Giter VIP home page Giter VIP logo

protobuf-wireshark's Introduction

Generating Wireshark/Ethereal plugins for Google Protocol Buffers

Dilip Antony Joseph (dilip.antony.joseph at gmail.com)
Dear Chap ( dear.chap at gmail.com)
http://code.google.com/p/protobuf-wireshark/

Version 0.4 (March 31, 2010)


We can generate two types of Wireshark dissector plugins:

A. Specific - Displays the Message as [field name:value] pairs.
   This option requires the .proto file for the specific protocol.

B. Generic - Displays a Message as [numeric field id:value] pairs. 
   This option does not require the .proto file.
   Requires protobuf-2.0.1 or higher.


NOTATION
========

WSRC_DIR      :   Directory containing the wireshark source code 
                  (wireshark-1.0.2 by default)
WINSTALL_DIR  :   Directory into which wireshark is installed.
CURR_DIR      :   This directory - containing this README file and
                  make_wireshark_plugin.py
AddressBook   :   The name of the top-level message we care about. Based on
                  the example in the protobuf package.



STEP 1: Install Wireshark from source
=====================================
(This step is common for both the generic and specific dissectors).

a. Download and unzip wireshark.  (Tested with wireshark-1.0.2)
b. $ cd WSRC_DIR
c. $ ./autogen.sh 
c. $ ./configure --prefix=WINSTALL_DIR --with-plugins
d. $ make install  (This will take a while)
e. WINSTALL_DIR/bin contains the wireshark you just compiled.  Start it up and
make sure it works fine.


A. Specific Message Dissector
##############################

Step 2: Prepare Protocol Buffers
================================
Run protoc on the addressbook.proto file to generate addressbook.pb.cc and
addressbook.pb.h (Or just run "make cpp" in the examples subdirectory). Refer
protoc documentation.  We assume that libprotobuf is installed in a well-known
location.

Step 3: Create plugin configuration file
========================================
Example: addressbook.conf

name                  : AddressBook
package               : tutorial
proto_file            : /home/danjo/work/protobuf-2.0.0beta/examples/addressbook.proto
wireshark_src_dir     : /home/danjo/work/pb_ethereal/wireshark-1.0.2
wireshark_install_dir : /home/danjo/work/pb_ethereal/wireshark-bin
wireshark_version     : 1.0.2
port_num              : 33445

a. name                   :   The name of the top-level message we are 
                              interested in, i.e., AddressBook in this example.
b. package                :   The package definition in  the .proto file[optional]
c. proto_file             :   Absolute path to all .proto files
d. wireshark_src_dir      :   Absolute path to the wireshark source files
                              directory, i.e., WSRC_DIR
e. wireshark_install_dir  :   Absolute path to the directory in wireshark is
                              installed, i.e., WINSTALL_DIR[optional]
f. wireshark_version      :   1.0.2 or whatever other version you are using
g. port_num               :   Space separated list of port numbers. 
                              Wireshark will automatically try to decode UDP
                              packets with given port numbers as AddressBook
                              messages.  If none are provided, port num is 
                              set to default value of 60000.

Step 4: Run make_wireshark_plugin.py
====================================
a. $ cd CURR_DIR
b. $ ./make_wireshark_plugin.py addressbook.conf
c. Watch out for any errors.

Step 5: Done
============
a. Start wireshark and check if AddressBook shows in "Analyze >> Enabled
Protocls" menu.
b. Send some UDP packets with AddressBook in the payload.
c. Check if they are correctly decoded.
d. If not, try forcefully decoding as "AddressBook" using the "Decode As"
popup menu item.
e. If it still does not work, please email the author.



B. Generic Message Dissector
############################

Step 2: Edit CURR_DIR/generic-dissector/generic.conf
=====================================================
Refer Step 3 of Specific Dissector instructions.


Step 3: Edit WSRC_DIR/configure.in and WSRC_DIR/plugins/Makefile.am
===================================================================
WSRC_DIR/configure.in         : Add "plugins/GoogleProtoBuf/Makefile" line 
                                to AC_OUTPUT
WSRC_DIR/plugins/Makefile.am  : Add "GoogleProtoBuf" line to SUBDIRS


Step 4: Run make_generic.py
===========================
a. $ cd CURR_DIR/generic-dissector
b. $ ./make_generic.py generic.conf
c. Watch out for any errors.


