Piecing Together Multipart UDP messages with Lua Wireshark Dissector

There isn't a built-in way of doing it like there is for TCP. But you can write Lua code to do it. The details for how to do that depend on how your protocol is structured and how you want to show the resulting message and fields in the Packet Details view.

If you can dissect the individual fields in each UDP packet alone, without having to reassemble across UDP packets in order to dissect it, that would make life a lot easier. You can still show which set of UDP packets are related to each other, by using an ftypes.FRAMENUM typed ProtoField.

But I'm presuming you need to reassemble across UDP packets in order to then dissect some reassembled payload that your protocol is carrying... correct?

If so, this is going to be hard to explain... it would probably be easier to just write an example script and post it. :)

The basic concept is you're going to have to save packet protocol payload as ByteArrays, in a Lua table. And then reassemble them in the final packet of a fragment sequence (if all the fragments were received), by concatenating the ByteArrays and creating a new Tvb from the concatenated one; and then calling the appropriate payload dissector on the new Tvb.

You'd also check the pinfo.visited, to avoid adding to this table after the first sequential run through the capture. And you'd need to set a function into proto.init, to reset the table(s) whenever a capture is restarted or a capture file loaded.

The details, though, depend a lot on how your protocol is structured; because the first thing you need is something to use for a key in the Lua table that holds these fragments. It would be key'd by some field or combination of fields in your protocol that identifies a single reassembled "message". Usually protocols call this thing a transaction id or message id or some such. That field needs to appear in every UDP packet, be the same value for each fragment of the same message, and be unique per reassembled message. For example, for the IPv4/IPv6 protocol, it's the "identification" field. Do you have such a field in your protocol? Or some combination of fields that can be used to create such a thing? (in fact it will really be a combination... for example, you'd probably want to include the source+dest IP:port in this key, so that the same id value from/to different hosts does not collide)

Also, if you have a current script and example pcap capture file, it would help a lot if you posted it. You can post the script here, and the pcap file on cloudshark.org; or post them on the wireshark wiki. That would make explaining this stuff go faster I think.