshark/plugins/pyreshark'
make[2]: *** [all-recursive] Error 1
make[2]: Leaving directory /home/paavu/wireshark/plugins' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory/home/paavu/wireshark'
make: *** [all] Error 2

In templates directory, I don't find ws_types.py.1_99. Is this file created dynamically? Or can we rename one of the files under templates directory?

System details:
Ubuntu 14.04
Pyreshark version - 0.1.4 (as per Changelog file)
wireshark version "v1.99.6rc0-48-g8204578"

A GPL2-compatible license is required as this is a Wireshark-derivative work.

Has anyone compared the performance of pyreshark to Lua when doing something more complicated than just field items?
I know the PyFunctionItem callbacks will be slower, particularly when unpacking packets, but does anyone know if they're faster/slower than doing something similar in Lua? I'm aware that performance can vary, but I'm particularly curious if packet.unpack is going to be a performance bottleneck compared to a similar implementation in Lua.

pyreshark_0.1.4_installer.exe does not copy pyreshark.dll into the plugins directory and does not copy pyreshark_locator.py into the python directory in wireshark.

Pyreshark 0.1.3 / Win32
On a simple code

'''
@summary: A my test protocol...
'''
from cal.cal_types import ProtocolBase, FieldItem, PyFunctionItem, Subtree, TextItem
from cal.ws_consts import FT_UINT32, FT_UINT16, BASE_HEX, FT_UINT8, FT_ETHER, FT_IPv4

class Protocol(ProtocolBase):
    def __init__(self):
        self._name = "MyTest over TCP"
        self._filter_name = "mytest"
        self._short_name = "MYTEST"
        self._items = [FieldItem("header", FT_UINT32, "Mytest header", display = BASE_HEX),
                       Subtree(TextItem("Op", "Operation"), [PyFunctionItem(self.add_addresses, { "t1" : FieldItem("t1",     FT_UINT32, "T1"),
                                                                                                  "t2" : FieldItem("t2",     FT_UINT32, "T2"),
                                                                                                  "t3" : FieldItem("t3",     FT_UINT32, "T3"),
                                                                                                  "t4" : FieldItem("t4",     FT_UINT32, "T4"),
                                                                                                  "t5" : FieldItem("t5",     FT_UINT32, "T5"),
                                                                                                  "t6" : FieldItem("t6",     FT_UINT32, "T6"),
                                                                                                })]),
                       ]
        self._register_under = { "tcp.port": 16001}

    def add_addresses(self, packet):
        ptype = packet.unpack(">L",4)[0]
        packet.read_item("t1")
        packet.offset += 16
        packet.read_item("t2")
        packet.read_item("t3")

I've got errors on long files:
Traceback (most recent call last):
File "_ctypes/callbacks.c", line 314, in 'calling callback function'
File "C:\Program Files\Wireshark\python\cal\cal_types.py", line 499, in _callback
p = Packet(p_tvb_and_tree.contents.tvb, p_tvb_and_tree.contents.tree, p_pinfo, p_offset, self._cal, self._items_dict)
RuntimeError: maximum recursion depth exceeded while calling a Python object
Traceback (most recent call last):
File "_ctypes/callbacks.c", line 314, in 'calling callback function'
......

Wow, this project is awesome!
I have some start-difficulties:
I want to implement a protocol like HTTP, which is directly under TCP.
What do I have to enter as value for self._register_under = {"tcp": ???}?

Thanks :-)

To dissector data in tcp packet.

Thanks.

Hi,

Firstly, apologies for asking trivial questions!

I'm trying to build wireshark after building from pyreshark. When I run the command WIRESHARK_RUN_FROM_BUILD_DIRECTORY=1 ./wireshark

I get the following error.

Can't open Pyreshark init file: /home/paavu/wireshark-1.12.4/python/pyreshark.py IOError: [Errno 2] No such file or directory: '/home/paavu/wireshark-1.12.4/python/pyreshark.py'

The actual path of pyreshark.py is wireshark-1.12.4/plugins/pyreshark/python/pyreshark.py

Any help is appreciated.

Regards,
Praveen