I'm new to Wireshark and I wonder if it's possible to perform the following task.
asked 11 Oct '17, 15:19
Wireshark can import hex dumps of protocol frames using
When deciding which dissector to use to analyse the next piece of frame data, Wireshark uses "dissector tables". These are mapping tables which translate some integer or text values found in lower protocol layers to links to dissectors. In some cases more complex methods are use but that is not relevant here. The root level of such mapping is the encapsulation type (Ethernet, 802.11 etc.) which cannot be found in the frame data itself but in its metadata stored in the capture file. In your case, I'd assume the best way to be to choose one of the USER1-USER15 encapsulations when importing the hex dump, and to register your Lua dissector for that encapsulation type using
answered 12 Oct '17, 07:04