Wireshark Generic Dissector

Mandatory

Change Log
Behavior modifications

Windows 64 bits

Wireshark 64 bits Last update Support
4.2.X download 2023/11/18 end 2026
4.0.X download 2022/10/08 end 2025
3.6.X download 2021/11/22 end 2024
3.4.X download 2021/01/10 end 2023
3.2.X download -
3.0.X download -
2.6.X download 2021/01/10 -
2.4.X download 2020/01/19 -
2.2.X download 2019/01/27 -
Linux clone/build script (wireshark >= 2.6)

Linux 64 bits

Wireshark 64 bits Last update Build on Support
4.2.X download 2023/11/20 CentOS Stream 9 Also works on, e.g. : - Ubuntu 22.04 end 2026
4.0.X download 2023/03/11 CentOS Stream 8 Also works on, e.g. : - CentOS 8 - CentOS Stream 9 - Debian 10 - Kali 2019.2 - Opensuse-leap 15.1 - Ubuntu 16.04, 18.04, 20.04, 22.04 Does not works on, e.g. : - CentOS 7 end 2025
3.6.X download 2023/03/11 CentOS 7 Also works on, e.g. : - CentOS 8 - CentOS Stream 8, 9 - Debian 10 - Kali 2019.2 - Opensuse-leap 15.1 - Ubuntu 16.04, 18.04, 20.04, 22.04 end 2024
3.4.X download end 2023
3.2.X download -
3.0.X download
2.6.X download 2019/01/25 CentOS 7
2.4.X download 2017/07/01
2.2.X download 2017/04/03 Ubuntu 14.04 -
2.0.X download
1.12.X download
1.10.X download 2015/02/21 Ubuntu 12.04 -
1.8.X download
1.6.X download
32 bits

Windows 32 bits

Wireshark 32 bits Last update Support
3.2.X download 2020/12/13 -
3.0.X download
2.6.X download
2.4.X download 2020/01/19
2.2.X download 2019/01/27

Linux 32 bits build on Ubuntu

Wireshark 32 bits Last update Build on Support
2.4.X download 2017/07/08 16.04 -
2.2.X download 2017/04/03 14.04
2.0.X download
1.12.X download
1.10.X download 2015/02/21 12.04
1.8.X download
1.6.X download

For a first test

Posted on 27/10/2007 by UserName

example_with_capture.wsgd
example_with_capture.fdesc
example_with_capture.pcap



Text editor highlighters

Posted on 27/10/2007 by UserName

vscode wsgd-0.0.4.vsix
vim vim_syntax_wsgd.tar untar it into your home directory
notepad++ userDefineLang_WSGD.xml put it into notepad++ userDefineLangs directory
PSPad fdesc.ini put it into <pspad>/syntax directory

Source code

Posted on 27/10/2007 by UserName

C++ source code : https://gitlab.com/wsgd/wsgd





Stand-alone

Posted on 27/10/2007 by UserName

The tools here are :
- NOT linked to wireshark tools (or source code)
- NOT able to manage <file>.wsgd
- NOT able to manage directly <file>.pcap
- NOT able to capture packet on network
- NOT able to manage sub-dissector/proto


Byte interpret is a stand-alone command line tool which is able to decode a binary file/input using the <file>.fdesc syntax.
>byte_interpret.exe <file>.fdesc -frame_bin <file_which_contains_binary_data>
...
>byte_interpret.exe byte_order big_endian ; float32 value ; -- 00 01 02 03
value = 9.25572e-041

OS 64 bits
Windows byte_interpret.exe
Linux byte_interpret.x


Windows frhed with fdesc_decoder           (last update : 2011/04/02)
This is Byte interpret embedded inside frhed (version 1.5.1).
frhed is a hexa-decimal editor, see http://frhed.sourceforge.net/.
Use "File/Open ..." to choose the (binary) file to interpret.
Use "Edit/Apply template ..." to choose the <file>.fdesc to apply to the binary data.


The <file>.fdesc must contains all types definitions.
Then you must add, at the end, the data you want to read.
E.g, very short example :

# First, the definitions 
enum16  my_1st_enum_type
{
    val_false      0
    val_true       1
    val_not_sure   2
}
alias my_1st_int_type  uint32{d=hex}{min=0x22:max=0x2345675};
# Then, what I want to read/decode :
my_1st_enum_type      my_1st_enum_field;
my_1st_int_type[*]    my_1st_int_field;
CSS Template by Rambling Soul