Step 5: Done
============
a. Start wireshark and check if GoogleProtoBuf shows in "Analyze >> Enabled
Protocls" menu.
b. Send some UDP packets with any Protobuf generated message in the payload 
in the payload.
c. Check if they are correctly decoded.
d. If not, try forcefully decoding as "GoogleProtoBuf" using the "Decode As"
popup menu item.
e. If it still does not work, please email the author.


protobuf-wireshark's People

Watchers

 avatar

protobuf-wireshark's Issues

Failure to read .proto file which really does exist and works OK in the Java code generator (protoc).

What steps will reproduce the problem?

1. start wireshark (built from source)


What is the expected output? What do you see instead?

I expect to see no errors from the protobuf-wireshark dissector.

Instead I see:

filename to import /home/chris/protobuf/pbtest/src/addressbook.proto
Error in file /home/chris/protobuf/pbtest/src/addressbook.proto at 
line/col:-1/0File not found.
Unable to parse /home/chris/protobuf/pbtest/src/addressbook.proto
Couldnt get descriptor from addressbook.conf

and the dissector does not work.


What version of the product are you using? On what operating system?

protobuf-wireshark-runtime-0.1
libprotoc 2.4.1
wireshark 1.6.4


Please provide any additional information below.


Here is the console...

chris@chris-linux-desktop:~/protobuf/wireshark$ bin/wireshark
filename to import /home/chris/protobuf/pbtest/src/addressbook.proto
Error in file /home/chris/protobuf/pbtest/src/addressbook.proto at 
line/col:-1/0File not found.
Unable to parse /home/chris/protobuf/pbtest/src/addressbook.proto
Couldnt get descriptor from addressbook.conf

// Wireshark GUI appears at this point... exit manually.

chris@chris-linux-desktop:~/protobuf/wireshark$ ls -lA 
/home/chris/protobuf/pbtest/src/addressbook.proto
-rw-r--r-- 1 chris chris 472 2012-01-03 10:56 
/home/chris/protobuf/pbtest/src/addressbook.proto

chris@chris-linux-desktop:~/protobuf/wireshark$ cat 
/home/chris/protobuf/pbtest/src/addressbook.proto
package tutorial;

option java_package = "pbtest";
option java_outer_classname = "AddressBookProtos";

message Person {
  required string name = 1;
  required int32 id = 2;
  optional string email = 3;

  enum PhoneType {
    MOBILE = 0;
    HOME = 1;
    WORK = 2;
  }

  message PhoneNumber {
    required string number = 1;
    optional PhoneType type = 2 [default = HOME];
  }

  repeated PhoneNumber phone = 4;
}

message AddressBook {
  repeated Person person = 1;
}




Original issue reported on code.google.com by [email protected] on 3 Jan 2012 at 12:28

Can not run on Windows

What steps will reproduce the problem?
1. Download win 32 wire shaark
2. Install win 32 wireshark
3. Try to find protobuf plugin dll for wireshark

What is the expected output? What do you see instead?

plugin dll found in downloads

What version of the product are you using? On what operating system?

Wireshark 1.6.5

Please provide any additional information below.


Original issue reported on code.google.com by [email protected] on 15 Mar 2012 at 2:49

Submit to upstream Wireshark project

Protobuf is a popular wire data format. It appears that the majority of the 
issues for this project are related to people trying to compile and use this. 
It would be of large benefit to Protobuf and Wireshark users if this dissector 
plugin were included in the upstream project. Is there any interest in doing 
this and/or has this been discussed before?

I imagine this work would involve:

1) Review license compatibility between this project (Apache License 2.0) and 
the upstream Wireshark (GPL 2) 

http://www.apache.org/licenses/GPL-compatibility.html
https://www.gnu.org/licenses/license-list.html#apache2

From what I can tell this project would need to be re-licensed before the code 
can be contributed to Wireshark.

2) Contribute the code to Wireshark. This may require refactoring and/or misc 
tidying of the project according to upstream conventions.

https://www.wireshark.org/docs/wsdg_html_chunked/ChSrcContribute.html#ChSrcSend


What do you think?

Original issue reported on code.google.com by [email protected] on 25 Nov 2014 at 5:14

Missing file configure.in

What steps will reproduce the problem?
1. Create config file for plugin
2. run make_wireshark_plugin.py

What is the expected output? What do you see instead?
Expected output would be a compiled plugin. Instead we get an error about not 
being able to find configure.in

What version of the product are you using? On what operating system?
Wireshark 1.10.8, protobuf-wireshark 0.5, Ubuntu 14.04

Please provide any additional information below.

