init.lua 18 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668
  1. -- init.lua
  2. --
  3. -- initialize wireshark's lua
  4. --
  5. -- This file is going to be executed before any other lua script.
  6. -- It can be used to load libraries, disable functions and more.
  7. --
  8. -- Wireshark - Network traffic analyzer
  9. -- By Gerald Combs <gerald@wireshark.org>
  10. -- Copyright 1998 Gerald Combs
  11. --
  12. -- SPDX-License-Identifier: GPL-2.0-or-later
  13. -- Set enable_lua to false to disable Lua support.
  14. enable_lua = true
  15. if not enable_lua then
  16. return
  17. end
  18. -- If set and Wireshark was started as (setuid) root, then the user
  19. -- will not be able to execute custom Lua scripts from the personal
  20. -- configuration directory, the -Xlua_script command line option or
  21. -- the Lua Evaluate menu option in the GUI.
  22. run_user_scripts_when_superuser = true
  23. function typeof(obj)
  24. local mt = getmetatable(obj)
  25. return mt and mt.__typeof or obj.__typeof or type(obj)
  26. end
  27. -- the following function checks if a file exists
  28. -- since 1.11.3
  29. function file_exists(name)
  30. local f = io.open(name,"r")
  31. if f ~= nil then io.close(f) return true else return false end
  32. end
  33. -- the following function prepends the given directory name to
  34. -- the package.path, so that a 'require "foo"' will work if 'foo'
  35. -- is in the directory name given to this function. For example,
  36. -- if your Lua file will do a 'require "foo"' and the foo.lua
  37. -- file is in a local directory (local to your script) named 'bar',
  38. -- then call this function before doing your 'require', by doing
  39. -- package.prepend_path("bar")
  40. -- and that will let Wireshark's Lua find the file "bar/foo.lua"
  41. -- when you later do 'require "foo"'
  42. --
  43. -- Because this function resides here in init.lua, it does not
  44. -- have the same environment as your script, so it has to get it
  45. -- using the debug library, which is why the code appears so
  46. -- cumbersome.
  47. --
  48. -- since 1.11.3
  49. function package.prepend_path(name)
  50. -- get the function calling this package.prepend_path function
  51. local dt = debug.getinfo(2, "f")
  52. if not dt then
  53. error("could not retrieve debug info table")
  54. end
  55. -- get its upvalue
  56. local _, val = debug.getupvalue(dt.func, 1)
