ring0 » blog

Writing Wireshark Plugins in C

After some time writing the phonet dissector for wireshark in lua I noticed the disadvantages:

• wireshark’s lua interface is incomplete
• it can’t be properly installed
• C is much faster
• I can’t reuse any code

So I tried the C interface. I found the basic structure for plugins pretty fast in their documentation and thought about some design changes in the plugin:

• usage of tree’s (e.g. all data is below “Message”)
• usage of dissectors for the individual resources
• one file per resource
• usage of expert-info, for broken packet length