wirshark解析自定义协议，并且从自定义协议截取部分字段保存文件

1.将自定义协议由wirshark解析

--myprotocol.lua

do
	local p_my_proto = Proto("mw", "mw")
	
	--定义header头的结构
	local f_header_id = ProtoField.uint8("id", "id", base.HEX) --头id 4字节
	--local f_header = ProtoField.uint8("my_proto.header","header", base.HEX)
	local f_header = ProtoField.bytes("header","header", base.DOT)
	local f_reserve = ProtoField.bytes("reserve","reserve", base.DOT) -- 保留字，4字节
	local f_data = ProtoField.bytes("payload", "payload",base.NONE) --h265 payload
	
	p_my_proto.fields = {f_header_id, f_header, f_reserve, f_data}
	
	--获取data解析器
	local data_dis = Dissector.get("data")
	
	local function mlw_dissector(buf, pkt,root)
		local buf_len = buf:len()
		if buf_len < 16 then return false end
		
		--自定义各个字段的长度
		local len_header_id = 4
		local len_reserve = 4
		local len_header = 24
		local len_data = buf_len-len_header_id-len_header-len_reserve
		local v_header_id = buf(0,len_header_id)
		
		--判断起始码是否符合
		if(v_header_id:uint()~=0x4d583144)
		then return false end
		
		--把data中的buf，放入对应的字段中
		local start_pos = len_header_id
		local v_header = buf(start_pos,len_header)
		start_pos = start_pos + len_header
		local v_reserve = buf(start_pos,len_reserve)
		start_pos = start_pos + len_reserve
		local v_data = buf(start_pos, len_data)
		
		--buf关联自定义的协议
		local t = root:add(p_my_proto, buf)
		
		pkt.cols.protocol = "mw"
		t:add(f_header_id, v_header_id)
		t:add(f_header, v_header)
		t:add(f_reserve, v_reserve)
		t:add(f_data, v_data)
		return true
	end
	
	--当目标符合要求时，自动显示
	function p_my_proto.dissector(buf, pkt, root)
		if mlw_dissector(buf, pkt, root) then
		else
			--当不是自己的协议，调用data
			data_dis:call(buf, pkt, root)
		end
	end
	
	local udp_encap_table = DissectorTable.get("udp.port")
	udp_encap_table:add(5061, p_my_proto)
end

2.通过在工具菜单下，加入一个菜单项目，将自定义协议中的payload提取后，保存为原始数据

--[[
	myprotocol_extractor.lua	
	从自定义的协议中，取出payload字段，写入文件中
 *]]
 
 
do
    local mw_payload = Field.new("payload")
    
    local function extract_h265_from_mw()
        local function dump_filter(fd)
            local fh = "mw";
            if fd ~= nil and fd ~= "" then
                return string.format("%s and (%s)", fh, fd)
            else    
                return fh
            end
        end

	--Listener用来设置一个监听条件，当条件发生时，执行定义的动作
        local mw_tap = Listener.new("ip", "mw")
        local text_window = TextWindow.new("mlw extractor")
        local fp = io.open("dump.h265", "wb")
        local seq_payload_table = { }
        local packet_count = 0
        local max_packet_count = 0;
        local pass = 0;
    
        local function log(info)
            text_window:append(info)
            text_window:append("\n")
        end
        
        local function remove() 
            if fp then 
                fp:close()
                fp = nil
            end
            mw_tap:remove()
        end
		
        local function on_opus_payload(seq, payload)
            table.insert(seq_payload_table, { key = tonumber(seq.value), value = payload.value })
        end
        
        
        function mw_tap.packet(pinfo, tvb)
            local payloadTable = { mw_payload() } 
            --local seqTable = { rtp_seq() }
            
            
            if pass == 0 then 
                for i, payload in ipairs(payloadTable) do
                    max_packet_count = max_packet_count + 1
                end
            else
                for i, payload in ipairs(payloadTable) do
					if payload.len < 20 then
						return
					end
					
                    packet_count = packet_count + 1
					local payload_data = payload.value --is ByteArray
					fp:write(payload_data:tvb()():raw())--把原始数据写到文件中
                end
                
            end 
        end
        
        function mw_tap.reset()
        end
		
        function mw_tap.draw() 
        end
        
        log("Start")
		
        text_window:set_atclose(remove)
        
        pass = 0
        retap_packets()
        log("phase 1 max_packet_count = "..tostring(max_packet_count))
        
        pass = 1
        retap_packets()
        
        log("End")
        
    end
  
    register_menu("Extract h265 stream from mw", extract_h265_from_mw, MENU_TOOLS_UNSORTED)
end