  57. if not val or type(val) ~= 'table' then
  58. error("No calling function upvalue or it is not a table")
  59. end
  60. -- get the __DIR__ field in its upvalue table
  61. local dir = val["__DIR__"]
  62. -- get the platform-specific directory separator character
  63. local sep = package.config:sub(1,1)
  64. -- prepend the dir and given name to path
  65. if dir and dir:len() > 0 then
  66. package.path = dir .. sep .. name .. sep .. "?.lua;" .. package.path
  67. end
  68. -- also prepend just the name as a directory
  69. package.path = name .. sep .. "?.lua;" .. package.path
  70. end
  71. -- Wiretap encapsulations XXX
  72. wtap_encaps = {
  73. ["PER_PACKET"] = -1,
  74. ["UNKNOWN"] = 0,
  75. ["ETHERNET"] = 1,
  76. ["TOKEN_RING"] = 2,
  77. ["SLIP"] = 3,
  78. ["PPP"] = 4,
  79. ["FDDI"] = 5,
  80. ["FDDI_BITSWAPPED"] = 6,
  81. ["RAW_IP"] = 7,
  82. ["ARCNET"] = 8,
  83. ["ARCNET_LINUX"] = 9,
  84. ["ATM_RFC1483"] = 10,
  85. ["LINUX_ATM_CLIP"] = 11,
  86. ["LAPB"] = 12,
  87. ["ATM_PDUS"] = 13,
  88. ["ATM_PDUS_UNTRUNCATED"] = 14,
  89. ["NULL"] = 15,
  90. ["ASCEND"] = 16,
  91. ["ISDN"] = 17,
  92. ["IP_OVER_FC"] = 18,
  93. ["PPP_WITH_PHDR"] = 19,
  94. ["IEEE_802_11"] = 20,
  95. ["IEEE_802_11_PRISM"] = 21,
  96. ["IEEE_802_11_WITH_RADIO"] = 22,
  97. ["IEEE_802_11_RADIOTAP"] = 23,
  98. ["IEEE_802_11_AVS"] = 24,
  99. ["SLL"] = 25,
  100. ["FRELAY"] = 26,
  101. ["FRELAY_WITH_PHDR"] = 27,
  102. ["CHDLC"] = 28,
  103. ["CISCO_IOS"] = 29,
  104. ["LOCALTALK"] = 30,
  105. ["OLD_PFLOG"] = 31,
  106. ["HHDLC"] = 32,
  107. ["DOCSIS"] = 33,
  108. ["COSINE"] = 34,
  109. ["WFLEET_HDLC"] = 35,
  110. ["SDLC"] = 36,
  111. ["TZSP"] = 37,
  112. ["ENC"] = 38,
  113. ["PFLOG"] = 39,
  114. ["CHDLC_WITH_PHDR"] = 40,
  115. ["BLUETOOTH_H4"] = 41,
  116. ["MTP2"] = 42,
  117. ["MTP3"] = 43,
  118. ["IRDA"] = 44,
  119. ["USER0"] = 45,
  120. ["USER1"] = 46,
  121. ["USER2"] = 47,
  122. ["USER3"] = 48,
  123. ["USER4"] = 49,
  124. ["USER5"] = 50,
  125. ["USER6"] = 51,
  126. ["USER7"] = 52,
  127. ["USER8"] = 53,
  128. ["USER9"] = 54,
  129. ["USER10"] = 55,
  130. ["USER11"] = 56,
  131. ["USER12"] = 57,
  132. ["USER13"] = 58,
  133. ["USER14"] = 59,
  134. ["USER15"] = 60,
  135. ["SYMANTEC"] = 61,
  136. ["APPLE_IP_OVER_IEEE1394"] = 62,
  137. ["BACNET_MS_TP"] = 63,
  138. ["NETTL_RAW_ICMP"] = 64,
  139. ["NETTL_RAW_ICMPV6"] = 65,
  140. ["GPRS_LLC"] = 66,
  141. ["JUNIPER_ATM1"] = 67,
  142. ["JUNIPER_ATM2"] = 68,
