最近因为公司两个dubbo服务间请求总超时，服务端同学认定不超时，所以思考怎么反驳，优先考虑的就是抓包了
首先通过tcpdump抓包，然后通过wireshark来分析

然而，不太熟Wireshark，通过这两天的学习，发现一些小技巧，分享一下。

下载

https://www.wireshark.org/download.html

MacBook打开多个窗口

# 打开命令行
open -n /Applications/Wireshark.app

切换中文

下载Wireshark之后，它内置中文，打开 Preference - Appearance - Language，选择中文即可

配置时间格式

视图 - 时间显示格式，选择预期的格式

标记包

command+M 标记/解除标记

常用过滤条件

dubbo请求分析

dubbo数据包分析

0000   62 1a e0 84 2a ea ee ee ee ee ee ee 08 00 45 00
0010   00 6e 6d 29 40 00 3c 06 33 8f 0a 15 e9 ba 0a 15
0020   9f ed 51 90 88 a6 a5 1e 25 3e 96 12 f2 5a 80 18
0030   02 39 e4 30 00 00 01 01 08 0a f7 1b ca 43 75 63
0040   35 af da bb 02 14 00 00 00 00 00 01 bf 21 00 00
0050   00 2a 94 72 13 6a 61 76 61 2e 75 74 69 6c 2e 41
0060   72 72 61 79 4c 69 73 74 3e f6 55 3f 0a 74 48 05
0070   64 75 62 62 6f 05 32 2e 30 2e 32 5a

以下参考chatgpt分析

前面是TCP头部信息，直接看到第五行da bb部分

             da bb 02 14 00 00  00 00 00 01 bf 21 00 00
0050   00 2a 94 72 13 6a 61 76  61 2e 75 74 69 6c 2e 41
0060   72 72 61 79 4c 69 73 74  3e f6 55 3f 0a 74 48 05
0070   64 75 62 62 6f 05 32 2e  30 2e 32 5a

• 魔数(da bb) : Dubbo协议的魔数(magic number)，通常是 da bb
• 版本信息（02）：Dubbo的版本号。
• 标志位（14）：表示这是一个响应包。
• 状态（00）：表示正常状态。
• 请求ID（00 00 00 00 00 01 bf 21）：一个8字节的请求ID。

https://dubbo.apache.org/zh-cn/overview/reference/protocols/tcp/

编写Wireshark解析dubbo协议插件

1. 确认Wireshark启用lua脚本

About Wireshark - 文件夹

打开全局配置

打开init.lua文件，确认是否打开

-- Set enable_lua to false to disable Lua support.
enable_lua = true

2. 打开插件文件夹

双击上图的全局Lua插件

创建dubbo.lua

-- 定义Dubbo协议的解析器
local dubbo_proto = Proto("dubbo", "Dubbo Protocol")

-- 定义Dubbo协议的字段
local dubbo_fields = {
    magic = ProtoField.uint16("dubbo.magic", "Magic"),
    flag = ProtoField.uint8("dubbo.flag", "Flag"),
    status = ProtoField.uint8("dubbo.status", "Status"),
    request_id = ProtoField.uint64("dubbo.request_id", "Request ID"),
    data_length = ProtoField.uint32("dubbo.data_length", "Data Length"),
    dubbo_data = ProtoField.bytes("dubbo.data", "Data"),
}

dubbo_proto.fields = dubbo_fields

-- 定义解析器的主要函数
function dubbo_proto.dissector(buffer, pinfo, tree)
    pinfo.cols.protocol = "Dubbo"
    
    local subtree = tree:add(dubbo_proto, buffer())
    local offset = 0
    
    -- 解析Dubbo头部
    subtree:add(dubbo_fields.magic, buffer(offset, 2))
    offset = offset + 2
    subtree:add(dubbo_fields.flag, buffer(offset, 1))
    offset = offset + 1
    subtree:add(dubbo_fields.status, buffer(offset, 1))
    offset = offset + 1
    
    -- 解析请求ID
    local request_id_high = buffer(offset, 4):le_uint()
    local request_id_low = buffer(offset + 4, 4):le_uint()
    local request_id_combined = string.format("%08x%08x", request_id_high, request_id_low)
    subtree:add(dubbo_fields.request_id, buffer(offset, 8)):append_text(string.format(" (%s)", request_id_combined))
    offset = offset + 8
    
    -- 解析数据长度
    subtree:add(dubbo_fields.data_length, buffer(offset, 4))
    offset = offset + 4 
    
    -- 检查数据长度是否足够解析Dubbo数据
    local data_length = buffer(offset - 4, 4):le_uint()
    if buffer:len() < (offset + data_length) then
        return
    end
    
    -- 解析Dubbo数据
    subtree:add(dubbo_fields.dubbo_data, buffer(offset, data_length))
end

-- 注册解析器
local tcp_port_table = DissectorTable.get("tcp.port")
tcp_port_table:add(20880, dubbo_proto)

