Wreshark message analysis plug-in generation method and system

Abstract

The invention discloses a Wreshark message analysis plug-in generation method and system, and relates to the technical field of computer networks, and the method comprises the steps: obtaining a designed protocol hierarchical relation graph; analyzing the protocol hierarchical relation graph by adopting a hierarchical relation graph analysis engine to obtain association and key contents of field values between hierarchies and in the layer, and analyzing a protocol design document by adopting a protocol design document engine to obtain a field set; taking the bit width of the data type in the Wireshark plug-in as a reference set, processing the bit width of a field according to a protocol field splitting algorithm, and marking the type and mask of the field to obtain a field set mask; building plug-in elements according to the field set masks; and generating a protocol analysis plug-in according to the hierarchical relation graph, the protocol design document and the plug-in element. According to the method, the plugin development threshold can be reduced, the problems of complexity and diversity of protocol design, uncertain fields and the like are solved, and the Wreshark message analysis plugin is efficiently, accurately and automatically generated.

Description

Technical Field

[0001] The present invention relates to the technical field of computer networks, and in particular to a method and system for generating a Wireshark message parsing plug-in. Background Art

[0002] Wireshark is a powerful and popular open source network protocol analysis tool. In order to allow users to use Wireshark to analyze protocol packets transmitted in the network more conveniently and effectively in network communications, Wireshark provides a relatively powerful plug-in extension function.

[0003] When Wireshark parses packets of custom protocols, it is usually implemented in accordance with the protocol format definition combined with the extension rules of the plug-in. The existing plug-in development method provided by Wireshark has obvious limitations. First, the Lua and C languages ​​supported by Wireshark's plug-in implementation are both embedded languages, and their plug-in development has a high implementation threshold and complex design logic; secondly, the protocol design is complex and diverse, with flexible hierarchical nesting, and high uncertainty in field options and width, which makes plug-in development difficult, reusable, high maintenance cost, and difficult to debug and locate. Summary of the invention

[0004] The present invention aims to provide a method and system for generating a Wireshark message parsing plug-in to solve the technical problems existing in the prior art.

[0005] The present invention is achieved through the following technical solutions: In a first aspect, an embodiment of the present invention provides a method for generating a Wireshark message parsing plug-in, comprising: Get the designed protocol hierarchy diagram; The hierarchical relationship diagram parsing engine is used to parse the protocol hierarchical relationship diagram to obtain the association and key content of field values ​​between levels and within the current layer. The protocol design document engine is used to parse the protocol design document to obtain the field set. The bit width of the data type in the Wireshark plug-in is used as a benchmark set, the field bit width is processed according to the protocol field splitting algorithm, and the field type and mask are marked to obtain the field set mask; Build plugin element based on fieldset mask; Generate a protocol parsing plug-in based on the hierarchical relationship diagram, protocol design document, and plug-in elements.

[0006] In a second aspect, an embodiment of the present invention provides a Wireshark message parsing plug-in generation system, comprising: an acquisition module, a parsing module, a calculation module, a construction module and a generation module. The acquisition module is used to acquire the designed protocol level relationship diagram; The parsing module uses a hierarchical relationship diagram parsing engine to parse the protocol hierarchical relationship diagram to obtain the association and key content of field values ​​between levels and within the current layer, and uses a protocol design document engine to parse the protocol design document to obtain a field set; The calculation module uses the bit width of the data type in the Wireshark plug-in as a reference set, processes the field bit width according to the protocol field splitting algorithm, and marks the type and mask of the field to obtain a field set mask; The building module is used to build a plug-in element according to the field set mask; The generation module generates a protocol parsing plug-in according to the hierarchical relationship diagram, the protocol design document and the plug-in elements.