  143. ["REDBACK"] = 69,
  144. ["NETTL_RAW_IP"] = 70,
  145. ["NETTL_ETHERNET"] = 71,
  146. ["NETTL_TOKEN_RING"] = 72,
  147. ["NETTL_FDDI"] = 73,
  148. ["NETTL_UNKNOWN"] = 74,
  149. ["MTP2_WITH_PHDR"] = 75,
  150. ["JUNIPER_PPPOE"] = 76,
  151. ["GCOM_TIE1"] = 77,
  152. ["GCOM_SERIAL"] = 78,
  153. ["NETTL_X25"] = 79,
  154. ["K12"] = 80,
  155. ["JUNIPER_MLPPP"] = 81,
  156. ["JUNIPER_MLFR"] = 82,
  157. ["JUNIPER_ETHER"] = 83,
  158. ["JUNIPER_PPP"] = 84,
  159. ["JUNIPER_FRELAY"] = 85,
  160. ["JUNIPER_CHDLC"] = 86,
  161. ["JUNIPER_GGSN"] = 87,
  162. ["LINUX_LAPD"] = 88,
  163. ["CATAPULT_DCT2000"] = 89,
  164. ["BER"] = 90,
  165. ["JUNIPER_VP"] = 91,
  166. ["USB_FREEBSD"] = 92,
  167. ["IEEE802_16_MAC_CPS"] = 93,
  168. ["NETTL_RAW_TELNET"] = 94,
  169. ["USB_LINUX"] = 95,
  170. ["MPEG"] = 96,
  171. ["PPI"] = 97,
  172. ["ERF"] = 98,
  173. ["BLUETOOTH_H4_WITH_PHDR"] = 99,
  174. ["SITA"] = 100,
  175. ["SCCP"] = 101,
  176. ["BLUETOOTH_HCI"] = 102,
  177. ["IPMB_KONTRON"] = 103,
  178. ["IEEE802_15_4"] = 104,
  179. ["X2E_XORAYA"] = 105,
  180. ["FLEXRAY"] = 106,
  181. ["LIN"] = 107,
  182. ["MOST"] = 108,
  183. ["CAN20B"] = 109,
  184. ["LAYER1_EVENT"] = 110,
  185. ["X2E_SERIAL"] = 111,
  186. ["I2C_LINUX"] = 112,
  187. ["IEEE802_15_4_NONASK_PHY"] = 113,
  188. ["TNEF"] = 114,
  189. ["USB_LINUX_MMAPPED"] = 115,
  190. ["GSM_UM"] = 116,
  191. ["DPNSS"] = 117,
  192. ["PACKETLOGGER"] = 118,
  193. ["NSTRACE_1_0"] = 119,
  194. ["NSTRACE_2_0"] = 120,
  195. ["FIBRE_CHANNEL_FC2"] = 121,
  196. ["FIBRE_CHANNEL_FC2_WITH_FRAME_DELIMS"] = 122,
  197. ["JPEG_JFIF"] = 123,
  198. ["IPNET"] = 124,
  199. ["SOCKETCAN"] = 125,
  200. ["IEEE_802_11_NETMON"] = 126,
  201. ["IEEE802_15_4_NOFCS"] = 127,
  202. ["RAW_IPFIX"] = 128,
  203. ["RAW_IP4"] = 129,
  204. ["RAW_IP6"] = 130,
  205. ["LAPD"] = 131,
  206. ["DVBCI"] = 132,
  207. ["MUX27010"] = 133,
  208. ["MIME"] = 134,
  209. ["NETANALYZER"] = 135,
  210. ["NETANALYZER_TRANSPARENT"] = 136,
  211. ["IP_OVER_IB_SNOOP"] = 137,
  212. ["MPEG_2_TS"] = 138,
  213. ["PPP_ETHER"] = 139,
  214. ["NFC_LLCP"] = 140,
  215. ["NFLOG"] = 141,
  216. ["V5_EF"] = 142,
  217. ["BACNET_MS_TP_WITH_PHDR"] = 143,
  218. ["IXVERIWAVE"] = 144,
  219. ["SDH"] = 145,
  220. ["DBUS"] = 146,
  221. ["AX25_KISS"] = 147,
  222. ["AX25"] = 148,
  223. ["SCTP"] = 149,
  224. ["INFINIBAND"] = 150,
  225. ["JUNIPER_SVCS"] = 151,
  226. ["USBPCAP"] = 152,