Though configure.in does not exist, there is a file called configure.ac

Original issue reported on code.google.com by [email protected] on 18 Jun 2014 at 12:05

Multiple dissectors failing

Wireshark cannot load multiple auto-generated dissectors.

Reason: They all share the same protocol abbreviation.

Will be fixed in the next release.

Original issue reported on code.google.com by [email protected] on 24 Jul 2008 at 8:21

Unable to compile wireshark plugin

Hi

I've tried to compile protobuf-wireshark-runtime-0.1
followed by instructions from README.txt
Wireshark version 1.9.0, rev 47629
Linux: Debian GNU/Linux 6.0.6 (squeeze), kernel: 2.6.32-5-686

libprotobuf6       - 2.3.0-4
libprotobuf-dev    - 2.3.0-4
libprotobuf-lite6  - 2.3.0-4

Wireshark itself well compiles and installs.

Troubles with wireshar-protobuf plugin:

make: *** No targets specified and no makefile found. Stop.
Unable to compile wireshark plugin in /home/igor/Dev/wireshark/plugins/protobuf

the paths in wireshark.conf and addressbook.conf set properly (corresponding to 
files location)

contents of wireshark/plugins/protobuf folder:
-rw-r--r-- 1 root root    536 Feb 11 08:43 Makefile.am
-rw-r--r-- 1 root root    253 Feb 11 08:43 moduleinfo.h
-rw-r--r-- 1 root root   5414 Feb 11 08:43 packet-protobuf.c
-rw-r--r-- 1 root root 577308 Feb 11 08:44 wireshark-glue-protobuf.o

how to enforce it to generate Makefile from Makefile.am ?

Regards,
Igor.

Original issue reported on code.google.com by [email protected] on 11 Feb 2013 at 3:12

Cannot compile protobuf-wireshark in Mac Lion 10.7

I want to use the protobuf-wireshark under Mac OS 10.7 to debug our program. 
However, the protobuf-wireshark cannot build in it.

I downloaded the "protobuf-wireshark-runtime-0.1" and run the 
"./make_wireshark_plugin.py". It complained:
==================================================
/bin/sh ../../libtool  --tag=CC   --mode=link gcc  -DINET6 -no-cpp-precomp 
-D_U_="__attribute__((unused))" -g -O2 -Wall -W -Wextra 
-Wdeclaration-after-statement -Wendif-labels -Wpointer-arith -Wno-pointer-sign 
-Wcast-align -Wformat-security -I/usr/local/include -D_REENTRANT 
-I/opt/local/include/gtk-2.0 -I/opt/local/lib/gtk-2.0/include 
-I/opt/local/include/atk-1.0 -I/opt/local/include/cairo 
-I/opt/local/include/gdk-pixbuf-2.0 -I/opt/local/include/pango-1.0 
-I/opt/local/include/gio-unix-2.0/ -I/opt/local/include 
-I/opt/local/include/glib-2.0 -I/opt/local/lib/glib-2.0/include 
-I/opt/local/include/pixman-1 -I/opt/local/include/freetype2 
-I/opt/local/include/libpng14     -module -avoid-version -shared 
-Wl,-soname,protobuf.so -o protobuf.so -Wl,-search_paths_first  
-L/usr/local/lib -L/usr/local/lib -L/usr/local/lib -L/usr/local/lib 
-L/usr/local/lib -o protobuf.la -rpath 
/Users/wangqi/disk/projects/snsgames/babywar/thirdparty/wireshark/bin/lib/wiresh
ark/plugins/1.6.3 packet-protobuf.lo  wireshark-glue-protobuf.o -lprotobuf

*** Warning: Linking the shared library protobuf.la against the non-libtool
*** objects  wireshark-glue-protobuf.o is not portable!
libtool: link: rm -fr  .libs/protobuf.la .libs/protobuf.lai
libtool: link: gcc -Wl,-undefined -Wl,dynamic_lookup -o .libs/protobuf.so 
-bundle  .libs/packet-protobuf.o  wireshark-glue-protobuf.o   -L/usr/local/lib 
/usr/local/lib/libprotobuf.dylib -lz  -O2 -Wl,-soname -Wl,protobuf.so 
-Wl,-search_paths_first  
ld: unknown option: -soname
collect2: ld returned 1 exit status
make: *** [protobuf.la] Error 1
Unable to compile wireshark plugin in 
/Users/wangqi/disk/projects/snsgames/babywar/thirdparty/wireshark/src/plugins/pr
otobuf

