{"id":13774622,"url":"https://github.com/whitequark/zmtp-wireshark","last_synced_at":"2025-03-16T21:31:06.067Z","repository":{"id":16901189,"uuid":"19662082","full_name":"whitequark/zmtp-wireshark","owner":"whitequark","description":"A Wireshark dissector for ZMTP version 3.0 and later (ZeroMQ 4 and later)","archived":false,"fork":false,"pushed_at":"2024-04-02T16:38:35.000Z","size":313,"stargazers_count":88,"open_issues_count":4,"forks_count":23,"subscribers_count":10,"default_branch":"master","last_synced_at":"2025-03-11T04:53:51.992Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"http://rfc.zeromq.org/spec:23","language":"Lua","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":"iTXTech/Genisys","license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/whitequark.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2014-05-11T08:42:55.000Z","updated_at":"2024-12-11T01:20:16.000Z","dependencies_parsed_at":"2024-08-03T17:19:00.068Z","dependency_job_id":null,"html_url":"https://github.com/whitequark/zmtp-wireshark","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/whitequark%2Fzmtp-wireshark","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/whitequark%2Fzmtp-wireshark/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/whitequark%2Fzmtp-wireshark/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/whitequark%2Fzmtp-wireshark/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/whitequark","download_url":"https://codeload.github.com/whitequark/zmtp-wireshark/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243830949,"owners_count":20354854,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-03T17:01:28.760Z","updated_at":"2025-03-16T21:31:05.570Z","avatar_url":"https://github.com/whitequark.png","language":"Lua","funding_links":[],"categories":["\u003ca id=\"6fa0e0d1f898fba299b2566a33602841\"\u003e\u003c/a\u003eWireshark"],"sub_categories":[],"readme":"ZMTP Wireshark Dissector\n========================\n\nThis is a Lua dissector written for the ZMTP protocol. It supports both the \"new\" protocol (ZMTP\n[version 3.0][zmtp30] and later), as well as the older [version 2][zmtp2].\n\nIt supports the [NULL][zmtp30] and [PLAIN][plain] authentication mechanisms.\n\n[zmtp2]: http://rfc.zeromq.org/spec:15\n[zmtp30]: http://rfc.zeromq.org/spec:23\n[zmtp31]: http://rfc.zeromq.org/spec:37\n[plain]:  http://rfc.zeromq.org/spec:24\n\nScreenshot\n----------\n\n![Screenshot](/screenshot.png)\n\nInstallation\n------------\n\nThis dissector requires Lua 5.2 or newer.\n\n    mkdir -p ~/.config/wireshark/plugins\n    git clone https://github.com/whitequark/zmtp-wireshark ~/.config/wireshark/plugins/zmtp-wireshark\n\nUsage\n-----\n\nAs ZeroMQ ports are inherently application-specific, you need to use \"Decode As -\u003e ZMTP\" on your\nzeromq packets. Alternatively, subdissectors can register the ZMTP dissector on specific TCP ports\nto automate decoding.\n\nYou can use expression `zmtp` to filter packets. TCP segments are automatically reassembled.\n\nIf you get frame errors, especially when capturing on `lo`, the problem is that libpcap cannot\ncapture packets over 64 KiB (relevant [bug](https://github.com/the-tcpdump-group/tcpdump/issues/389));\ndo `sudo ip link set lo mtu 65500`.\n\nSubdissectors\n-------------\n\nThis dissector supports calling subdissectors for an application-level protocol. As ZMTP does\nnot have a generic way of specifying the inner protocol, the mapping is done using TCP ports.\n\nA subdissector that wishes to observe ZMTP frames must register itself in the `zmtp.protocol`\ndissector table, using the TCP port as a key. Both source and dest ports are checked, so\nbidirectional links (request/response, for example) will need a dissector that can decode both\ndirections.\n\n    -- Register a subdissector \"my_subdissector\" to the ZMTP protocol table for TCP port 1234\n    local zmtp = DissectorTable.get(\"zmtp.protocol\")\n    zmtp:add(1234, my_subdissector_proto)\n    -- Register the ZMTP dissector as the default for that TCP port (so no \"decode as\" is needed)\n    local zmtp_dissector = Dissector.get(\"zmtp\")\n    local tcp_table = DissectorTable.get(\"tcp.port\")\n    tcp_table:add(1234, zmtp_dissector)\n\nLicense\n-------\n\nSee [LICENSE](LICENSE.txt).\n\nAcknowledgements\n----------------\n\nThis dissector is based on a dissector for ZMTP 2, written by [Robert G. Jakabosky](mailto:bobby@neoawareness.com).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwhitequark%2Fzmtp-wireshark","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fwhitequark%2Fzmtp-wireshark","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwhitequark%2Fzmtp-wireshark/lists"}