  227. ["RTAC_SERIAL"] = 153,
  228. ["BLUETOOTH_LE_LL"] = 154,
  229. ["WIRESHARK_UPPER_PDU"] = 155,
  230. ["STANAG_4607"] = 156,
  231. ["STANAG_5066_D_PDU"] = 157,
  232. ["NETLINK"] = 158,
  233. ["BLUETOOTH_LINUX_MONITOR"] = 159,
  234. ["BLUETOOTH_BREDR_BB"] = 160,
  235. ["BLUETOOTH_LE_LL_WITH_PHDR"] = 161,
  236. ["NSTRACE_3_0"] = 162,
  237. ["LOGCAT"] = 163,
  238. ["LOGCAT_BRIEF"] = 164,
  239. ["LOGCAT_PROCESS"] = 165,
  240. ["LOGCAT_TAG"] = 166,
  241. ["LOGCAT_THREAD"] = 167,
  242. ["LOGCAT_TIME"] = 168,
  243. ["LOGCAT_THREADTIME"] = 169,
  244. ["LOGCAT_LONG"] = 170,
  245. ["PKTAP"] = 171,
  246. ["EPON"] = 172,
  247. ["IPMI_TRACE"] = 173,
  248. ["LOOP"] = 174,
  249. ["JSON"] = 175,
  250. ["NSTRACE_3_5"] = 176,
  251. ["ISO14443"] = 177,
  252. ["GFP_T"] = 178,
  253. ["GFP_F"] = 179,
  254. ["IP_OVER_IB_PCAP"] = 180,
  255. ["JUNIPER_VN"] = 181,
  256. ["USB_DARWIN"] = 182,
  257. ["LORATAP"] = 183,
  258. ["3MB_ETHERNET"] = 184,
  259. ["VSOCK"] = 185,
  260. ["NORDIC_BLE"] = 186,
  261. ["NETMON_NET_NETEVENT"] = 187,
  262. ["NETMON_HEADER"] = 188,
  263. ["NETMON_NET_FILTER"] = 189,
  264. ["NETMON_NETWORK_INFO_EX"] = 190,
  265. ["MA_WFP_CAPTURE_V4"] = 191,
  266. ["MA_WFP_CAPTURE_V6"] = 192,
  267. ["MA_WFP_CAPTURE_2V4"] = 193,
  268. ["MA_WFP_CAPTURE_2V6"] = 194,
  269. ["MA_WFP_CAPTURE_AUTH_V4"] = 195,
  270. ["MA_WFP_CAPTURE_AUTH_V6"] = 196,
  271. ["JUNIPER_ST"] = 197,
  272. ["ETHERNET_MPACKET"] = 198,
  273. ["DOCSIS31_XRA31"] = 199,
  274. ["DPAUXMON"] = 200,
  275. ["RUBY_MARSHAL"] = 201,
  276. ["RFC7468"] = 202,
  277. ["SYSTEMD_JOURNAL"] = 203,
  278. ["EBHSCR"] = 204,
  279. ["VPP"] = 205,
  280. ["IEEE802_15_4_TAP"] = 206,
  281. ["LOG_3GPP"] = 207,
  282. ["USB_2_0"] = 208,
  283. ["MP4"] = 209,
  284. ["SLL2"] = 210,
  285. ["ZWAVE_SERIAL"] = 211,
  286. ["ETW"] = 212,
  287. ["ERI_ENB_LOG"] = 213,
  288. ["ZBNCP"] = 214,
  289. ["USB_2_0_LOW_SPEED"] = 215,
  290. ["USB_2_0_FULL_SPEED"] = 216,
  291. ["USB_2_0_HIGH_SPEED"] = 217
  292. }
  293. wtap = wtap_encaps -- for bw compatibility
  294. --
  295. -- Generate the wtap_filetypes items for file types, for backwards
  296. -- compatibility.
  297. -- We no longer have WTAP_FILE_TYPE_SUBTYPE_ #defines;
  298. -- built-in file types are registered the same way that
  299. -- plugin file types are registered.
  300. --
  301. -- New code should use wtap_name_to_file_type_subtype to
  302. -- look up file types by name.
