Inspect PRISM traffic with Wireshark¶

PRISM includes a Lua dissector repo/prism-ccl/wireshark/prism.lua. It decodes PRISM packet headers and TLVs, and exposes display filters under prism.*. No custom Wireshark build is required.

PRISM packets decoded by the Lua plugin in Wireshark — PRISM packets and decoded protocol fields in Wireshark.

Installation guide¶

Copy repo/prism-ccl/wireshark/prism.lua into your personal Lua plugin folder, creating it if necessary.

Windows¶

Copy the file to %APPDATA%\Wireshark\plugins.

Linux¶

Copy the file to ~/.local/lib/wireshark/plugins.

macOS¶

Copy the file to ~/.local/lib/wireshark/plugins.

Reload the plugin with Analyze → Reload Lua Plugins (Ctrl+Shift+L) or restart Wireshark. The exact folder in use is shown under Help → About Wireshark → Folders → Personal Lua Plugins.