Viewing your protocol in Wireshark and playing with libpcap

Writing network code eh? At times I am, and for this particular network stuff I needed a protocol dissector for wireshark. As one of these makes it that much easier to verify that you're sending the correct stuff on your wire.

First off, you'll most likely need to modify the wireshark installation to allow specific users to run the tool. This setup will also avoid that you'll be running wireshark as root. [README]

# sudo dpkg-reconfigure wireshark-common

Answer yes to the allow user to capture intefaces. Next, part is that you'll need to add the use(s) to the wireshark group to allow em to use the sniffer tool!

# sudo usermod -a -G wireshark $USER

Of course the $USER will add root! (sudo at the beginning) so you'll have to replace $USER with your user name, or pipe it to the experssion.

Finally, for your group changes to take effect you'll need to log in and out of gnome :O I know, it sucks etc. but that what you'll have to do!

Editorsnote: You can use this neat trick to force logout after package installation in the scripts Neato!

# gnome-session-quit --logout --no-prompt 

Onwards to the protocol stuff: [source]

Open your editor and create a simple lua dissector [source].

Now you'll need libpcap to send some data over the wire. I prefer libpcap as most of this code will be portable to windows using winpcap. This way you won't need to use a strategy pattern for teh socket stuff. As the libpcap/winpcap servers as this pattern.