  303. --
  304. wtap_filetypes = get_wtap_filetypes()
  305. -- Wiretap timestamp precision types
  306. wtap_tsprecs = {
  307. ["SEC"] = 0,
  308. ["DSEC"] = 1,
  309. ["CSEC"] = 2,
  310. ["MSEC"] = 3,
  311. ["USEC"] = 6,
  312. ["NSEC"] = 9
  313. }
  314. -- Wiretap file comment types
  315. wtap_comments = {
  316. ["PER_SECTION"] = 0x00000001,
  317. ["PER_INTERFACE"] = 0x00000002,
  318. ["PER_PACKET"] = 0x00000004
  319. }
  320. -- Field Types
  321. ftypes = {
  322. ["NONE"] = 0,
  323. ["PROTOCOL"] = 1,
  324. ["BOOLEAN"] = 2,
  325. ["CHAR"] = 3,
  326. ["UINT8"] = 4,
  327. ["UINT16"] = 5,
  328. ["UINT24"] = 6,
  329. ["UINT32"] = 7,
  330. ["UINT40"] = 8,
  331. ["UINT48"] = 9,
  332. ["UINT56"] = 10,
  333. ["UINT64"] = 11,
  334. ["INT8"] = 12,
  335. ["INT16"] = 13,
  336. ["INT24"] = 14,
  337. ["INT32"] = 15,
  338. ["INT40"] = 16,
  339. ["INT48"] = 17,
  340. ["INT56"] = 18,
  341. ["INT64"] = 19,
  342. ["IEEE_11073_SFLOAT"] = 20,
  343. ["IEEE_11073_FLOAT"] = 21,
  344. ["FLOAT"] = 22,
  345. ["DOUBLE"] = 23,
  346. ["ABSOLUTE_TIME"] = 24,
  347. ["RELATIVE_TIME"] = 25,
  348. ["STRING"] = 26,
  349. ["STRINGZ"] = 27,
  350. ["UINT_STRING"] = 28,
  351. ["ETHER"] = 29,
  352. ["BYTES"] = 30,
  353. ["UINT_BYTES"] = 31,
  354. ["IPv4"] = 32,
  355. ["IPv6"] = 33,
  356. ["IPXNET"] = 34,
  357. ["FRAMENUM"] = 35,
  358. ["GUID"] = 36,
  359. ["OID"] = 37,
  360. ["EUI64"] = 38,
  361. ["AX25"] = 39,
  362. ["VINES"] = 40,
  363. ["REL_OID"] = 41,
  364. ["SYSTEM_ID"] = 42,
  365. ["STRINGZPAD"] = 43,
  366. ["FCWWN"] = 44,
  367. ["STRINGZTRUNC"] = 45,
  368. ["OVERFLOW"] = 46,
  369. ["BADARG"] = 47,
  370. ["ERROR"] = 48
  371. }
  372. -- the following table is since 2.0
  373. -- Field Type FRAMENUM Types
  374. frametype = {
  375. ["NONE"] = 0,
  376. ["REQUEST"] = 1,
  377. ["RESPONSE"] = 2,
  378. ["ACK"] = 3,
  379. ["DUP_ACK"] = 4,
  380. ["RETRANS_PREV"] = 5,
  381. ["RETRANS_NEXT"] = 6
  382. }
  383. -- the following table is since 1.12
  384. -- Wiretap record_types
  385. wtap_rec_types = {
  386. ["PACKET"] = 0, -- packet
  387. ["FT_SPECIFIC_EVENT"] = 1, -- file-type-specific event
  388. ["FT_SPECIFIC_REPORT"] = 2, -- file-type-specific report
  389. ["SYSCALL"] = 3, -- system call
  390. ["SYSTEMD_JOURNAL_EXPORT"] = 4, -- systemd journal entry
  391. ["CUSTOM_BLOCK"] = 5, -- pcapng custom block
  392. }
  393. -- the following table is since 1.11.3
  394. -- Wiretap presence flags
  395. wtap_presence_flags = {
  396. ["TS"] = 1, -- time stamp
  397. ["CAP_LEN"] = 2, -- captured length separate from on-the-network length
  398. ["INTERFACE_ID"] = 4, -- interface ID
  399. ["SECTION_NUMBER"] = 8, -- section number
  400. }
  401. -- Display Bases
  402. base = {
  403. ["NONE"] = 0, -- none
  404. ["DEC"] = 1, -- decimal [integer, float]
  405. ["HEX"] = 2, -- hexadecimal [integer, float]
  406. ["OCT"] = 3, -- octal [integer]