======================================================

Then I modified the Makefile.am.template, change the line:
|PLUGIN_NAME|_la_LDFLAGS = -module -avoid-version -shared 
-Wl,-soname,|PLUGIN_NAME|.so -o |PLUGIN_NAME|.so
to 
|PLUGIN_NAME|_la_LDFLAGS = -module -avoid-version -shared -o |PLUGIN_NAME|.so

This time it can compile but throw a warning:

======================================================
/bin/sh ../../libtool  --tag=CC   --mode=link gcc  -DINET6 -no-cpp-precomp 
-D_U_="__attribute__((unused))" -g -O2 -Wall -W -Wextra 
-Wdeclaration-after-statement -Wendif-labels -Wpointer-arith -Wno-pointer-sign 
-Wcast-align -Wformat-security -I/usr/local/include -D_REENTRANT 
-I/opt/local/include/gtk-2.0 -I/opt/local/lib/gtk-2.0/include 
-I/opt/local/include/atk-1.0 -I/opt/local/include/cairo 
-I/opt/local/include/gdk-pixbuf-2.0 -I/opt/local/include/pango-1.0 
-I/opt/local/include/gio-unix-2.0/ -I/opt/local/include 
-I/opt/local/include/glib-2.0 -I/opt/local/lib/glib-2.0/include 
-I/opt/local/include/pixman-1 -I/opt/local/include/freetype2 
-I/opt/local/include/libpng14     -module -avoid-version -shared -o protobuf.so 
-Wl,-search_paths_first  -L/usr/local/lib -L/usr/local/lib -L/usr/local/lib 
-L/usr/local/lib -L/usr/local/lib -o protobuf.la -rpath 
/Users/wangqi/disk/projects/snsgames/babywar/thirdparty/wireshark/bin/lib/wiresh
ark/plugins/1.6.3 packet-protobuf.lo  wireshark-glue-protobuf.o -lprotobuf

*** Warning: Linking the shared library protobuf.la against the non-libtool
*** objects  wireshark-glue-protobuf.o is not portable!
libtool: link: gcc -Wl,-undefined -Wl,dynamic_lookup -o .libs/protobuf.so 
-bundle  .libs/packet-protobuf.o  wireshark-glue-protobuf.o   -L/usr/local/lib 
/usr/local/lib/libprotobuf.dylib -lz  -O2 -Wl,-search_paths_first  
libtool: link: ( cd ".libs" && rm -f "protobuf.la" && ln -s "../protobuf.la" 
"protobuf.la" )
======================================================

However, the wireshark 1.6.3 cannot start now.

======================================================
$ ./wireshark 
wireshark(32924,0x7fff7b9de960) malloc: *** error for object 
0xffffffffaaa2f5f0: pointer being freed was not allocated
*** set a breakpoint in malloc_error_break to debug
Abort trap: 6
======================================================


How can I run this problem in Mac. It's really important for me to develop. 
Thanks a lot!

Original issue reported on code.google.com by [email protected] on 18 Nov 2011 at 6:54

Error compiling .cc file.

I am getting an error where . / c++ is not recognized  as a internal or 
external command.

Here is the output:

make_wireshark_plugin.py iudp.conf
Generating Wireshark plugin for  iUDP
Generating  C:\CR1\source\Wireshark/plugins/iUDP/packet-iUDP.c
Generating  C:\CR1\source\Wireshark/plugins/iUDP/Makefile.am
Generating  C:\CR1\source\Wireshark/plugins/iUDP/moduleinfo.h
Generating  C:\CR1\source/wireshark-glue-iUDP.cc
Generating  C:\CR1\source/wireshark-glue-iUDP.h
plugins/iUDP/Makefile already present in configure.in
iUDP already present in plugins/Makefile.am
'.' is not recognized as an internal or external command,
operable program or batch file.
'.' is not recognized as an internal or external command,
operable program or batch file.
'c++' is not recognized as an internal or external command,
operable program or batch file.
Unable to compile wireshark-glue-iUDP.cc

c:\CR1\source\WIRESHARK TOOLS\protobuf-wireshark\iudp>


What version of the product are you using? On what operating system?
I have build the wireshark sources (1.9.1)
I have configured the .conf file point to the correct locations.
I am running on Windows 7, have Visual Studio 2010.

First issue
*make_wireshark_plugin.py issue
*I had an error where it could not open 'configure.in' and I saw the issue  
*opened where this was fixed by changing it to configure.ac

Original issue reported on code.google.com by [email protected] on 21 Mar 2013 at 11:09

New feature Request : Wireshark integration

Hello there,

that's a pretty useful wireshark plugin. Nice ! 

