I have to read a capture file and dump its packets to multiple files, according to several field values of the packets. In order to do that, I have created a postdissector using Lua to extract the field values of the packets.
The problem is with the fragmented packets. These packets are divided in several frames and the "Fragmented" frames don't have the necessary field values in order to dump them in the correct file. And if I ignore the fragmented packets, I will have the result below.
In the following image I have the frames of the source capture file. Look as one of the packets is fragmented in frames 8 and 9.
In the following image I have the frames of the result pcap. As I ignored the fragmented frame in the original capture file, in the result file I have a fragmented packet without the required information, as shown in the source file, packet 9.
So I would like that my result pcap would contain the same packets as the source pcap. I don't know if the "ip.reassembled_in" field could be useful, as it could allow me to associate the "Fragmented" frame to the frame with the information I need. But as this frame with the information appears always after the fragmented frame, maybe I could keep the fragmented frame temporarily in a array, and after that, when the frame with the information was reached, I could associate them, bring the fragmented frame and dump both to a file, but I don't know how I can keep a frame and after dump it to a file.
Do you know how to do that or any way to solve my problem with the fragmented packets?
asked 23 Feb '15, 07:58
edited 23 Feb '15, 09:41
[This is an old question, but since no one's answered it yet...]
Saving the fragments in a Lua table won't work very well - for one thing, the
But you don't need to do that - what you need is to have the packets dissected or tapped twice. The first time to figure out which SIP messages you want to export to which files, and to let the IP fragments be associated with each other; and the second time to export the IP packet frames to the relevant file, based on the decisions of the first time.
In Wireshark (not tshark) you can force the packets to be re-tapped again with the
The "trick" is to know when to invoke
So once you decide how you want to proceed with that model, you could use the "ip.reassembled_in" field of every packet and match the value to a Lua table of SIP packets you want to export - a Lua table which you created in the first pass based on the
answered 28 Jun '15, 10:37