[0007] Compared with the prior art, the present invention has the following advantages and beneficial effects: The embodiment of the present invention provides a Wireshark message parsing plug-in generation method and system. First, the plug-in is automatically generated through the plug-in Python program instead of directly writing the Lua program, which reduces the threshold for plug-in development; secondly, the protocol plug-in design process is simplified through the protocol layer relationship diagram, making the protocol plug-in implementation logic clearer; then, the protocol field splitting algorithm is introduced to solve the pain points of complex and diverse protocol design and uncertain fields. Finally, the method is transparent to the protocol. For the logical adjustment and field change of the protocol design, it only needs to adjust the protocol design document to regenerate the protocol plug-in, truly realizing the plug-in plug-in. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] In order to more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and should not be regarded as limiting the scope. For those of ordinary skill in the art, other relevant drawings can be obtained based on these drawings without creative work. In the drawings: Figure 1 A flowchart of a method for generating a Wireshark message parsing plug-in provided in the first embodiment of the present invention; Figure 2 To design the protocol hierarchy diagram; Figure 3 A flowchart of a specific method for calculating a field set mask based on a field set; Figure 4 A topology diagram of the protocol parsing plug-in application; Figure 5 A structural block diagram of a Wireshark message parsing plug-in generation system provided in another embodiment of the present invention. DETAILED DESCRIPTION

[0009] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with embodiments and drawings. The exemplary embodiments of the present invention and their description are only used to explain the present invention and are not intended to limit the present invention. Example

[0010] like Figure 1 As shown, a method for generating a Wireshark message parsing plug-in provided by an embodiment of the present invention includes: Get the designed protocol layer relationship diagram; The hierarchical relationship diagram parsing engine is used to parse the protocol hierarchical relationship diagram to obtain the association and key content of field values ​​between levels and within the current layer. The protocol design document engine is used to parse the protocol design document to obtain the field set. The bit width of the data type in the Wireshark plug-in is used as a benchmark set, the field bit width is processed according to the protocol field splitting algorithm, and the field type and mask are marked to obtain the field set mask; Build plugin element based on fieldset mask; Generate a protocol parsing plug-in based on the hierarchical relationship diagram, protocol design document, and plug-in elements.

[0011] The core principle of this method is to use the protocol layer relationship diagram to drive, based on the protocol design document, and revolve around the processing of the protocol layer relationship diagram.

[0012] The first step, such as Figure 2 As shown, a protocol hierarchy diagram is designed. The protocol in this embodiment is drawn based on Ethernet and belongs to a layer 2 communication protocol. The protocol includes a protocol type, a private service header field, a private sub-service header field, and a service body field. The custom protocol type Type value is used as an identification protocol number. Among them, except for the Ethernet header part, all are protocol field parts. In the protocol, the next layer of protocol can be determined by one or more field values ​​in the previous layer protocol structure, or by the field values ​​in the previous layer protocol field and the next layer protocol. The design of the protocol hierarchy diagram is very flexible. It can not only be used for the design of multi-level protocol messages, but also can be applied to the design of nested protocols at any level of standard protocols. It only needs to specify fields in the upper layer of the protocol part.

[0013] The second step is to write the engine for parsing the protocol design document and the engine for parsing the hierarchical diagram after designing the protocol hierarchical diagram. Use Python language to implement two types of engines. The hierarchical diagram engine is responsible for parsing the protocol hierarchical diagram, mainly focusing on the association and key content of field values ​​between levels and within the layer. The key content includes field names, associated fields and values; the protocol design document engine is responsible for parsing the field set in the protocol design document. The field set includes field name, starting bit width, and bit width information.

[0014] The third step is to calculate the field set mask based on the field set. The specific method is as follows: Taking the bit widths of the uint8, uint16, uint24, uint32, and uint64 data types in the Wireshark plug-in as the benchmark set A, we get At the same time, initialize the field stack S to store the field set to be calculated. Figure 3 The detailed process is as follows: First, the field bit width is subjected to benchmark splitting and compensation splitting operations according to the protocol field splitting algorithm.

[0015] The logic of the benchmark split operation is as follows: When the protocol fields are sequentially pushed into stack S, the bit width and total of the fields in stack S are calculated as follows: n is the number of fields in stack S.

[0016]

[0017] like When , the fields in stack S are not split, stack S is set to empty and total is set to 0.

