使用wireshark做协议分析，自定义协议可以编写Dissector插件进行分析，开始考虑使用c语言编写插件，了解了一下，发觉太麻烦，在效率要求不高的情况下，可以使用lua脚本编写插件：

1. 要使用lua脚本，先使wireshark支持lua脚本，编辑init.lua(在wireshark目录下)，找到"disable_lua = true; do return end;"行，在最前面添加"--"将此行注释掉；
2. 编写lua脚本文件，GZTP.lua 文件 lua

    

   do local p_GZTP = Proto("GZTP","GZTP") local f_identifier = ProtoField.bytes("GZTP.identifier","Identifier") local f_frametype = ProtoField.uint8("GZTP.frametype","FrameType",base.HEX,{ [1] = "up-data", [129] = "resp-up", [2] = "request-data", [130] = "down-data"}) local f_len = ProtoField.uint8("GZTP.length","Data Length",base.DEC) local f_address = ProtoField.uint16("GZTP.address","Address",base.HEX) local f_control = ProtoField.uint16("GZTP.Control","Control",base.HEX) local f_data = ProtoField.bytes("gztp.data","Data") p_GZTP.fields = { f_identifier, f_frametype, f_len,f_address,f_control,f_data} local data_dis = Dissector.get("data") local function GWData_dissector(buf,pkf,root) local buf_len = buf:len(); if buf_len < 6 then return false end if(buf(0,1):uint()~=255) then return false end local t = root:add(buf(0,buf_len),"GWData") local f_sym = ProtoField.uint8("GWData.Sym","Sym",base.HEX) t:add(f_sym,buf(0,1)) return true end local function GZTP_dissector(buf,pkt,root) local buf_len = buf:len(); if buf_len < 8 then return false end local v_identifier = buf(0,2) if ((buf(0,1):uint()~=254) or (buf(1,1):uint()~=254)) then return false end local v_frametype = buf(2,1) local i_operator = v_frametype:uint() local v_len = buf(3,1) local v_address = buf(4,2) local v_control = buf(6,2) --控制字 local t = root:add(p_GZTP,buf(0,buf_len)) pkt.cols.protocol = "GZTP" t:add(f_identifier,v_identifier) t:add(f_frametype,v_frametype) t:add(f_len,v_len) t:add(f_address,v_address) t:add(f_control,v_control) local i_len = v_len:uint() if i_len > 0 then local deal = false local dissector = Dissector.get("gwdata") if dissector ~= nil then local databuf = buf(8,i_len):tvb() if dissector:call(databuf,pkt,root) then deal = true end else t:add(buf(8,i_len),"Data:") end end return true end function p_GZTP.dissector(buf,pkt,root) if GZTP_dissector(buf,pkt,root) then --valid GZTP diagram else data_dis:call(buf,pkt,root) end end local udp_encap_table = DissectorTable.get("udp.port") udp_encap_table:add(10110,p_GZTP) end
   GWData.lua文件
   do function GetTimeOfMinVal(Value) local val = Value local minVal = val % 60 val = val / 60 local hour = val % 24 val = val / 24 local day = val % 32 val = val / 32 local month = val % 12 + 1 local year = val / 12 return string.format("%04d-%02d-%02d %02d:%02d",year,month,day,hour,minVal) end end do runinfo_proto = Proto("runinfo","RUNINFO","RunInfo Protocol") function runinfo_proto.dissector(buffer,pinfo,tree) pinfo.cols.info = "GWData run info" local t = tree:add(runinfo_proto,buffer(),"Run Info Protocol Data") end end --雨量分钟数据 do raindata_proto = Proto("raindata","RAINDATA","Rain Data Protocol") local f_ctype = ProtoField.uint8("RAINDATA.ctype","CType",base.DEC,{ [0] = "sample",[1] = "compress"}) raindata_proto.fields = {f_ctype} function raindata_proto.dissector(buffer,pinfo,tree) local str_minutes = string.format("%d",buffer(2,2):le_uint()) --分钟数 local str_time = GetTimeOfMinVal(buffer(4,4):le_uint()) --时间 pinfo.cols.protocol = "RAIN DATA" pinfo.cols.info = "Time: "..str_time .. " Minutes: " .. str_minutes --local buf_len = buffer:len(); local t = tree:add(raindata_proto,buffer(),"Rain Data Protocol Data") t:add(f_ctype,buffer(0,1)) t:add(buffer(1,1),"Res: " .. string.format("0x%02X",buffer(1,1):uint())) t:add(buffer(2,2),"Minutes: " .. str_minutes) t:add(buffer(4,4),"Time: ".. str_time) t:add(buffer(8),"Data: ") end end do -- declare our protocol gwdata_proto = Proto("gwdata","GWDATA","GWDATA Protocol") local f_datatype = ProtoField.uint8("GWDATA.datatype","DataType",base.HEX,{ [0x02] = "run info",[0x12] = "rain data", [3] = "gprs"}) local f_trantype = ProtoField.uint8("GWDATA.trantype","TranType",base.HEX,{ [1] = "net", [2] = "modem", [3] = "gprs"}) gwdata_proto.fields = {f_datatype,f_trantype} local protos ={ [0x02] = Dissector.get("runinfo"), [0x12] = Dissector.get("raindata"), } -- create a function to dissect it function gwdata_proto.dissector(buffer,pinfo,tree) pinfo.cols.protocol = "GWDATA" if (buffer(0,1):uint()~=255) then return false end local subtree = tree:add(gwdata_proto,buffer(),"GWData Protocol Data") subtree:add(buffer(0,1),"Sym: " .. string.format("0x%02X",buffer(0,1):uint())) subtree:add(buffer(1,1),"Length: " .. buffer(1,1):uint()) subtree:add(f_datatype,buffer(2,1)) subtree:add(f_trantype,buffer(3,1)) subtree:add(buffer(4,2),"Addr: " .. buffer(4,2):le_uint()) local data_len = buffer(1,1):uint() local proto_id = buffer(2,1):uint() local dissector = protos[proto_id] if dissector ~= nil then dissector:call(buffer(6,data_len):tvb(),pinfo,tree) end return true end end
3. 在init.lua文件最后添加：
   dofile("GWData.lua") dofile("GZTP.lua")
4. 将抓包文件*.pcap重新打开就可以了