I’ve recently turned to WireShark to do some network analysis but found tracking the bits and bytes of xPL not too easy, though still not difficult. But when I read that WireShark can be extended using Lua, I started fiddling around with that to see how I could get xPL support in WireShark. And this post is about the results…

The ‘dissector’ I wrote (download is below) will examine xPL packets, and dissect them into the underlying components. This allows you to use WireSharks filtering capabilities to find just the xPL messages you need. Beyond that it will analyze the structure of the messages received and validate that against the xPL protocol, flagging any malformed messages. Continue reading →