[0018] like When , the top field of the stack is split. If the bit width of the top field of the stack is represented by x, and the number of split segments is represented by n, the calculation expression of the bit width of each segment f (n) is: , in, , is the bit width of the 0th field, is the bit width of the nth field, is the largest value in the benchmark set A.

[0019] The logic of the compensation split operation is as follows: The field bit width y of the compensation split should meet the following conditions:

[0020] When this condition is met, the compensation splitting algorithm is used, where the number of split segments is represented by n, and the calculation expression of the segment bit width f (n) is:

[0021] Secondly, the type and mask of the tag field are marked. The benchmark splitting algorithm is still used, but the processing is different. The specific operations are as follows.

[0022] After the protocol fields are sequentially pushed into stack S, the total bit width of the stack S fields is calculated in the same way as above.

[0023] like When , the stack field shared data type is total, and the field elements in the stack occupy data type bit interval bits from the bottom to the top of the stack in order, all of which are 1, which is the mask of the field. The data type and mask are used as the new attributes of the field, and the stack S and total are reset at the same time, and the next round of calculation is performed.

[0024] like When , the field elements in the stack are maintained and wait for new fields to be pushed into the stack.

[0025] The fourth step is to build plug-in elements such as field sets and logical judgments based on the field set mask.

[0026] First, the field name, data type and mask attribute in the protocol field are used to complete the field definition of the plug-in; secondly, according to the protocol layer relationship diagram and associated fields, the logical judgment conditions of the protocol layer are generated, and the logical judgment conditions of the fields at this layer are supplemented; finally, according to the field bit offset, the fields are added to the entire protocol chain in sequence.

[0027] At this point, the Python code is built and the protocol plug-in generation tool is completed.

[0028] Step 5: Generate a protocol parsing plug-in. Place the protocol layer relationship diagram and the protocol design document in the directory where the generation tool is located, and run the tool to generate a protocol parsing plug-in named with the .lua suffix.

[0029] like Figure 4 As shown in the figure, the application of the protocol parsing plug-in. Prepare the operating environment of the Wireshark software on the PC device, and copy the generated parsing plug-in to the plug-in directory of Wireshark. Then start Wireshark to capture the protocol message sent from server A to the network card through the network card, and determine whether it is the target protocol message. If it is, use the protocol parsing plug-in to perform protocol parsing, and the parsing results of the captured message can be dynamically displayed in the Wireshark graphical interface. If not, parse according to the built-in protocol.

[0030] The embodiment of the present invention provides a method for generating a Wireshark message parsing plug-in. First, the plug-in is automatically generated through a plug-in Python program instead of directly writing a Lua program, thereby lowering the threshold for plug-in development. Secondly, the protocol plug-in design process is simplified through a protocol layer relationship diagram, making the protocol plug-in implementation logic clearer. Then, a protocol field splitting algorithm is introduced to solve the pain points of complex and diverse protocol design and uncertain fields. Finally, the method is transparent to the protocol. For the logical adjustment and field change of the protocol design, it only needs to adjust the protocol design document to regenerate the protocol plug-in, truly realizing plug-and-play of the plug-in.

[0031] like Figure 5 As shown, another embodiment of the present invention provides a Wireshark message parsing plug-in generation system, including: an acquisition module, a parsing module, a calculation module, a construction module and a generation module, the acquisition module is used to obtain the designed protocol hierarchy diagram; the parsing module adopts a hierarchy diagram parsing engine to parse the protocol hierarchy diagram, obtains the association and key content of the field values ​​between the layers and within the layer, and adopts a protocol design document engine to parse the protocol design document to obtain a field set; the calculation module takes the bit width of the data type in the Wireshark plug-in as a reference set, processes the field bit width according to the protocol field splitting algorithm, and marks the field type and mask to obtain a field set mask; the construction module is used to construct a plug-in element according to the field set mask; the generation module generates a protocol parsing plug-in according to the hierarchy diagram, the protocol design document and the plug-in element.

[0032] Among them, the key content includes field name, associated fields and values, and the field set includes field name, starting bit width and bit width information.

