This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to use lua to parse multi frames for one package?

0	I want to write a lua plugin to parse my private protocol. In my protocol, a package size often bigger then MTU, so I need parse many TCP frames for one package. lua asked 01 Nov '13, 02:48 zhang 1●1●1●1 accept rate: 0%

One Answer:

Please read the first few comments in the Wiki

http://wiki.wireshark.org/Lua/Dissectors

Then there some samples, that show how it works. pinfo.desegment_len is the key (see also Wiki).

http://delog.wordpress.com/2013/05/21/dealing-with-segmented-data-in-a-wireshark-dissector-written-in-lua/
http://blog.roisu.org/english-create-a-wireshark-dissector-with-lua/
http://stackoverflow.com/questions/13138088/how-do-i-reassemble-tcp-packet-in-lua-dissector
https://github.com/reverbrain/elliptics/blob/master/wireshark/elliptics.lua

If you search google for lua "desegment_len" you'll probably find more samples.

Regards
Kurt

answered 01 Nov '13, 05:46

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%