wsdf (Wireshark Dissector Framework) is a proc-macro based framework to generate Wireshark dissectors from your Rust data types. Using wsdf, you can write dissectors in a declarative way, all from within Rust.
Here is what a dissector for UDP looks like:
#[derive(wsdf::Protocol)]
#[wsdf(decode_from = [("ip.proto", 17)])]
struct UDP {
src_port: u16,
dst_port: u16,
length: u16,
checksum: u16,
#[wsdf(subdissector = ("udp.port", "dst_port", "src_port"))]
payload: Vec<u8>,
}
Check out the docs for more information. Some examples are also available, including a simple dissector for DNS, showcased below.
wsdf has been tested on Linux against Wireshark 4.0.
License
Licensed under either of Apache License, Version 2.0 or MIT license at your option.Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in this crate by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.