  407. ["DEC_HEX"] = 4, -- decimal (hexadecimal) [integer]
  408. ["HEX_DEC"] = 5, -- hexadecimal (decimal) [integer]
  409. ["CUSTOM"] = 6, -- call custom routine to format [integer, float]
  410. ["EXP"] = 7, -- exponential [float]
  411. ["DOT"] = 8, -- hexadecimal bytes with a period (.) between each byte
  412. ["DASH"] = 9, -- hexadecimal bytes with a dash (-) between each byte
  413. ["COLON"] = 10, -- hexadecimal bytes with a colon (:) between each byte
  414. ["SPACE"] = 11, -- hexadecimal bytes with a space between each byte
  415. ["NETMASK"] = 12, -- Used for IPv4 address that shouldn't be resolved (like for netmasks)
  416. ["PT_UDP"] = 13, -- UDP port
  417. ["PT_TCP"] = 14, -- TCP port
  418. ["PT_DCCP"] = 15, -- DCCP port
  419. ["PT_SCTP"] = 16, -- SCTP port
  420. ["OUI"] = 17, -- OUI resolution
  421. ["LOCAL"] = 18, -- local time in our time zone, with month and day
  422. ["UTC"] = 19, -- UTC, with month and day
  423. ["DOY_UTC"] = 20, -- UTC, with 1-origin day-of-year
  424. ["NTP_UTC"] = 21, -- UTC, with "NULL" when timestamp is all zeros
  425. ["RANGE_STRING"] = 256, -- Use the supplied range string to convert the field to text
  426. ["UNIT_STRING"] = 4096, -- Add unit text to the field value
  427. }
  428. -- Encodings
  429. ENC_BIG_ENDIAN = 0
  430. ENC_LITTLE_ENDIAN = 2147483648
  431. ENC_NA = 0
  432. ENC_CHARENCODING_MASK = 65534
  433. ENC_ASCII = 0
  434. ENC_ISO_646_IRV = 14
  435. ENC_UTF_8 = 2
  436. ENC_UTF_16 = 4
  437. ENC_UCS_2 = 6
  438. ENC_UCS_4 = 8
  439. ENC_ISO_8859_1 = 10
  440. ENC_ISO_8859_2 = 12
  441. ENC_ISO_8859_3 = 14
  442. ENC_ISO_8859_4 = 16
  443. ENC_ISO_8859_5 = 18
  444. ENC_ISO_8859_6 = 20
  445. ENC_ISO_8859_7 = 22
  446. ENC_ISO_8859_8 = 24
  447. ENC_ISO_8859_9 = 26
  448. ENC_ISO_8859_10 = 28
  449. ENC_ISO_8859_11 = 30
  450. ENC_ISO_8859_13 = 34
  451. ENC_ISO_8859_14 = 36
  452. ENC_ISO_8859_15 = 38
  453. ENC_ISO_8859_16 = 40
  454. ENC_WINDOWS_1250 = 42
  455. ENC_3GPP_TS_23_038_7BITS_PACKED = 44
  456. ENC_3GPP_TS_23_038_7BITS = 14
  457. ENC_EBCDIC = 46
  458. ENC_MAC_ROMAN = 48
  459. ENC_CP437 = 50
  460. ENC_ASCII_7BITS = 52
  461. ENC_T61 = 54
  462. ENC_EBCDIC_CP037 = 56
  463. ENC_WINDOWS_1252 = 58
  464. ENC_WINDOWS_1251 = 60
  465. ENC_CP855 = 62
  466. ENC_CP866 = 64
  467. ENC_ISO_646_BASIC = 66
  468. ENC_BCD_DIGITS_0_9 = 68
  469. ENC_KEYPAD_ABC_TBCD = 70
  470. ENC_KEYPAD_BC_TBCD = 72
  471. ENC_3GPP_TS_23_038_7BITS_UNPACKED = 76
  472. ENC_ETSI_TS_102_221_ANNEX_A = 78
  473. ENC_GB18030 = 80
  474. ENC_EUC_KR = 82
  475. ENC_APN_STR = 84
  476. ENC_ZIGBEE = 1073741824
  477. ENC_STR_NUM = 16777216
  478. ENC_STR_HEX = 33554432
  479. ENC_STRING = 50331648
  480. ENC_STR_MASK = 65534
  481. ENC_NUM_PREF = 2097152
  482. ENC_SEP_NONE = 65536
  483. ENC_SEP_COLON = 131072
  484. ENC_SEP_DASH = 262144
  485. ENC_SEP_DOT = 524288
  486. ENC_SEP_SPACE = 1048576
