11.21. Protobuf Search Paths

The binary wire format of Protocol Buffers (Protobuf) messages are not self-described protocol. For example, the varint wire type in protobuf packet may be converted to int32, int64, uint32, uint64, sint32, sint64, bool or enum field types of protocol buffers language. Wireshark should be configured with Protocol Buffers language files (*.proto) to enable proper dissection of protobuf data (which may be payload of gRPC) based on the message, enum and field definitions.

You can specify protobuf search paths at the Protobuf protocol preferences. For example, if you defined a proto file with path d:/my_proto_files/helloworld.proto and the helloworld.proto contains a line of import "google/protobuf/any.proto"; because the any type of offical protobuf library is used. And the real path of any.proto is d:/protobuf-3.4.1/include/google/protobuf/any.proto. You should add the d:/protobuf-3.4.1/include/ and d:/my_proto_files paths into protobuf search paths.

The configuration for the protobuf search paths is a user table, as described in Section 11.7, “User Table”, with the following fields:

Protobuf source directory
This specifies a directory containing protobuf source files. For example, d:/protobuf-3.4.1/include/ and d:/my_proto_files in Windows, or /usr/include/ and /home/alice/my_proto_files in Linux/UNIX.
Load all files
If this option is enabled, Wireshark will load all *.proto files in this directory and its subdirectories when Wireshark startup or protobuf search paths preferences changed. Note that the source directories that configured to protobuf offical or third libraries path (like d:/protobuf-3.4.1/include/) should not be set to load all files, that may cause memory unnecessary occuption.