[0033] The calculation module includes a reference set unit, a reference splitting unit and a compensation splitting unit. The reference set unit is used to use the bit width of the uint8, uint16, uint24, uint32, and uint64 data types in the Wireshark plug-in as the reference set A to obtain , initialize the field stack S, which is used to store the field set to be calculated; When the benchmark splitting unit is used to push the protocol fields into the stack S in sequence, the formula for calculating the total amount of fields in the stack S is: , Where n is the number of fields in stack S; like When , the fields in stack S are not split, stack S is set to empty and total is set to 0; like When , the top field of the stack is split. If the bit width of the top field of the stack is represented by x, and the number of split segments is represented by n, the calculation expression of the bit width of each segment f (n) is:

[0034] in, is the bit width of the 0th field, is the bit width of the nth field, is the largest value in the benchmark set A.

[0035] The compensation splitting unit is used to determine whether the bit width y meets the condition: ; If it is satisfied, the compensation splitting algorithm is used, where the number of split segments is represented by n, and the calculation expression of the bit width of each segment f (n) is: .

[0036] The calculation module also includes a marking unit, which is used to mark the type and mask of the field, specifically including: after calculating the total amount of fields in the stack S, if , the stack field shared data type is total, the field elements in the stack from the bottom to the top of the stack, in order to occupy the data type bit interval bits are all 1, the mask of the field is 1, the data type and mask as the new attributes of the field, at the same time stack S, total is reset, and the next round of calculation, if When , the field elements in the stack are maintained and wait for new fields to be pushed into the stack.

[0037] The specific methods of the building module to build plug-in elements based on the field set mask include: Complete the plug-in field definition according to the field name, data type and mask attribute in the protocol field; generate the logical judgment conditions of the protocol layer according to the protocol layer relationship diagram and associated fields, and supplement the logical judgment conditions of the fields at this layer; The fields are added to the entire protocol chain in sequence according to the field bit offset.

[0038] The embodiment of the present invention provides a Wireshark message parsing plug-in generation system. First, the plug-in is automatically generated through the plug-in Python program instead of directly writing the Lua program, which reduces the threshold for plug-in development; secondly, the protocol plug-in design process is simplified through the protocol layer relationship diagram method, making the protocol plug-in implementation logic clearer; then, the protocol field splitting algorithm is introduced to solve the pain points of complex and diverse protocol design and uncertain fields. Finally, the method is transparent to the protocol. For the logical adjustment and field change of the protocol design, it only needs to adjust the protocol design document to regenerate the protocol plug-in, truly realizing the plug-in plug-in.

[0039] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for generating a Wireshark message parsing plug-in, characterized in that: include: Get the designed protocol hierarchy diagram; The hierarchical relationship diagram parsing engine is used to parse the protocol hierarchical relationship diagram to obtain the association and key content of field values ​​between levels and within the current layer. The protocol design document engine is used to parse the protocol design document to obtain the field set. The bit width of the data type in the Wireshark plug-in is used as a benchmark set, the field bit width is processed according to the protocol field splitting algorithm, and the field type and mask are marked to obtain the field set mask; Build plugin element based on fieldset mask; Generate a protocol parsing plug-in based on the hierarchical relationship diagram, protocol design document, and plug-in elements.

2. The method according to claim 1, characterized in that The key content includes field name, associated fields and values, and the field set includes field name, starting bit width and bit width information.

3. The method according to claim 1, characterized in that The method of using the bit width of the data type in the Wireshark plug-in as the reference set specifically includes: using the bit width of the uint8, uint16, uint24, uint32, and uint64 data types in the Wireshark plug-in as the reference set A, obtaining , initialize the field stack S, which is used to store the field set to be calculated; The processing of the field bit width according to the protocol field splitting algorithm includes a benchmark splitting method, specifically including: When the protocol fields are pushed into stack S in sequence, the formula for calculating the total amount of fields in stack S is: ， Where n is the number of fields in stack S; like When , the fields in stack S are not split, stack S is set to empty and total is set to 0; like When , the top field of the stack is split. If the bit width of the top field of the stack is represented by x, and the number of split segments is represented by n, the calculation expression of the bit width of each segment f (n) is: ； in, , is the bit width of the 0th field, is the bit width of the nth field, is the largest value in the benchmark set A.