  487. ENC_SEP_MASK = 2031616
  488. ENC_BCD_ODD_NUM_DIG = 65536
  489. ENC_BCD_SKIP_FIRST = 131072
  490. ENC_TIME_SECS_NSECS = 0
  491. ENC_TIME_TIMESPEC = 0
  492. ENC_TIME_NTP = 2
  493. ENC_TIME_TOD = 4
  494. ENC_TIME_RTPS = 8
  495. ENC_TIME_NTP_BASE_ZERO = 8
  496. ENC_TIME_SECS_USECS = 16
  497. ENC_TIME_TIMEVAL = 16
  498. ENC_TIME_SECS = 18
  499. ENC_TIME_MSECS = 20
  500. ENC_TIME_SECS_NTP = 24
  501. ENC_TIME_RFC_3971 = 32
  502. ENC_TIME_MSEC_NTP = 34
  503. ENC_TIME_MIP6 = 36
  504. ENC_TIME_CLASSIC_MAC_OS_SECS = 38
  505. ENC_TIME_NSECS = 40
  506. ENC_TIME_USECS = 48
  507. ENC_ISO_8601_DATE = 65536
  508. ENC_ISO_8601_TIME = 131072
  509. ENC_ISO_8601_DATE_TIME = 196608
  510. ENC_RFC_822 = 262144
  511. ENC_RFC_1123 = 524288
  512. ENC_ISO_8601_DATE_TIME_BASIC = 1048576
  513. ENC_STR_TIME_MASK = 2031616
  514. ENC_VARINT_PROTOBUF = 2
  515. ENC_VARINT_QUIC = 4
  516. ENC_VARINT_ZIGZAG = 8
  517. -- Expert flags and facilities (deprecated - see 'expert' table below)
  518. PI_SEVERITY_MASK = 15728640
  519. PI_COMMENT = 1048576
  520. PI_CHAT = 2097152
  521. PI_NOTE = 4194304
  522. PI_WARN = 6291456
  523. PI_ERROR = 8388608
  524. PI_GROUP_MASK = 4278190080
  525. PI_CHECKSUM = 16777216
  526. PI_SEQUENCE = 33554432
  527. PI_RESPONSE_CODE = 50331648
  528. PI_REQUEST_CODE = 67108864
  529. PI_UNDECODED = 83886080
  530. PI_REASSEMBLE = 100663296
  531. PI_MALFORMED = 117440512
  532. PI_DEBUG = 134217728
  533. PI_PROTOCOL = 150994944
  534. PI_SECURITY = 167772160
  535. PI_COMMENTS_GROUP = 184549376
  536. PI_DECRYPTION = 201326592
  537. PI_ASSUMPTION = 218103808
  538. PI_DEPRECATED = 234881024
  539. -- the following table is since 1.11.3
  540. -- Expert flags and facilities
  541. expert = {
  542. -- Expert event groups
  543. group = {
  544. -- The protocol field has a bad checksum, usually uses PI_WARN severity
  545. ["CHECKSUM"] = 16777216,
  546. -- The protocol field indicates a sequence problem (e.g. TCP window is zero)
  547. ["SEQUENCE"] = 33554432,
  548. -- The protocol field indicates a bad application response code (e.g. HTTP 404), usually PI_NOTE severity
  549. ["RESPONSE_CODE"] = 50331648,
  550. -- The protocol field indicates an application request (e.g. File Handle == xxxx), usually PI_CHAT severity
  551. ["REQUEST_CODE"] = 67108864,
  552. -- The data is undecoded, the protocol dissection is incomplete here, usually PI_WARN severity
  553. ["UNDECODED"] = 83886080,
  554. -- The protocol field indicates a reassemble (e.g. DCE/RPC defragmentation), usually PI_CHAT severity (or PI_ERROR)
  555. ["REASSEMBLE"] = 100663296,
  556. -- The packet data is malformed, the dissector has "given up", usually PI_ERROR severity
  557. ["MALFORMED"] = 117440512,
  558. -- A generic debugging message (shouldn't remain in production code!), usually PI_ERROR severity
  559. ["DEBUG"] = 134217728,
