Initial Wireshark nDPI integration

2 files changed, 67 insertions, 0 deletions

diff --git a/wireshark/README.md b/wireshark/README.md
new file mode 100644
index 000000000..1811c663e
--- /dev/null
+++ b/wireshark/README.md
@@ -0,0 +1,20 @@
+# nDPI Wireshark Plugin
+
+## Introduction
+
+nDPI can provide Wireshark protocol dissection to complement internal protocol decoding. In order to do this, the ndpiReader application is used to provide Wireshark nDPI protocol dissection, and a Wireshark plugin interprets nDPI information.
+
+## Installation
+
+- Copy the ndpiReader application (it is located under nDPI/example) to the Extcap path. See Wireshark -> About menu for identifying the extcap directory. Under OSX it is usually /Applications/Wireshark.app/Contents/MacOS/extcap
+- Copy the ndpi.lua plugin under ~/.wireshark/plugins (or in the global Wireshark plugins directory)
+
+## Usage
+
+At Wireshark startup you will find a new extcap interface named "nDPI interface". Select that interface and specify an interface name (for live capture) or a pcap file path (for reading packets from a pcap file). You can choose a nDPI protocol list from the dropdown menu in case you want Wireshark to dissect only protocols of the specified nDPI application protocol.
+
+During capture the ndpiReader plugin will pass Wireshark the nDPI protocol information adding an ethernet packet trailer that contains nDPI information. The lua plugin interprets this information and it displays it in the Wireshark GUI.
+
+## nDPI Packet Filtering
+
+As nDPI is natively integrated into Wireshark, you can filter packets using the usual filtering mechanism. Example use "ndpi.protocol.name==BitTorrent" to filter all BitTorrent traffic.
diff --git a/wireshark/ndpi.lua b/wireshark/ndpi.lua
new file mode 100644
index 000000000..2065d2335
--- /dev/null
+++ b/wireshark/ndpi.lua
@@ -0,0 +1,47 @@
+--
+-- (C) 2017 - ntop.org
+--
+-- This plugin is part of nDPI (https://github.com/ntop/nDPI)
+--
+--
+local ndpi_proto = Proto("ndpi", "nDPI", "nDPI Protocol Interpreter")
+
+ndpi_proto.fields = {}
+local fds = ndpi_proto.fields
+
+fds.network_protocol     = ProtoField.new("nDPI Network Protocol", "ndpi.protocol.network", ftypes.UINT8, nil, base.DEC)
+fds.application_protocol = ProtoField.new("nDPI Application Protocol", "ndpi.protocol.application", ftypes.UINT8, nil, base.DEC)
+fds.name = ProtoField.new("nDPI Protocol Name", "ndpi.protocol.name", ftypes.STRING)
+
+local f_eth_trailer = Field.new("eth.trailer")
+
+-- ###############################################
+
+-- the dissector function callback
+function ndpi_proto.dissector(tvb, pinfo, tree)
+   local pktlen = tvb:len()
+   local eth_trailer = f_eth_trailer()
+   local magic = tostring(tvb(pktlen-28,4))
+
+   if(magic == "19680924") then
+      local ndpi_subtree = tree:add(ndpi_proto, tvb(), "nDPI Protocol")
+      local network_protocol     = tvb(pktlen-24,2)
+      local application_protocol = tvb(pktlen-22,2)
+      local name = tvb(pktlen-20,16)
+      local name_str = name:string(ENC_UTF_8)
+      
+      ndpi_subtree:add(fds.network_protocol, network_protocol)
+      ndpi_subtree:add(fds.application_protocol, application_protocol)
+      ndpi_subtree:add(fds.name, name)
+
+      local pname = ""..application_protocol
+      if(pname ~= "0000") then
+	 -- Set protocol name in the wireshark protocol column (if not Unknown)
+	 pinfo.cols.protocol = name_str
+      end
+   end
+end
+
+register_postdissector(ndpi_proto)
+
+-- ###############################################