A collection of useful Wireshark/tshark plugins
git clone --recursive https://github.com/phreakocious/plugin-shark ~/.local/lib/wireshark/plugins/plugin-sharkWireshark loads every .lua file under its personal Lua plugin folder, subfolders included. Help → About Wireshark → Folders shows where that folder is on your system.
./check.sh installs the repo into a throwaway plugin folder. It fails if a plugin does not load, or raises a Lua error while dissecting test.pcap (TCP, HTTP and TLS over loopback, starting mid-stream). Last passed on Wireshark 4.6.6 (Lua 5.5).
| PLUGIN | WHAT IT ADDS | SOURCE | CHECKED |
|---|---|---|---|
| gd_l4 | L4 stream index and protocol name, for one column across all protocols | gr8drag1/gd_l4, vendored | dissects test.pcap |
| gd_tcflag | Per-TCP-conversation flags and stats, so a display filter can select whole streams | gr8drag1/gd_tcflag r27, vendored | dissects test.pcap |
| TCPextend | Bytes in flight, bytes since push and per-sender delta on every packet | gaddman/wireshark-tcpextend, vendored | dissects test.pcap |
| TLSextend | TLS handshake state per TCP stream: TLSextend.state==1 finds a ClientHello that got no ServerHello |
syn-bit/TLSextend, vendored | dissects test.pcap |
| http-extra | Request method, URI and host on each HTTP response; full URL on both | shomeax/wireshark-http-extra, vendored | dissects test.pcap |
| Cap'n Proto RPC | Cap'n Proto RPC dissector | kaos/wireshark-plugins, submodule | loads |
| Lync / Skype for Business | MS-TURN, ICE and RTP/RTCP for Lync and Skype for Business | James Cussen, v2.0.0 (original pages are gone) | loads |
| MPEG2 TS dump | Tools → Dump MPEG TS Packets writes MPEG TS packets to a file (GUI only) | Cisco | loads |
| TCP statistics | Per-stream TCP report: MSS, window scaling, SACK, iRTT, worst delta and window | Wireshark wiki | runs on test.pcap |
Vendored means copied into this repo and patched where Wireshark 4.x needed it. The first line of each vendored file names its upstream commit; git log has the changes. Every third-party file keeps its author's license: GPL for the vendored plugins; the Lync plugin's header forbids commercial use without its author's consent; the MPEG dump and TCP statistics scripts state no license. The BSD-2-Clause LICENSE covers only what this repo adds: check.sh, test.pcap, this README and preferences.plugin-shark.
In tshark, TCPextend and TLSextend fill their fields on the second pass. Use -2 -R frame: without a read filter, tshark's first pass gives Lua plugins no field values.
TCP statistics prints a report, so it would print into every tshark run if Wireshark auto-loaded it. Its file name does not end in .lua, so run it on demand:
tshark -o tcp.calculate_timestamps:TRUE -q -n -X lua_script:tcp_stats.lua.disabled -r capture.pcapngpreferences.plugin-shark is a Wireshark preferences file. Its "host" column uses http_resp.host from http-extra.
NMEA 0183, Redis (RESP), IEEE 1905.1a, MQTT, DoIP, DLMS, protobuf, and SAP's NI, Router, Diag, Message Server, Enqueue, IGS, SNC and HDB protocols. Pyreshark is gone too (archived in 2015).
Disclaimer: plugins listed below have not been tested!
| PLUGIN | DESCRIPTION |
|---|---|
| Aerospike Plugin | Plugin to interpret Aerospike wire protocol |
| Apple Continuity | Apple Continuity protocol dissector (C) |
| Chromium IPC Sniffer | Capture and dissect messages between Chromium processes (Windows) |
| CITP-Dissector | Wireshark CITP Lua Dissector |
| Cloudshark Plugin | Upload captures directly to CloudShark from Wireshark |
| Edgeshark | Extcap: live capture from containers and pods (Linux, Windows) |
| FoxIO JA4+ | JA4S, JA4H, JA4L, JA4X, JA4SSH, JA4T and JA4D fingerprints (Wireshark has JA3 and JA4 built in). Native: prebuilt for macOS arm64, Linux, Windows; FoxIO license |
| FRITZ!Box extcap | Extcap: capture from FRITZ!Box routers |
| h264extractor | Extract H.264 or opus stream from rtp packets |
| HEP Wireshark | Wireshark Dissector for the HEP Encapsulation Protocol |
| Inspektor Gadget extcap | Extcap: capture from Kubernetes pods |
| KDNET Debugger | Windows Kernel Debugger over Network |
| KSNIFF | Kubectl plugin to ease sniffing on Kubernetes pods using tcpdump and Wireshark |
| Open Drone ID | Drone Remote ID broadcast dissector |
| RFC8450 VC2 Dissector | Wireshark plugin to parse RTP streams implementing the VC-2 HQ payload specification |
| RSocket | Wireshark/tshark Plugin in C for RSocket & supports all RSocket frames, except resumption |
| RTP Video and Audio Dissector Wireshark Plugin | Wireshark plugin for H.265, H.264, PS, PCM, AMR, and SILK Codecs by hongch911 |
| STOMP Dissector | STOMP dissector for Wireshark |
| suriwire | Displays Suricata analysis info |
| Telegram MTProto | Telegram MTProto dissector |
| Wireshark Plugin AFDX | AFDX protocol dissector for Wireshark |
| WiresharkLIFXDissector | Dissects packets of the LIFX LAN Protocol |