benluiwj / wsdf

Wireshark Dissector Framework

wsdf (Wireshark Dissector Framework) is a proc-macro based framework to generate Wireshark dissectors from your Rust data types. Using wsdf, you can write dissectors in a declarative way, all from within Rust.

Here is what a dissector for UDP looks like:

#[derive(wsdf::Protocol)]
#[wsdf(decode_from = [("ip.proto", 17)])]
struct UDP {
    src_port: u16,
    dst_port: u16,
    length: u16,
    checksum: u16,
    #[wsdf(subdissector = ("udp.port", "dst_port", "src_port"))]
    payload: Vec<u8>,
}

Check out the docs for more information. Some examples are also available, including a simple dissector for DNS, showcased below.

wsdf has been tested on Linux against Wireshark 4.0.

License

^{Licensed under either of Apache License, Version 2.0 or MIT license at your option.}
_{Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in this crate by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.}