4. The method according to claim 3, characterized in that The processing of the field bit width according to the protocol field splitting algorithm includes a compensation splitting method, which specifically includes: Determine whether the bit width y meets the conditions: ； If it is satisfied, the compensation splitting algorithm is used, where the number of split segments is represented by n, and the calculation expression of the bit width of each segment f (n) is: 。 5. The method according to claim 3, characterized in that: The specific method of marking the type and mask of the field includes: After calculating the total amount of fields in stack S, if When , the stack field shared data type is total, and the field elements in the stack occupy the data type bit interval bits in order from the bottom of the stack to the top of the stack, and all the bits are 1. The mask of the field is 1, and the data type and mask are used as the new attributes of the field. At the same time, the stack S and total are reset, and the next round of calculation is performed; like , the field elements in the stack remain and wait for new fields to be pushed into the stack.

6. The method according to claim 5, characterized in that The specific method of constructing a plug-in element according to a field set mask includes: Complete the plug-in field definition based on the field name, data type, and mask attributes in the protocol field; According to the protocol layer relationship diagram and associated fields, generate the logical judgment conditions of the protocol layer and supplement the logical judgment conditions of the fields in this layer; The fields are added to the entire protocol chain in sequence according to the field bit offset.

7. A Wireshark message parsing plug-in generation system, characterized in that: include: Get module, parse module, calculate module, build module and generate module, The acquisition module is used to acquire the designed protocol level relationship diagram; The parsing module uses a hierarchical relationship diagram parsing engine to parse the protocol hierarchical relationship diagram to obtain the association and key content of field values ​​between levels and within the current layer, and uses a protocol design document engine to parse the protocol design document to obtain a field set; The calculation module uses the bit width of the data type in the Wireshark plug-in as a reference set, processes the field bit width according to the protocol field splitting algorithm, and marks the type and mask of the field to obtain a field set mask; The building module is used to build a plug-in element according to the field set mask; The generation module generates a protocol parsing plug-in according to the hierarchical relationship diagram, the protocol design document and the plug-in elements.

8. The system according to claim 7, characterized in that The key content includes field name, associated fields and values, and the field set includes field name, starting bit width and bit width information.

9. The system according to claim 8, characterized in that The calculation module includes a reference set unit, a reference splitting unit and a compensation splitting unit. The reference set unit is used to use the bit width of the uint8, uint16, uint24, uint32, and uint64 data types in the Wireshark plug-in as a reference set A to obtain , initialize the field stack S, which is used to store the field set to be calculated; When the benchmark splitting unit is used to push the protocol fields into the stack S in sequence, the formula for calculating the total amount of fields in the stack S is: ， Where n is the number of fields in stack S; like When , the fields in stack S are not split, stack S is set to empty and total is set to 0; like When , the top field of the stack is split. If the bit width of the top field of the stack is represented by x, and the number of split segments is represented by n, the calculation expression of the bit width of each segment f (n) is: ； in, , is the bit width of the 0th field, is the bit width of the nth field, is the largest value in the benchmark set A; The compensation splitting unit is used to determine whether the bit width y meets the condition: ； If it is satisfied, the compensation splitting algorithm is used, where the number of split segments is represented by n, and the calculation expression of the bit width of each segment f (n) is: 。 10. The system according to claim 9, characterized in that The calculation module also includes a marking unit, which is used to mark the type and mask of the field, specifically including: after calculating the total amount of fields in the stack S, if , the stack field shared data type is total, the field elements in the stack from the bottom to the top of the stack, in order to occupy the data type bit interval bits are all 1, the mask of the field is 1, the data type and mask as the new attributes of the field, at the same time stack S, total is reset, and the next round of calculation, if , the field elements in the stack remain and wait for new fields to be pushed into the stack.

Images