{"id":13774662,"url":"https://github.com/cloudshark/wireshark-plugin","last_synced_at":"2025-05-11T06:33:29.743Z","repository":{"id":47440606,"uuid":"42529687","full_name":"cloudshark/wireshark-plugin","owner":"cloudshark","description":"Upload captures directly to CloudShark from Wireshark","archived":false,"fork":false,"pushed_at":"2022-07-20T21:51:50.000Z","size":42,"stargazers_count":39,"open_issues_count":0,"forks_count":8,"subscribers_count":10,"default_branch":"master","last_synced_at":"2024-11-17T09:39:34.319Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://www.cloudshark.org","language":"Lua","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cloudshark.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-09-15T15:51:36.000Z","updated_at":"2024-08-12T19:19:16.000Z","dependencies_parsed_at":"2022-09-23T03:28:08.051Z","dependency_job_id":null,"html_url":"https://github.com/cloudshark/wireshark-plugin","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cloudshark%2Fwireshark-plugin","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cloudshark%2Fwireshark-plugin/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cloudshark%2Fwireshark-plugin/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cloudshark%2Fwireshark-plugin/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cloudshark","download_url":"https://codeload.github.com/cloudshark/wireshark-plugin/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253528415,"owners_count":21922623,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-03T17:01:29.080Z","updated_at":"2025-05-11T06:33:29.389Z","avatar_url":"https://github.com/cloudshark.png","language":"Lua","funding_links":[],"categories":["\u003ca id=\"6fa0e0d1f898fba299b2566a33602841\"\u003e\u003c/a\u003eWireshark","Lua"],"sub_categories":[],"readme":"# CloudShark Plugin for Wireshark\nThe CloudShark Plugin for Wireshark makes it seamless to move your \ncapture files from Wireshark to a CloudShark appliance or \n\u003chttps://www.cloudshark.org\u003e. Once installed, the plugin adds a new \n**CloudShark** submenu under the existing Wireshark **Tools** menu. \nCapture files are sent to the configured CloudShark appliance or \n\u003chttps://www.cloudshark.org\u003e by selecting the upload option under the \n**Tools \u003e CloudShark** menu. The plugin also works with tshark from the command-line.\n\n## Requirements\n\nThe CloudShark plugin requires Wireshark version 1.4 or newer. The \nplugin uses Wireshark's Lua scripting interface and runs on all \nplatforms supported by Wireshark, provided the Lua interface has been \nenabled. Systems must also contain a recent version of [curl](http://curl.haxx.se/).\n\n## Installation\n\nThe plugin should be installed in your Wireshark Lua plugin directory.\n\nYou can find your Wireshark plugin directory by opening Wireshark and\ngoing to `Help \u003e About Wireshark` and clicking on the `Folders` tab. \nThe `Personal Lua Plugins` directory should be used to install the\nCloudShark Wireshark plugin to allow users to configure their own API\nTokens.\n\nYou can install the CloudShark Wireshark plugin by cloning this\nrepository into a directory named `cloudshark` in your Wireshark plugins\nfolder.\n\nTo do that on Unix-like systems, such as Linux, OS X, \\*BSD, Solaris,\nAIX, and HP-UX, from the command line:\n\n1. If the path displayed as your `Personal Lua Plugins` directory doesn't\nexist, create it with `mkdir -p \u003cpath\u003e`.\n2. Change to that directory with `cd \u003cpath\u003e`\n3. Clone the repository with\n```\ngit clone https://github.com/cloudshark/wireshark-plugin.git cloudshark\n```\n\nAlternatively you can download the [zip file](https://github.com/cloudshark/Wireshark-plugin/archive/master.zip)\nand extract the contents of the `wireshark-plugin-master` folder into a folder\nnamed `cloudshark` in your Wireshark Personal Lua plugins directory.