Implementing a basic packet counter and incorrect order detector using dissectors and Lua

Question

I am trying to implement, using Lua, a dissector which tells me whether the packets sent are arriving or not. To achieve this, on top of UDP I have implemented a custom protocol with a field "ID" which is auto-incremented by one on each packet.

I got the dissector to process the fields, but I am not able to make it read the previous packet ID and report whether the current packet ID is in the expected order.

My code:

packet_counter=0
function ogg.init()
  packet_counter=0
end
function ogg.dissector(buffer, pinfo, tree)
local index
--Get the expected index and store it to a global (and unique per packet) variable
if (not pinfo.private.expected) then
  pinfo.private.expected=packet_counter+1
  --Get the new index (the current packet ID field)
  index=buffer(2,2):uint()
  --Set it as the new expected packet
  packet_counter=index
end

if (tree) then
  --Make all the packet processing here. Somewhere among this:
  if (tonumber(pinfo.private.expected) ~= index) then
    pinfo.cols.info = &quot;ID: &quot;..index..&quot; is Invalid! Expected &quot;.. pinfo.private.expected
  end          
end

end

I am getting several packets with the information correct, but other packets are getting the packet_counter variable different than what it should be, i.e. the previous packet was 100, current is 101, and it is saying that expected is 154, as if the processing order of the packets weren’t sequential.

What is wrong here?

Answer 1

You should be using pinfo.visited as suggested earlier.

The problem is that dissectors are running twice before your display is constructed when your wireshark opens and then ever time you click on a packet.

So you think you see pinfo.visited it always as True. Where it's not.

Have a look at this question of mine - Lua postdissector executed every time I click on a packet

Try below code ( not sure if it will work but you should get the idea )

I'd suggest keeping data in outside table.

packet_counter=0
function ogg.init()
packet_counter=0
end
– Define a table your data
local pkts = {}
function ogg.dissector(buffer, pinfo, tree)
local index
local pkt_no = tostring(pinfo.number)

if not pinfo.visited then
    if not pkts[pkt_no] then
        pkts[pkt_no] = {}
    end
    -- add the stuff you want to keep into your table
    pkts[pkt_no][&#39;counter&#39;] = packet_counter + 1
end

index=buffer(2,2):uint()
packet_counter=index

if pkts[pkt_no] then
    pinfo.cols.info = &quot;ID: &quot;..index..&quot; is Invalid! Expected &quot;.. pkts[pkt_no][&#39;counter&#39;]
end

end

Answer 2

I have no experience with Lua dissectors, but with C dissectors you can check the flag "pinfo->fd->flags.visited" whether it is the first time a frame is dissected (on the first sequential run through the packets).

You then have to create session and packet states by using conversations and per-packet data. As is described in "doc/README.developer" in paragraphs 2.2 and 2.5.

I'm sure there is an interface to these in Lua as well, but I have no experience with Lua dissectors myself unfortunately...