0

I was attempting to use the ZMTP Wireshark Dissector with my current copy of Wireshark (v4.0.6) which uses Lua 5.2.4 on my Ubuntu 20.04 machine to dissect zeromq.

I put the lua file in the proper place for Wireshark, and when I start wireshark it obviously sees it, but it throws an "attempt to index global 'ftypes' (a nil value)" error.

screenshot of error

To me, this means that the Lua dissector was not happy with the code itself (so not a Wireshark problem per say, but a Lua one). The repo this dissector came from was last updated in 2020, so I am guessing that something small has been updated on the Lua side and has caused the code to not keep pace.

I believe there are only a handful of lines that matter for this error, and they are:

-- zmq protocol example
-- declare our protocol
local zmtp_proto = Proto("zmtp", "ZMTP", "ZeroMQ Message Transport Protocol")

-- setup protocol fields.

vs_stype = {
    [0] = "pair",
    [1] = "publish",
    [2] = "subscribe",
    [3] = "request",
    [4] = "reply",
    [5] = "dealer",
    [6] = "router",
    [7] = "pull",
    [8] = "push"
}

zmtp_proto.fields = {}
local fds = zmtp_proto.fields
fds.greeting = ProtoField.new("Signature", "zmtp.greeting", ftypes.BYTES)

With that last line being like 41 that was referenced in the error message. Is there some way that these Lua proto fields should be setup differently?

I have tried making the suspect line a local and taking away the fds, but that seemed to not help any.

Jason
  • 3
  • 2

1 Answers1

2

The ftypes table is defined in the init.lua file, which should be installed in the Wireshark "global installation directory".

Does your system have that file?

Christopher Maynard
  • 5,702
  • 2
  • 17
  • 23
  • Good catch. I see that I have a /usr/share/wireshark/init.lua, but it is an empty file. Is it safe to pull that file from another machine? Or do I need to have it built/configured somehow locally? – Jason Jun 21 '23 at 19:21
  • 1
    It should be safe, but I'd try to get one from a machine with the same version of Wireshark (v4.0.6), just in case there have been changes. You might want to investigate why the file is empty though, as obviously it shouldn't be. Possibly reinstalling Wireshark might be another option? – Christopher Maynard Jun 21 '23 at 19:23