\n\n\u003e **Note**\n\u003e \n\u003e You **must** name the folder that the plugin resides in \"cloudshark\".\n\nAfter cloning the git repository or unzipping the archive you must copy the\ndefault configuration, `cloudshark.default`, to `cloudshark.config`.\n\n**Running as root or admin:** If you are running Wireshark as root or \nadmin, you may need to enable support for Lua scripts by modifying your \n/etc/Wireshark/init.lua script and setting the \n**runuser_scripts_when_superuser** field to true.\n\n```bash\nrun_user_scripts_when_superuser = true\n```\n\nRather than running as root or admin, try \n[enabling capture privileges](http://wiki.wireshark.org/CaptureSetup/CapturePrivileges)\nfor the user running Wireshark.\n\n## Installing cURL on Windows\n\nThe CloudShark plugin requires [cURL](https://curl.haxx.se/) which is not \ninstalled by default on Windows. For an easy to use installation program use\n[this installer](http://www.confusedbycode.com/curl/). Note that you may have\nto logout and log back into Windows after running this installer for the plugin\nto work properly.\n\n## Configuration\n\nBy default, the plugin is configured to work with\n\u003chttps://www.cloudshark.org\u003e.  You must modify the plugin configuration\nfile to work with your own CloudShark appliance.  The configuration file\nis installed as `cloudshark.config` in the `cloudshark` directory in\nyour Wireshark plugin directory.  The configuration file can be edited\nright through Wireshark by selecting **Tools \u003e CloudShark \u003e\nPreferences**.  This menu option will open the current configuration\nfile in a text window that you may edit.  After modifying the\nconfiguration file, be sure to save it before closing the window.\n\nIf you are using \u003chttps://www.cloudshark.org\u003e you will have to modify\nthe `CLOUDSHARK_API_KEY` to match your API token. This can be found by\nlogging into \u003chttps://www.cloudshark.org\u003e and clicking on\n`Preferences \u003e API Tokens`.\n\nThe following configuration variables are defined. The configuration \nfile is a Lua file that must conform to the Lua syntax. If a syntax \nerror is created, Wireshark will raise a Lua exception during the next \nupload. The configuration is reloaded before every new upload.\n\n```text\n--[[\nThis is the configuration file for the CloudShark plugin.\nVisit https://support.cloudshark.org for additional help.\n--]]\n\n-- To disable the CloudShark plugin,\n-- set the CLOUDSHARK_ENABLE setting to \"n\".\nCLOUDSHARK_ENABLE = \"y\"\n\n-- URL:  The CloudShark appliance URL\nCLOUDSHARK_URL = \"https://www.cloudshark.org\"\n\n-- API:  The API token to use\nCLOUDSHARK_API_KEY = \"\u003cINSERT API TOKEN HERE\u003e\"\n\n-- Tags: A comma separated list of tags\nCLOUDSHARK_TAGS = \"\"\n\n-- User: The user name (only if login is required)\nCLOUDSHARK_USER = \"\"\n\n-- Password: The password (only if login is required)\nCLOUDSHARK_PASSWORD = \"\"\n\n-- Tshark: To enable tshark support for the plugin,\n-- set the CLOUDSHARK_TSHARK setting to \"y\" for auto\n-- mode or \"prompt\" for prompting mode.\nCLOUDSHARK_TSHARK = \"n\"\n\n-- Curl: The path to curl if non-standard\n-- Paths should be formatted with [[path]]\n-- Remove the -- below to uncomment\n-- CLOUDSHARK_CURL = [[C:\\example\\curl.exe]]\n\n-- CA Bundle: The path to an alternative CA bundle file in pem format\n-- Paths should be formatted with [[path]]\n-- Remove the -- below to uncomment\n-- CLOUDSHARK_CABUNDLE = [[C:\\example\\curl-ca-bundle.crt]]\n\n-- Certificate verification: You can disable certificate verification\n-- by setting CLOUDSHARK_CERT_VERIFY to \"n\". This will use\n-- curl's --insecure option.