Unable to See Yamux Protocol in Wireshark Settings: A Comprehensive Guide

Unable to See Yamux Protocol in Wireshark Settings: A Comprehensive Guide

Yamux is a multiplexing protocol that enables efficient use of network connections for applications that require sending multiple streams of data. When analyzing network traffic using Wireshark, you might encounter difficulties finding Yamux listed as a protocol in the settings. This comprehensive guide will help you understand the concepts related to Yamux and Wireshark and provide steps to tackle this issue.

Understanding Yamux and Wireshark

Yamux is a multiplexing protocol designed for use with the frp project, which serves as a fast reverse proxy. Yamux breaks down a single network connection into multiple streams, allowing applications to transmit multiple data streams simultaneously. This increases the efficiency and performance of the data transfer.

Wireshark is a popular network protocol analyzer that captures and displays network traffic. It supports various protocols, and you can customize and extend its functionality using plugins and dissectors. Although Wireshark supports many protocols, Yamux is not one of the default protocols.

Issue: Yamux Protocol Not Visible in Wireshark Settings

The main issue is that Wireshark doesn't natively support Yamux as a protocol. Thus, you cannot find Yamux listed in Wireshark's protocol settings. You might think that this makes analyzing Yamux traffic impossible, but that's not the case.

Solution: Manual Dissection of Yamux Protocol in Wireshark

To analyze Yamux protocol traffic in Wireshark, you need to create a custom dissector for it manually. This can be achieved by implementing the protocol dissector in Lua, Wireshark's scripting language.

1. Obtain the Yamux Protocol Specification

To create a custom dissector, you first need the Yamux protocol specification. Unfortunately, the official specification is not available. However, you can refer to the Yamux implementation in Go here for reference.

2. Write a Lua Dissector

-- Yamux Lua dissector

local yamux_port = 7800

local yamux_magic_number = 0x78563412

local yamux_frame_types = {
  [0x0] = "SETTINGS",
  [0x1] = "WINDOW_UPDATE",
  [0x2] = "DATA",
  [0x3] = "CLOSE",
}

local proto = Proto("yamux", "Yamux Protocol")

function proto.dissector(buffer, pinfo, tree)
  local offset = 0
  local length = buffer:len()

  -- Check if the buffer starts with Yamux magic number
  if buffer(offset, 4):le(yamux_magic_number) then
    local version = buffer(offset + 4, 1):uint()

    pinfo.cols.protocol:set("Yamux/" .. version)

    -- Create a protocol tree
    local yamux_tree = tree:add(proto, buffer(), "Yamux Stream")

    -- Parse settings frame
    if version == 1 then
      local stream_id = buffer(offset + 5, 4):uint()
      local settings_length = buffer(offset + 9, 2):uint()

      if settings_length > 0 then
        local setting_type = buffer(offset + 11, 1):uint()
        local setting_length = buffer(offset + 12, 1):uint()

        yamux_tree:add(yamux_frame_types[0],
          string.format("Stream ID: 0x%x, Type: 0x%x, Length: 0x%x",
            stream_id, setting_type, setting_length))
      end
    end

    offset = offset + 13 + settings_length
  end
end

-- Register the Yamux protocol to dissect TCP ports
local tcp_port = DissectorTable.get("tcp.port")
tcp_port:add(yamux_port, proto)

3. Load and Test the Dissector

To load and test the dissector, follow these steps:

1. Launch Wireshark.

2. In the menu, select "Edit" -> "Preferences".

3. In the Preferences window, scroll down and select "Lua".

4. Click the "New" button, enter a name, and use the following command to add the Lua script:

   
   do
     local f = io.open("yamux_dissector.lua", "r")
     local content = f:read("*all")
     f:close()
   
     local status, err = load(content)
     if not status then
       print("Error loading Yamux dissector:", err)
       return
     end
   
     status()
   end
   

5. Save the preferences and start capturing traffic on the network interface or the Yamux server listening on the port 7800.

   The custom Yamux protocol dissector should now be working, allowing you to analyze the Yamux protocol traffic in Wireshark.

• Yamux is a multiplexing protocol that enhances the efficiency of data transfer between applications.
• Wireshark is a widely-used protocol analyzer, but it doesn't natively support Yamux.
• You can write a custom Lua dissector for the Yamux protocol to make it analyzable using Wireshark.

References

• Yamux Protocol Implementation in Go: https://github.com/hashicorp/yamux

• Wireshark Lua Scripting Guide: https://wiki.wireshark.org/Lua