wireshark解析达梦数据库协议

大梦数据库不开源，所以wireshark没有相应的协议分析，但在实际工作中，我们需要掌握包来验证程序处理过程是否正确。为了便于验证，我们手拉了一个梦想分析脚本。

先展示一下分析结果：

解析脚本：dameng.lua

dameng_protocol = Proto("Dameng", "Dameng Protocol")  local head_packet_type_desc = {     [0x01]  = "Login",     [0x05]  = "SQL Request",     [0xa3]  = "Login ACK",  [0xbb]  = "Response",     [0xc8]  = "Version",  [0xe4]  = "Version", }  local DAMENG_ie = {  head_packet_type = ProtoField.uint16("dameng.head_packet_type", "HeadPacketType", base.HEX, head_packet_type_desc),  data_len = ProtoField.uint16("dameng.date_len", "DataLen", base.DEC), }  local login_ie = {  username_len = ProtoField.uint32("dameng.username_len", "UserNameLen", base.DEC),  username = ProtoField.bytes("dameng.username", "UserName"),  password_len = ProtoField.uint32("dameng.password_len", "PassWordLen", base.DEC),  password = ProtoField.bytes("dameng.password", "PassWord"),  client_name_len = ProtoField.uint32("dameng.client_name_len", "ClientNameLen", base.DEC),  client_name = ProtoField.string("dameng.client_name", "ClientName"),  system_name_len = ProtoField.uint32("dameng.system_name_len", "SystemNameLen", base.DEC),  system_name = ProtoField.string("dameng.system_name", "SystemName"),  host_name_len = ProtoField.uint32("dameng.host_name_len", "HostNameLen", base.DEC),  host_name = ProtoField.string("dameng.host_name", "HostName"), }  local loginACK_ie = {  db_name = ProtoField.string("dameng.db_name", "DataBaseName"),  username = ProtoField.string("dameng.username", "UserName"),  client_ip = ProtoField.string("dameng.client_ip", "ClientIP"),  link_time = ProtoField.string("dameng.link_time", "LinkTime"), }  local SQL_ie = {  sql_data = ProtoField.string("dameng.sql_data", "SQL data"), }  local Version_ie = {  clinet_version = ProtoField.string("dameng.client_version", "Client Version"),  server_version = ProtoField.string("dameng.server_version", "Server Version"), }  dameng_protocol.fields = {   ---------------DAMENG_ie----------------  DAMENG_ie.head_packet_type,  DAMENG_ie.data_len,  ---------------login_ie----------------  login_ie.username_len,  login_ie.username,  login_ie.password_len,  login_ie.password,  login_ie.client_name_len,  login_ie.client_name,  login_ie.system_name_len,  login_ie.system_name,  login_ie.host_name_len,  login_ie.host_name,  ---------------loginACK_ie----------------  loginACK_ie.db_name,  loginACK_ie.username,  loginACK_ie.client_ip,  loginACK_ie.link_time,  ---------------SQL_ie----------------  SQL_ie.sql_data,  ---------------Version_ie----------------  Version_ie.clinet_version,  Version_ie.server_version, }  function dameng_protocol.dissector(tvb, pinfo, tree)     length = tvb:len()     if length == 0 then         return     end     pinfo.cols.protocol = dameng_protocol.name  local offset = 0  local msg_len = 0       local subtree = tree:add(dameng_protocol, tvb(), "Dameng Protocol Data")  offset = offset   4  local headPacketType = tvb(offset,2):le_uint()  subtree:add_le(DAMENG_ie.head_packet_type, tvb(offset,2))  offset = offset   2  local dataLen = tvb(offset,2):le_uint() -- subtree:add_le(DAMENG_ie.data_len, tvb(offset,2))  offset = offset   2  if (headPacketType == 0x01) then  ----------------dissect login-------------------   offset = offset   56   ----------------dissect username-------------------   local usernameLen = tvb(offset,4):le_uint() --  subtree:add_le(login_ie.username_len, tvb(offset,4))     offset = offset   4   subtree:add(login_ie.username, tvb(offset, usernameLen))   offset = offset   usernameLen   ----------------dissect password-------------------   local passwordLen = tvb(offset,4):le_uint() --  subtree:add_le(login_ie.password_len, tvb(offset,4))   offset = offset   4     subtree:add(login_ie.password, tvb(offset, passwordLen))   offset = offset   passwordLen   ----------------dissect client_name-------------------   local clientNameLen = tvb(offset,4):le_uint() --  subtree:add_le(login_ie.client_name_len, tvb(offset,4))   offset = offset   4     subtree:add(login_ie.client_name, tvb(offset, clientNameLen))   offset = offset   clientNameLen   ----------------dissect system_name-------------------   local systemNameLen = tvb(offset,4):le_uint() --  subtree:add_le(login_ie.system_name_len, tvb(offset,4))   offset = offset   4     subtree:add(login_ie.system_name, tvb(offset, systemNameLen))   offset = offset   systemNameLen   ----------------dissect host_name-------------------   local hostNameLen = tvb(offset,4):le_uint() --  subtree:add_le(login_ie.host_name_len, tvb(offset,4))   offset = offset   4     subtree:add(login_ie.host_name, tvb(offset, hostNameLen))   offset = offset   hostNameLen     elseif (headPacketType == 0xa3) then  ----------------disect login ACK-------------------
		offset = offset + 72
		----------------dissect database name-------------------
		local dbNameLen = tvb(offset,4):le_uint()		
		offset = offset + 4
		subtree:add(loginACK_ie.db_name, tvb(offset, dbNameLen))
		offset = offset + dbNameLen
		----------------dissect user-------------------
		local userNameLen = tvb(offset,4):le_uint()
		offset = offset + 4		
		subtree:add(loginACK_ie.username, tvb(offset, userNameLen))
		offset = offset + userNameLen
		----------------dissect client_ip-------------------
		local clientIpLen = tvb(offset,4):le_uint()
		offset = offset + 4		
		subtree:add(loginACK_ie.client_ip, tvb(offset, clientIpLen))
		offset = offset + clientIpLen
		----------------dissect link time-------------------
		local linkTimeLen = tvb(offset,4):le_uint()
		offset = offset + 4		
		subtree:add(loginACK_ie.link_time, tvb(offset, linkTimeLen))
		offset = offset + linkTimeLen	
		
