Install Livewire GPIO filter plugin for Wireshark

Updated by Milos Nemcik

Scope

The following is a plugin for Wireshark that can monitor the Livewire GPIO multicast group. This plugin translates the multicast messages so that you can view it in a more human readable format. Note the Info column on the last image of this page.

Additionally, this lua filter is provided to you with the hope that you will find it helpful. It is provided without support or warranty of any kind, including the appropriateness to your application.

Lua is free open-source software, distributed under a very liberal license (the well-known MIT license). It may be used for any purpose, including commercial purposes, at absolutely no cost. You can find more at their Web Site lua.org.

Wireshark and the "fin" logo are registered trademarks of the Wireshark Foundation. For support and information on its use, visit their Web Site at https://www.wireshark.org/


Adding the Plug-In to Wireshark

  1. Start Wireshark
  2. Open the Help menuS
  3. Select About Wireshark

From the pop-up window,

  1. Select the Folders tab
  2. Click on the Global Plugins directory link
  1. Download the following file livewire_gpiov3.lua
Note: This is an updated file as of 12/2021 with the following changes.
- supports stacked GPIO messaging (where before it would parse the first message and show the other items as additional information but in HEX)
- correction in the circuit latch/pulse duration information (would show a pulse when it was a latch)
  1. Place it into the directory
  1. Close Wireshark and restart it.

Once WireShark starts it will read the plugin folder and be able to use the plugin. Simply filter out traffic for multicast group 239.192.255.4 and WireShark will do the rest. The correct filter syntax is ip.dst==239.192.255.4


Let us know how we can help

If you have further questions on this topic or have ideas about improving this document, please contact us.


How did we do?