\n-- CLOUDSHARK_CERT_VERIFY = \"n\"\n\n-- When used from Wireshark, the plugin will attempt\n-- to open a brower and load CloudShark after a capture\n-- is uploaded. You can set CLOUDSHARK_OPEN_BROWSER to\n-- \"n\" to disable this behavior.\nCLOUDSHARK_OPEN_BROWSER = \"y\"\n```\n\nThese options are defined as:\n\n* **CLOUDSHARK_ENABLE:** The CLOUDSHARK_ENABLE entry controls the \nstatus of the Lua plugin. By default the plugin is active. You can turn off\nthe plugin by setting this value to \"n\".\n\n* **CLOUDSHARK_URL:** The CLOUDSHARK_URL entry contains the URL used to \nreach your CloudShark appliance. It must also contain desired http or \nhttps transport.\n\n* **CLOUDSHARK_API_KEY:** The CLOUDSHARK_API_KEY entry \ncontains the API key for your CloudShark appliance. \n\n* **CLOUDSHARK_TAGS:** The CLOUDSHARK_TAGS entry is used to specify tags \nthat should be applied to every Wireshark upload. Tags must be comma \nseparated. Additional tags can also be specified at upload time in the \nUpload GUI. Useful tags include location information, device \ninformation, and security information.\n\n* **CLOUDSHARK_USER:** The CLOUDSHARK_USER entry is required when the API \nkey also requires user authentication. NOTE: The default API keys for \n\u003chttps://www.cloudshark.org\u003e do not require user authentication.\n\n* **CLOUDSHARK_PASSWORD:** The CLOUDSHARK_PASSWORD entry is required when \nthe API key also requires user authentication. This entry must contain \nthe password. NOTE: The default API keys for \u003chttps://www.cloudshark.org\u003e do not \nrequire user authentication.\n\n* **CLOUDSHARK_TSHARK:** The CLOUDSHARK_TSHARK entry is used to enable the \nCloudShark plugin for tshark. By default, the plugin does not perform \nany uploads when tshark is used. You can enable tshark support by \nsetting this value to \"y\" for automatic uploads or \"prompt\" to prompt \nthe user before uploading.\n\n* **CLOUDSHARK_CURL:** The CLOUDSHARK_CURL entry is used to specify the \ncommand path to curl. By default, the plugin executes curl which must be \nin the path for the user running Wireshark. Paths should be entered \nusing Lua's [[ ]] notation rather than using double quotes.\n\n* **CLOUDSHARK_CABUNDLE:** The CLOUDSHARK_CABUNDLE entry is used to specify \nan alternative CA file. Paths should be entered using Lua's [[ ]] notation \nrather than using double quotes.\n\n* **CLOUDSHARK_CERT_VERIFY:** The CLOUDSHARK_CERT_VERIFY entry is used \nto enable or disable certificate verification. By default, the plugin will attempt\nto verify the CloudShark server's extension when using https URLs. You can turn\noff certificate verification by setting this value to \"n\". When disabled, the\nplugin using curl's --insecure option.\n\n* **CLOUDSHARK_OPEN_BROWSER:** The CLOUDSHARK_OPEN_BROWSER entry is used \nto enable or disable launching of a web browser when using the Wireshark GUI. \nBy default, the plugin will launch your local browser after uploading a capture\nfile to CloudShark. You can disable this behavior by setting this option to\n\"n\".\n\n## Uploading\n\nA capture file can be uploaded by selecting the **Upload** option from \nthe **Tools \u003e CloudShark** menu. Capture files can be uploaded when a \nlive capture is still in progress or stop the capture before the upload. \nIf you upload a live capture, any new packets that arrive while the upload \nis happening may not be included. For precise results, we recommend that \nyou stop a live capture before uploading.\n\nThe Upload dialog provides additional options for adding tags and naming \nyour capture file. Both of these entries are optional. Any tags \nspecified will be added in addition to any tags configured with the \nCLOUDSHARK_TAGS option. If a new name is specified, the plugin will \ncopy the capture file to this name before uploading. The name field \nshould also contain the desired extension such as .cap or .pcap. If no \nname is specified, the file name used in the CloudShark session is OS \ndependent.