* http://www.nwlab.net/tutorials/wireshark/

• https://nmap.org/npcap/

• https://wiki.wireshark.org/TCP_Reassembly

Display only SYN-Packets

  tcp.flags.syn==1 && !tcp.flags.ack==1

Display SYN-ACK-Packets

  tcp.flags.syn==1 && tcp.flags.ack==1

Durch das Hinzufügen zwei weiterer 'Custom'-Spalten lässt sich die Analyse vereinfachen:

  tcp.stream
  tcp.time_delta
  

• File Format
• Dev-Libraries Ubuntu: sudo apt-get install libpcap-dev

sudo chgrp admin /usr/bin/dumpcap 
sudo chmod 750 /usr/bin/dumpcap 
sudo setcap cap_net_raw,cap_net_admin+eip /usr/bin/dumpcap

Danach kann man mit Wireshark auch ohne Root-Rechte sniffen.

Offizielle Doku:

• https://wiki.wireshark.org/Lua/Dissectors#postdissectors
• Chapter 10. Lua Support in Wireshark
• Chapter 11. Wireshark’s Lua API Reference Manual

Forum:

• Calling Lua Dissectors from Lua Dissector
• How to dissect a field in an already dissected package
• Get HTTP payload when writing chained HTTP dissector
• Reassemble PDUs in lua wireshark dissector

Anleitungen:

• https://delog.wordpress.com/2010/09/27/create-a-wireshark-dissector-in-lua/
• https://mika-s.github.io/wireshark/lua/dissector/2017/11/04/creating-a-wireshark-dissector-in-lua-1.html
• https://delog.wordpress.com/2012/06/25/obtain-dissection-data-field-and-fieldinfo/
• https://delog.wordpress.com/2013/05/21/dealing-with-segmented-data-in-a-wireshark-dissector-written-in-lua/
• https://delog.wordpress.com/2011/04/20/custom-dissector-for-ethertype-link-layer-and-ip-protocol/
• https://delog.wordpress.com/2017/04/25/wireshark-dissector-in-lua-for-custom-protocol-over-websockets/
• https://lowentropymusings.wordpress.com/2013/10/02/registering-dissectors-for-unknown-mime-types-in-wireshark/
• https://ask.wireshark.org/questions/58247/ssl-lua-dissector-how

Beispiele:

• https://github.com/Cilab/Wireshark-MQTT
• https://github.com/magicmonkey/lifxjs (im Wireshark Verzeichnis)