	elseif (headPacketType == 0x05) then
	----------------dissect SQL Request-------------------
		offset = offset + 56
		subtree:add(SQL_ie.sql_data, tvb(offset, dataLen))
	elseif (headPacketType == 0xc8) then
	----------------dissect Client Version-------------------
		offset = offset + 56
		local clientVersionLen = tvb(offset,4):le_uint()
--		subtree:add_le(login_ie.client_name_len, tvb(offset,4))
		offset = offset + 4		
		subtree:add(Version_ie.clinet_version, tvb(offset, clientVersionLen))
		offset = offset + clientVersionLen
	elseif (headPacketType == 0xe4) then
	----------------dissect Server Version-------------------
		offset = offset + 72
		local serverVersionLen = tvb(offset,4):le_uint()
--		subtree:add_le(login_ie.client_name_len, tvb(offset,4))
		offset = offset + 4		
		subtree:add(Version_ie.server_version, tvb(offset, serverVersionLen))
		offset = offset + serverVersionLen
	end
end

local tcp_port = DissectorTable.get("tcp.port")
tcp_port:add(5236, dameng_protocol)

下面说说怎么把解析脚本嵌到wireshark中：

将damen.lua文件放在wirekshark的安装目录，在wireshark的根目录中找到init.lua，打开后将文件中的enable_lua设置为true，并在init.lua文件中增加我们编写的lua脚本，使用的命令为dofile(DATA_DIR.."dameng.lua")。

 再次用wireshak打开达梦的包，就能看到解析内容了。

注意：脚本中默认的达梦数据库端口为5236，如果实际环境为其它端口，在脚本中做对应修改即可。