\n\nA progress dialog will appear once an upload is started. At the \ncompletion of the upload, Wireshark will open another status dialog with \neither the location of the CloudShark session URL or an error \nindication. If the upload is successful, CloudShark will also attempt to \nopen the CloudShark session URL using the default browser.\n\n## Using Other Certificates\n\nBy default the CloudShark plugin will verify certificates using the systems\npreloaded root certificates. If you need to use a different CA file to verify \nyour CloudShark appliance, you can specify the path to a local CA file that \ncontains the required CA certificates in PEM format. For example:\n\n``` text\nCLOUDSHARK_CABUNDLE = \"/home/fred/my-ca.crt\"\n```\n\n## Tshark Support\n\nThe plugin supports both the Wireshark GUI and tshark. To enable tshark \nsupport, configure the CLOUDSHARK_TSHARK setting to either **y** or \n**prompt**. The same configuration file is used for both Wireshark and \ntshark. When CLOUDSHARK_TSHARK is set to \"y\", the plugin will \nautomatically upload the current capture file to CloudShark. When \nCLOUDSHARK_TSHARK is set to \"prompt\", the user will be prompted to \nconfirm the upload. The capture file will not be uploaded in \"prompt\" \nmode unless the user specically enters \"y\" at the prompt.\n\n### Tshark Example\n\n``` text\ntshark -i eth0 -q -c 5 \nCloudShark plugin for Wireshark (c) 2012\nVersion 1.0 rev 136\nDeveloped by QA Cafe\nCapturing on eth0\n5 packets captured\n\nUploading capture file to CloudShark via http://172.16.1.137\n  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\n                                 Dload  Upload   Total   Spent    Left  Speed\n100  5048    0    66  100  4982    238  18007 --:--:-- --:--:-- --:--:-- 18050\n\nHTTP Response Code: 200\nA new CloudShark session has been created at:\n\nhttp://172.16.1.137/captures/7d1e5e2645b3\n```\n\n## Security\n\nUse of https uploads is recommended. The CloudShark plugin will always \nupload via https when the CLOUDSHARK_URL is specified using https. The \ndefault configuration for \u003chttps://www.cloudshark.org\u003e defaults to https.\n\n## Default Browser\n\nThe CloudShark plugin will open new CloudShark session URLs using the \nsystem's default browser. We recommend setting up your system with an \nupdated version of one of the modern browsers as your default. This will \nmaximize your CloudShark experience. The latest version of Chrome or \nSafari is recommended.\n\n## Disk Space\n\nThe plugin uses the `cloudshark` directory in your Wireshark plugin\ndirectory for working disk space.  You must have enough disk space in\nthis directory to support your captures.  A good rule of thumb is to\nallocate three times as much disk space as your largest desired capture\nfile.  The plugin manages the capture files automatically.\n\n## Errors\n\nIt is possible that an upload will fail. If the upload does fail, an \nerror message will be reported. Some possible errors include:\n\n* Invalid CLOUDSHARK_URL\n* Invalid API Key\n* Authentication failure\n* Capture file is too big\n\n## Upgrades\n\nThe plugin can safely be upgraded to a new version if available. By \ndefault, the installer will not overwrite any existing configuration \nfile. Your configuration will be preserved if you have configured your \nplugin to work with a specific CloudShark appliance.\n\n## Uninstall\n\nThe plugin can be removed by deleting the `cloudshark` directory in your\nWireshark plugin directory.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcloudshark%2Fwireshark-plugin","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcloudshark%2Fwireshark-plugin","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcloudshark%2Fwireshark-plugin/lists"}