Wireshark Scripting

March 15, 2016 (at 9 a.m.)

Wireshark is a highly customizable software for network analysis. The Lua scripting language can be used to extend nearly all aspects of Wireshark including the definition of new protocols (protocol dissectors), event triggers, GUI, etc. In this hands-on training, attendants will learn how to customize Wireshark to their own needs for network analysis, protocol research, etc. using Lua scripts.

Topics:

Introduction to the Lua scripting language and the Lua-API in Wireshark
Write your own protocol dissectors for protocol reverse engineering, support of uncommon protocols, etc.
Extend existing protocol dissectors for a more detailed view on a network protocol
Create listeners to trigger events based on traffic patterns
Create your own UI elements (menu, windows, preferences) within Wireshark, File IO

Requirements:

Basic understanding for common network protocol
Laptop (we provide the training environment on a bootable USB thumb drive)

Sebastian Schrittwieser

Sebastian Schrittwieser heads the Josef Ressel Center for Unified Threat Intelligence on Targeted Attacks https://www.jrz-target.at and is a lecturer for IT security at the University of Applied Sciences St. Pölten, Austria. He received a doctoral degree in informatics with focus on information security from the Vienna University of Technology in 2014. Sebastian’s research interests include, among others, network analysis, digital forensics, binary analysis, and mobile security. Furthermore, Sebastian is a senior expert at Kibosec GmbH.