Generating Wireshark/Ethereal plugins for Google Protocol Buffers
Dilip Antony Joseph (dilip.antony.joseph at gmail.com) Dear Chap ( dear.chap at gmail.com) http://code.google.com/p/protobuf-wireshark/
Version 0.4 (March 31, 2010)
We can generate two types of Wireshark dissector plugins:
A. Specific - Displays the Message as [field name:value] pairs. This option requires the .proto file for the specific protocol.
B. Generic - Displays a Message as [numeric field id:value] pairs. This option does not require the .proto file. Requires protobuf-2.0.1 or higher.
WSRC_DIR : Directory containing the wireshark source code (wireshark-1.0.2 by default) WINSTALL_DIR : Directory into which wireshark is installed. CURR_DIR : This directory - containing this README file and make_wireshark_plugin.py AddressBook : The name of the top-level message we care about. Based on the example in the protobuf package.
(This step is common for both the generic and specific dissectors).
a. Download and unzip wireshark. (Tested with wireshark-1.0.2) b. $ cd WSRC_DIR c. $ ./autogen.sh c. $ ./configure --prefix=WINSTALL_DIR --with-plugins d. $ make install (This will take a while) e. WINSTALL_DIR/bin contains the wireshark you just compiled. Start it up and make sure it works fine.
A. Specific Message Dissector ##############################
Run protoc on the addressbook.proto file to generate addressbook.pb.cc and addressbook.pb.h (Or just run "make cpp" in the examples subdirectory). Refer protoc documentation. We assume that libprotobuf is installed in a well-known location.
Example: addressbook.conf
name : AddressBook package : tutorial proto_file : /home/danjo/work/protobuf-2.0.0beta/examples/addressbook.proto wireshark_src_dir : /home/danjo/work/pb_ethereal/wireshark-1.0.2 wireshark_install_dir : /home/danjo/work/pb_ethereal/wireshark-bin wireshark_version : 1.0.2 port_num : 33445
a. name : The name of the top-level message we are interested in, i.e., AddressBook in this example. b. package : The package definition in the .proto file[optional] c. proto_file : Absolute path to all .proto files d. wireshark_src_dir : Absolute path to the wireshark source files directory, i.e., WSRC_DIR e. wireshark_install_dir : Absolute path to the directory in wireshark is installed, i.e., WINSTALL_DIR[optional] f. wireshark_version : 1.0.2 or whatever other version you are using g. port_num : Space separated list of port numbers. Wireshark will automatically try to decode UDP packets with given port numbers as AddressBook messages. If none are provided, port num is set to default value of 60000.
a. $ cd CURR_DIR b. $ ./make_wireshark_plugin.py addressbook.conf c. Watch out for any errors.
a. Start wireshark and check if AddressBook shows in "Analyze >> Enabled Protocls" menu. b. Send some UDP packets with AddressBook in the payload. c. Check if they are correctly decoded. d. If not, try forcefully decoding as "AddressBook" using the "Decode As" popup menu item. e. If it still does not work, please email the author.
B. Generic Message Dissector ############################
Refer Step 3 of Specific Dissector instructions.
WSRC_DIR/configure.in : Add "plugins/GoogleProtoBuf/Makefile" line to AC_OUTPUT WSRC_DIR/plugins/Makefile.am : Add "GoogleProtoBuf" line to SUBDIRS
a. $ cd CURR_DIR/generic-dissector b. $ ./make_generic.py generic.conf c. Watch out for any errors.
a. Start wireshark and check if GoogleProtoBuf shows in "Analyze >> Enabled Protocls" menu. b. Send some UDP packets with any Protobuf generated message in the payload in the payload. c. Check if they are correctly decoded. d. If not, try forcefully decoding as "GoogleProtoBuf" using the "Decode As" popup menu item. e. If it still does not work, please email the author.