  560. -- The protocol field violates a protocol specification, usually PI_WARN severity
  561. ["PROTOCOL"] = 150994944,
  562. -- The protocol field indicates a security problem (e.g. insecure implementation)
  563. ["SECURITY"] = 167772160,
  564. -- The protocol field indicates a packet comment
  565. ["COMMENTS_GROUP"] = 184549376,
  566. -- The protocol field indicates a decryption problem
  567. ["DECRYPTION"] = 201326592,
  568. -- The protocol field has incomplete data, decode based on assumed value
  569. ["ASSUMPTION"] = 218103808,
  570. -- The protocol field has been deprecated, usually PI_NOTE severity
  571. ["DEPRECATED"] = 234881024,
  572. },
  573. -- Expert severity levels
  574. severity = {
  575. -- Packet comment
  576. ["COMMENT"] = 1048576,
  577. -- Usual workflow, e.g. TCP connection establishing
  578. ["CHAT"] = 2097152,
  579. -- Notable messages, e.g. an application returned an "unusual" error code like HTTP 404
  580. ["NOTE"] = 4194304,
  581. -- Warning, e.g. application returned an "unusual" error code
  582. ["WARN"] = 6291456,
  583. -- Serious problems, e.g. a malformed packet
  584. ["ERROR"] = 8388608,
  585. },
  586. }
  587. -- menu groups for register_menu
  588. MENU_PACKET_ANALYZE_UNSORTED = 0
  589. MENU_ANALYZE_CONVERSATION_FILTER = 1
  590. MENU_PACKET_STAT_UNSORTED = 2
  591. MENU_STAT_GENERIC = 3
  592. MENU_STAT_CONVERSATION_LIST = 4
  593. MENU_STAT_ENDPOINT_LIST = 5
  594. MENU_STAT_RESPONSE_TIME = 6
  595. MENU_STAT_RSERPOOL = 7
  596. MENU_STAT_TELEPHONY = 8
  597. MENU_STAT_TELEPHONY_ANSI = 9
  598. MENU_STAT_TELEPHONY_GSM = 10
  599. MENU_STAT_TELEPHONY_LTE = 11
  600. MENU_STAT_TELEPHONY_MTP3 = 12
  601. MENU_STAT_TELEPHONY_SCTP = 13
  602. MENU_TOOLS_UNSORTED = 14
  603. MENU_LOG_ANALYZE_UNSORTED = 15
  604. MENU_LOG_STAT_UNSORTED = 16
  605. -- Old / deprecated menu groups. These shoudn't be used in new code.
  606. MENU_ANALYZE_UNSORTED = MENU_PACKET_ANALYZE_UNSORTED
  607. MENU_ANALYZE_CONVERSATION = MENU_ANALYZE_CONVERSATION_FILTER
  608. MENU_STAT_CONVERSATION = MENU_STAT_CONVERSATION_LIST
  609. MENU_STAT_ENDPOINT = MENU_STAT_ENDPOINT_LIST
  610. MENU_STAT_RESPONSE = MENU_STAT_RESPONSE_TIME
  611. MENU_STAT_UNSORTED = MENU_PACKET_STAT_UNSORTED
  612. -- the possible values for Pinfo's p2p_dir attribute
  613. P2P_DIR_UNKNOWN = -1
  614. P2P_DIR_SENT = 0
  615. P2P_DIR_RECV = 1
  616. -- other useful constants
  617. -- DATA_DIR and USER_DIR have a trailing directory separator.
  618. GUI_ENABLED = gui_enabled()
  619. DATA_DIR = Dir.global_config_path()..package.config:sub(1,1)
  620. USER_DIR = Dir.personal_config_path()..package.config:sub(1,1)
  621. -- deprecated function names
  622. datafile_path = Dir.global_config_path
  623. persconffile_path = Dir.personal_config_path
  624. if not running_superuser or run_user_scripts_when_superuser then
  625. dofile(DATA_DIR.."console.lua")
  626. end
  627. --dofile(DATA_DIR.."dtd_gen.lua")