也附上开发者帮提供的，更为详细
https://github.com/apache/dubbo/issues/13044

local bit32 = require "bit32"
do
    local pDubbo = Proto("DUBBO", "Apache Dubbo")
    local fMagic = ProtoField.uint16("dubbo.magic", "Magic", base.HEX)
    local fReqFlag = ProtoField.bool("dubbo.isRequest", "IsRequest", base.NONE)
    local f2Way = ProtoField.bool("dubbo.isTwoWay", "IsTwoWay", base.NONE)
    local fEvent = ProtoField.bool("dubbo.event", "IsEvent", base.NONE)
    local fSerializationID = ProtoField.uint8("dubbo.serializationID", "SerializationID", base.DEC)
    local fStatus = ProtoField.uint8("dubbo.status", "Status", base.DEC)
    local fRequestID = ProtoField.uint32("dubbo.requestID", "RequestID", base.DEC)
    local fDataLength = ProtoField.uint32("dubbo.dataLength", "DataLength", base.DEC)
    local fDubboVersion = ProtoField.string("dubbo.dubboVersion", "DubboVersion", base.UNICODE)
    local fServiceName = ProtoField.string("dubbo.serviceName", "ServiceName", base.UNICODE)
    local fServiceVersion = ProtoField.string("dubbo.version", "Version", base.UNICODE)
    local fMethodName = ProtoField.string("dubbo.methodName", "MethodName", base.UNICODE)
    local fMethodParamTypes = ProtoField.string("dubbo.methodParamTypes", "MethodParamTypes", base.UNICODE)
    local fMethodArgs = ProtoField.string("dubbo.methodArguments", "MethodArguments", base.UNICODE)
    local fAttachment = ProtoField.string("dubbo.attachment", "Attachment", base.UNICODE)

    pDubbo.fields = { fMagic, fReqFlag, f2Way, fEvent, fSerializationID, fStatus, fRequestID, fDataLength, fDubboVersion, fServiceName, fServiceVersion, fMethodName, fMethodParamTypes, fMethodArgs, fAttachment }

    local data_dis = Dissector.get("data")

    local function DUBBO_dissector(buf, pkt, root)
        local function accumulateByteArray(byteArray)
            local idx = 0
            local sum = 0
            while (idx < byteArray:len())
            do
                -- (len - idx- 1) * 8
                sum = sum + bit32.lshift(byteArray:get_index(idx), (byteArray:len() - idx - 1) * 8)
                idx = idx + 1
            end
            return sum
        end

        local function bytesToString(byteArray)
            local str = ""
            local idx = 0
            while (idx < byteArray:len())
            do
                str = str .. string.char(byteArray:get_index(idx))
                idx = idx + 1
            end
            return str
        end

        local function resolvePart(byteArray, offset)
            local partBytes = byteArray:subset(offset, 4)
            local partLength = accumulateByteArray(partBytes)
            local partArray = byteArray:subset(4 + offset, partLength)
            offset = offset + 4 + partLength
            return bytesToString(partArray), offset
        end

        local function substringIfNecessary(str, serializationID)
            -- fastjson2 offset 1
            if serializationID == 23
            then
                str = string.sub(str, 2, -1)
                return str
            else
                return str
            end
        end

        local buf_len = buf:len();
        if buf_len < 16 then
            return false
        end

        -- dubbo magic = 0xdabb
        local magic = buf(0, 2)
        if (magic:uint(0, 2) ~= 0xdabb)
        then
            return false
        end
        local t = root:add(pDubbo, buf)
        pkt.cols.protocol = "DUBBO"
        t:add(fMagic, magic)


        -- is dubbo
        local segment2 = buf:bytes(2, 1)
        local seg2Bytes = segment2:get_index(0)
        local reqFlag = bit32.band(seg2Bytes, 128)
        t:add(fReqFlag, reqFlag)

        local twoWay = bit32.band(seg2Bytes, 64)
        t:add(f2Way, twoWay)

        local event = bit32.band(seg2Bytes, 32)
        t:add(fEvent, event)

        local serializationID = bit32.band(seg2Bytes, 0x1F)
        t:add(fSerializationID, serializationID)

        -- requestID
        t:add(fRequestID, accumulateByteArray(buf:bytes(4, 8)))

        local dataLengthSegment = buf:bytes(12, 4)
        local dataBodyLength = accumulateByteArray(dataLengthSegment)
        t:add(fDataLength, dataBodyLength)

        local dataBodyBytes = buf:bytes(16, dataBodyLength)
        if (reqFlag ~= 0)
        then
            -- process request decode
            -- 1.dubbo version
            local offset = 0
            local dubboVersionString, offset = resolvePart(dataBodyBytes, offset)
            t:add(fDubboVersion, substringIfNecessary(dubboVersionString, serializationID))

            --  2. ServiceName
            local serviceName, offset = resolvePart(dataBodyBytes, offset)
            t:add(fServiceName, substringIfNecessary(serviceName, serializationID))

            -- 3. ServiceVersion
            local serviceVersion, offset = resolvePart(dataBodyBytes, offset)
            t:add(fServiceVersion, substringIfNecessary(serviceVersion, serializationID))

            -- 4. MethodName
            local methodName, offset = resolvePart(dataBodyBytes, offset)
            t:add(fMethodName, substringIfNecessary(methodName, serializationID))

        else
            --    process response decode

            -- 1. status
            t:add(fStatus, buf:bytes(3, 1):get_index(0))
        end
        return true
    end

    function pDubbo.dissector(buf, pkt, root)
        if DUBBO_dissector(buf, pkt, root) then
        else
            data_dis:call(buf, pkt, root)
        end
    end

    local tcpTable = DissectorTable.get("tcp.port")
    tcpTable:add(20880, pDubbo)

end