dissector for encapsulated tcp option data

Question

Hi,

I'm writing a post-dissector, to process some bespoke TCP options.

Im having problems processing the TCP options where the TCP packet is encapsulated. Since TVB is the full buffer, I just want the offset of the TCP.OPTIONS ?

and process that!

or even better, how can i just take the tcp.options userdata, and process that? - I have to iterate over the tcp option data, as there can be many OPTIONS

thanks

Answer 1

How about using the "tcp.options" Field to get just the ByteArray of the TCP options?

Like so:

local myproto = Proto("MyTcpOpts","Fake proto example to get at TCP options")
local tcp_opts = Field.new("tcp.options")
function myproto.dissector(tvb,pinfo,tree)
local tcp_opt_finfo = tcp_opts()
if tcp_opt_finfo then
local bytearray = tcp_opt_finfo()
print("opts bytes length =" .. bytearray:len())
print("opts bytes in hex =" .. tostring(bytearray))
    -- do stuff to tcp options here

else
    print(&quot;no tcp options&quot;)
end

end
register_postdissector(myproto)