mirror of https://github.com/NewLifeX/X

2 changed files with 87 additions and 0 deletions
@ -0,0 +1,71 @@ |
|||
do |
|||
local p_newlife = Proto("newlife", "新生命标准网络封包") |
|||
|
|||
-- https://www.wireshark.org/docs/wsdg_html_chunked/lua_module_Proto.html#lua_class_ProtoField |
|||
local FF_flag = { |
|||
[8] = "[Reply]", |
|||
[7] = "[Error/Oneway]", |
|||
[3] = "[Encrypted]", |
|||
[2] = "[Compressed]", |
|||
[1] = "[Binary]" |
|||
} |
|||
|
|||
local f_flag = ProtoField.uint8("NewLife.flag", "标记", base.HEX, FF_flag, 0xFF) |
|||
-- local f_flag = ProtoField.uint8("NewLife.flag", "标记", base.HEX) |
|||
local f_seq = ProtoField.uint8("NewLife.seq", "序列号", base.DEC) |
|||
local f_length = ProtoField.uint16("NewLife.length", "长度", base.DEC) |
|||
-- local f_data = ProtoField.string("NewLife.data", "内容", base.UNICODE) |
|||
local f_data = ProtoField.bytes("NewLife.data", "数据", base.SPACE) |
|||
|
|||
p_newlife.fields = {f_flag, f_seq, f_length, f_data} |
|||
|
|||
local data_dis = Dissector.get("data") |
|||
|
|||
local function NewLife_dissector(buf, pkt, root) |
|||
local buf_len = buf:len(); |
|||
if buf_len < 4 then |
|||
return false |
|||
end |
|||
|
|||
local tvb = buf:range() |
|||
local v_flag = tvb(0, 1) |
|||
local v_seq = tvb(1, 1) |
|||
local v_length = tvb(2, 2) |
|||
local flag = tvb(0, 1):uint() |
|||
|
|||
local len = tvb(2, 2):le_uint() |
|||
local v_data = tvb(4, len) |
|||
|
|||
pkt.cols.protocol = "NewLife" |
|||
|
|||
local t = root:add(p_newlife, buf) |
|||
t:add(f_flag, v_flag) |
|||
t:add(f_seq, v_seq) |
|||
t:add_le(f_length, v_length) |
|||
|
|||
-- t:add_packet_field(f_data, v_data, ENC_UTF_8 + ENC_STRING) |
|||
t:add(f_data, v_data) |
|||
|
|||
return true |
|||
end |
|||
|
|||
function p_newlife.dissector(buf, pkt, root) |
|||
if NewLife_dissector(buf, pkt, root) then |
|||
-- valid NewLife diagram |
|||
else |
|||
data_dis:call(buf, pkt, root) |
|||
end |
|||
end |
|||
|
|||
local udp_encap_table = DissectorTable.get("udp.port") |
|||
udp_encap_table:add(5500, p_newlife) |
|||
udp_encap_table:add(9999, p_newlife) |
|||
udp_encap_table:add(777, p_newlife) |
|||
udp_encap_table:add(12345, p_newlife) |
|||
|
|||
local tcp_encap_table = DissectorTable.get("tcp.port") |
|||
tcp_encap_table:add(5500, p_newlife) |
|||
tcp_encap_table:add(9999, p_newlife) |
|||
tcp_encap_table:add(777, p_newlife) |
|||
tcp_encap_table:add(12345, p_newlife) |
|||
end |
Write
Preview
Loading…
Cancel
Save
Reference in new issue