But I was wondering, if it is technically possible to integrate it differently 
in wireshark :
 1- Install the (new) plugin only once in the wireshark directory.
 2- In the decode as menu, at transport level, you select PROTOCOL_BUFFERS 
    for instance.
 3- The user is prompted for the .proto file to use (and additional info)
 4- The decoding is then applied automatically.

I am not a wireshark developer, but a wireshark user ;). And I believe it 
would be nicer to have it this way.

This said, I hope you take it as it is, a constructive remark. 
Because it's true that it's open source and I may code it myself!
But fore sure, it would take me more time to get familiar with the 
wireshark development...

Cheers,
Roudy 



Original issue reported on code.google.com by [email protected] on 14 Jun 2010 at 2:59

Issue with repeated fields

What steps will reproduce the problem?
1. Generate messages with repeated fields of primitive type

What is the expected output? What do you see instead?
Dissector should display these fields too. Instead the Dissector crashed

Please use labels and text to provide additional information.


Original issue reported on code.google.com by [email protected] on 8 Apr 2010 at 8:05

fails to build on debian testing and wireshark-1.10.5

What steps will reproduce the problem?
1. patch http://code.google.com/p/protobuf-wireshark/issues/detail?id=9
2. compile against wireshark-1.10.5

  CC       packet-protobuf.lo
packet-protobuf.c: In function 'proto_register_protobuf':
packet-protobuf.c:70:9: error: too many arguments to function 
'get_persconffile_path'
         dirname = get_persconffile_path("protobuf", FALSE, FALSE);
         ^
In file included from packet-protobuf.c:9:0:
../../epan/filesystem.h:197:21: note: declared here
 WS_DLL_PUBLIC char *get_persconffile_path(const char *filename, gboolean from_profile);
                     ^
packet-protobuf.c:60:12: warning: variable 'protobuf_module' set but not used 
[-Wunused-but-set-variable]
  module_t *protobuf_module;
            ^
packet-protobuf.c: In function 'wireshark_pb_process_protobuf_register_subtree':
packet-protobuf.c:152:31: warning: request for implicit conversion from 'void 
*' to 'struct hf_register_info *' not permitted in C++ [-Wc++-compat]
   hf_register_info *hf_info = malloc(sizeof( hf_register_info ) );
                               ^
packet-protobuf.c: In function 'wireshark_pb_process_protobuf_register_field':
packet-protobuf.c:173:27: warning: enum conversion in initialization is invalid 
in C++ [-Wc++-compat]
                           type,
                           ^
packet-protobuf.c:173:27: warning: (near initialization for 
'message_info.hfinfo.type') [-Wc++-compat]
packet-protobuf.c:181:31: warning: request for implicit conversion from 'void 
*' to 'struct hf_register_info *' not permitted in C++ [-Wc++-compat]
   hf_register_info *hf_info = malloc(sizeof( hf_register_info ) );
                               ^
make: *** [packet-protobuf.lo] Error 1
Unable to compile wireshark plugin in /tmp/wireshark-1.10.5//plugins/protobuf
f

Original issue reported on code.google.com by [email protected] on 3 Mar 2014 at 1:37

Cannot compile on Ubuntu 9.04

Ubuntu 9.04
Wireshark 1.2.2
Protobuff 2.0.3-2.2
protobuf-wireshark 0.2

I followed B. Generic Message Dissector

Cannot compile. Here is error:
*** Warning: Linking the shared library GoogleProtoBuf.la against the
non-libtool
*** objects  wireshark-glue-GoogleProtoBuf.o is not portable!
libtool: link: gcc -shared  .libs/packet-GoogleProtoBuf.o 
wireshark-glue-GoogleProtoBuf.o   -L/usr/local/lib /usr/lib/libprotobuf.so
 -pthread -Wl,-soname -Wl,GoogleProtoBuf.so   -pthread -Wl,-soname
-Wl,GoogleProtoBuf.so -o .libs/GoogleProtoBuf.so
libtool: link: ( cd ".libs" && rm -f "GoogleProtoBuf.la" && ln -s
"../GoogleProtoBuf.la" "GoogleProtoBuf.la" )
Unable to compile wireshark plugin in
/home/iron/temp/wireshark-1.2.2/plugins/GoogleProtoBuf



Original issue reported on code.google.com by [email protected] on 5 Oct 2009 at 12:05

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.