search

Tessares / convert-wireshark-dissector

A Wireshark disector for the draft-ietf-tcpm-converters
BSD 3-Clause "New" or "Revised" License
6 stars 5 forks source link

Wireshark loading error #5

Open Jerry0666 opened 1 week ago

Jerry0666 commented 1 week ago

Hello, I use the command wireshark -X lua_script:convert.lua to load the lua file, but it show 螢幕擷取畫面 2024-07-05 223447

Do you know how to solve it?

matttbe commented 1 week ago

Hello,

It looks like the convert.lua script is being opened twice. Is it because a copy of this script is also in your Wireshark's plugin dir?

Out of curiosity, and if you are allowed to say more about that, in which context are you using the Convert protocol? So far, I only heard about its usage to solve specific cases. Maybe here the usage is different?

Jerry0666 commented 1 week ago

Thank for your response. I need to execute some MPTCP proxy, it use rfc8803 0-RTT TCP Convert Protocol to transform remote address information. I delete the repeated lua script, and reload, the error no longer occur. But it seems that wireshark still doesn't parse my packet correctly. image This is the first SYN to the proxy. I think the data field should be parsed to 0-RTT convert data field. I already wirte a init.lua in the /usr/share/wireshark folder. image

matttbe commented 1 week ago

I need to execute some MPTCP proxy, it use rfc8803 0-RTT TCP Convert Protocol to transform remote address information.

Nice, good usage!

I delete the repeated lua script, and reload, the error no longer occur.

Good!

But it seems that wireshark still doesn't parse my packet correctly.

By default, the script only looks at packets using the port 5124: https://github.com/Tessares/convert-wireshark-dissector/blob/4492d4b9e88431418451b2675506b5655cbb19e0/convert.lua#L3

On your side, I see you are using a different port number (1234). You can force Wireshark to decode the connection as "Convert protocol": https://www.wireshark.org/docs/wsug_html_chunked/ChCustProtocolDissectionSection.html