Wireshark has long been a standard tool for engineers across many disciplines. With its rich feature set, protocol support, and outstanding GUI, 90% of what you need works out of the box. However, reverse engineers often spend their time neck-deep in that missing 10%.
Sometimes I find myself leaving the shiny color-coded UI of Wireshark for its command line-based little cousin, tshark. tshark has some quirks compared to Wireshark, which left me dead in the water when I couldn’t use my custom Lua dissectors. The solution is simple, but it was difficult to find through Google searching. I’ve written this blog post to save others some time and frustration.
What is tshark? tshark, or terminal Wireshark, is Wireshark without the GUI. When comparing tshark vs Wireshark, the back-end libraries are exactly the same, but tshark is implemented differently because the GUI is heavily integrated into Wireshark.
I find myself running tshark commands in three scenarios:
1. Heuristics
I want a count of all of the “type” fields across my packet of interest. I am sure there is a way to do this in Wireshark, but I can’t imagine it’s easier than:
tshark -r sample.pcap -Y "protocol" -T fields -e protocol.hdr.type |sort |uniq -c2. Rapid Iteration and Prototyping
When reversing protocols, changes happen very quickly as new information is discovered. tshark runs are stateless, and the output can be passed directly into tools such as sed, awk, and grep. This workflow makes it easier to create files, analyze data, and start to build operational tools. I’ve also found that Wireshark likes to process a full file, which can take a long time, while tshark executes one frame.number at a time. Maybe I’m a little antiquated, but I feel like I have more control of files on the command line.
3. Python Integration
I regularly integrate my protocol dissectors and tshark filters into Python tools. I do this for many reasons, including running in a Docker container, using matplotlib or SciPy for visualization, using object-oriented programming, and integrating with other tools that don’t play nicely with Wireshark.
Lua and tshark
If you’ve ever tried to run a self-compiled version of tshark, you may have noticed your Lua dissectors no longer work. This is because tshark doesn’t compile Lua by default, and there’s a lot of incorrect and out-of-date information available on the internet. For the full solution, scroll to the bottom of the post.
My first challenge is that I’m using Ubuntu 18.04 due to technical requirements. Ubuntu 18.04 has exceeded its five-year support lifetime and is no longer supported by many tools, which makes self-compiled code a constant challenge. In this particular case, I found that version 2.6.10 is a good, stable version, so I went with it.
After going through the normal cmake build, I ran tshark and got this error:
> git clone https://gitlab.com/wireshark/wireshark.git /opt/wireshark
> cd /opt/wireshark
> git checkout v2.6.10
> mkdir build && cd build && cmake ..
> make tshark && sudo make install tshark
> tshark -r sample.pcap -Y "protocol" -T fields -e protocol.hdr.type
tshark: Some fields aren't valid:
protocol.hdr.typeFurther investigation showed that my tshark build was missing directories for Lua code:
> run/tshark -G folders
Temp: /tmp
Personal configuration: /home/user/.config/wireshark
Global configuration: /home/user/.local/opt/wireshark/build/run
System: /etc
Program: /home/user/.local/opt/wireshark/build/run
Personal Plugins: /home/user/.local/lib/wireshark/plugins/2.6
Global Plugins: /opt/wireshark/build/run/plugins/2.6
Extcap path: /opt/wireshark/build/run/extcapAll was clear after looking at the version information:
tshark --ver
TShark (Wireshark) 2.6.10 (v2.6.10-0-g7ba4efc4)
Copyright 1998-2019 Gerald Combs <gerald@wireshark.org> and contributors.
License GPLv2+: GNU GPL version 2 or later <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with libpcap, without POSIX capabilities, without libnl, with GLib 2.56.4, with zlib 1.2.11, without SMI, without c-ares, without Lua, without GnuTLS, with Gcrypt 1.8.1, without Kerberos, without MaxMind DB resolver,without nghttp2, without LZ4, without Snappy, without libxml2.
Running on Linux 4.15.0-1121-fips, with Intel Xeon Processor (Cascadelake) (with SSE4.2), with 16037 MB of physical memory, with locale C.UTF-8, with libpcap version 1.8.1, with Gcrypt 1.8.1, with zlib 1.2.11, binary plugins supported (13 loaded).
Built using gcc 7.5.0.Wonderful! So, tshark hasn’t compiled Lua with this build. Looks like I just need to turn on Lua and recompile.
> apt install liblua5.3-dev
> cmake -DENABLE_LUA=ON ..
> make tshark && sudo make install tshark
> tshark -r sample.pcap -Y "protocol" -T fields -e protocol.hdr.type
tshark: Some fields aren't valid:
protocol.hdr.typeSame problem. Let’s see if the cmake command offers any clues.
> cmake -DENABLE_LUA=ON .. |grep -i lua
...
...
-- Checking for one of the modules 'lua5.2;lua-5.2;lua52;lua5.1;lua-5.1;lua51;lua5.0;lua-5.0;lua50'
-- Checking for one of the modules 'lua<=5.2.99'
-- Could NOT find LUA (missing: LUA_LIBRARY LUA_INCLUDE_DIR LUA_VERSION_NUM)
-- LUA NOT FOUND
...
...tshark couldn’t find Lua because I’m using v5.3, but v5.2 is the highest supported version. We can fix that!
> sudo apt install liblua5.2-dev
> cmake -DENABLE_LUA=ON -DLUA_VERSION_NUM=5.2 ..
> make tshark && sudo make install tshark
> tshark -r sample.pcap -Y "protocol" -T fields -e protocol.hdr.type
0x00000004
0x0000000c
...
...Success!
Now we can reverse-engineer unknown protocols on the command line, for fun and profit, using tshark built from source.
For reference, here’s the full script:
## Script for building tshark with lua dependencies
#!/bin/bash
# Inputs
if [ ! -v ROOT_DIR ]; then
ROOT_DIR="/opt"
fi
if [ ! -v WIRESHARK_REPO ]; then
WIRESHARK_REPO="https://gitlab.com/wireshark/wireshark.git"
fi
if [ ! -v WIRESHARK_VERSION ]; then
WIRESHARK_VERSION="v2.6.10"
fi
if [ ! -v LUA_VERSION ]; then
LUA_VERSION="5.2"
fi
WIRESHARK_DIR="$ROOT_DIR/wireshark"
# Dependencies
lua_dpkg="liblua$LUA_VERSION-dev"
sudo apt install $lua_dpkg
# Manage git directory
if [ ! -d $WIRESHARK_DIR ]; then
if [ ! -w $WIRESHARK_DIR ]; then
echo ""
echo "You do not have permission to write to \"$WIRESHARK_DIR\""
echo "Change permissions, choose another directory, or rerun with sudo"
exit 1
fi
mkdir -p $WIRESHARK_DIR
fi
# Clone git repo
if ! git clone $WIRESHARK_REPO $WIRESHARK_DIR; then
exit 1
fi
# Checkout version
cd $WIRESHARK_DIR
if ! git checkout $WIRESHARK_VERSION; then
exit 1
fi
# Build
mkdir build
cd build
cmake -DENABLE_LUA=ON -DLUA_VERSION_NUM=$LUA_VERSION ..
make tshark -j8
sudo make install tshark -j8
# Display info
tshark --ver
tshark -G foldersConclusion
We hope this was helpful for you and saved you some headaches and time. If you did find it useful, please help amplify the signal by sharing or upvoting wherever you find cool articles, like Reddit and HackerNews.
If you have any questions or feedback, let us know at hello@zetier.com.
