How do I get the acknowledgement number for a packet in Wireshark using Lua?

I am writing a Lua dissector for a protocol on top of the TCP protocol. It needs to store the acknowledgment number of request packets, in order to determine which is the corresponding response packet.

For example I can get the packet number with pinfo.number, is there any similar way I can access the acknowledgement number?

asked 07 May '12, 03:20

Ville
1●1●1●2
accept rate: 0%

edited 07 May '12, 03:55

What protocol are you dissecting?

(07 May '12, 03:37) helloworld

A special protocol on top of the TCP protocol.

(07 May '12, 03:56) Ville

One Answer:

active answers oldest answers newest answers popular answers

You can define the desired fields with Field.new() and then use the field definitions in the dissector function.

-- define the fields
tcp_srcp_f = Field.new("tcp.srcport")
tcp_dstp_f = Field.new("tcp.dstport")
tcp_ack_f = Field.new("tcp.ack")
tcp_seq_f = Field.new("tcp.seq")

function tcp_test_proto.dissector(buffer,pinfo,tree)
-- use the fields in the dissector
local sport = tcp_srcp_f()
local dport = tcp_dstp_f()
local ack = tcp_ack_f()
local seq = tcp_seq_f()
...
end

Regards
Kurt

permanent link

answered 07 May '12, 06:57

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

edited 07 May '12, 06:58

Your answer

toggle preview

community wiki:

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "title")
image?![alt text](/path/img.jpg "title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Question tags:

tcp ×752
dissector ×637
lua ×431
pinfo ×12
acknowledgement ×3

question asked: 07 May '12, 03:20

question was seen: 4,396 times

last updated: 07 May '12, 06:58

How do I get the acknowledgement number for a packet in Wireshark using Lua?

Follow this question

You have a trillion packets.

You need to see four of them.

Don't have Wireshark?

Related questions