TriStation Dissector It's a TriStation Protocol Dissector, yo. It's more crude than #tubular, but here's a basic Wireshark LUA dissector for TriStation. Ref pcap: https://packettotal.com/app/analysis?id=0e55d9467f138d148c9635617bc8fd83 Ref blahg: https://www.fireeye.com/blog/threat-research/2018/06/totally-tubular-treatise-on-triton-and-tristation.html