Hello Wireshark Community!
I have been using lua to create various protocol dissectors for quite a while now and I am facing a problem I haven't been able to figure out. The way lua handles TCP reassembly is relatively simple however it seems like there is one shortcoming considering the following situation:
- You are dissecting some streaming protocol FOO where a message unit is N byte long (N < 1500).
- Your capture starts at the beginning of one message unit.
- All the TCP packets you receive contains at least one cut off message (at the end of the packet)
- And this keeps going on for as long as your capture is taken.
- Let's say your whole capture contains 100 packets.
- Let's say when you reassemble all those packets, you have 500 complete messages.
Now here is where it gets tricky.
CASE 1 If your last packet actually contains the bytes that complete the message cut off in the previous packet PLUS one complete message (and nothing else) then your Wireshark will display 99 TCP frames and 1 FOO frame. When looking at this FOO frame it will say something like "100 reassembled TCP segments.." with all the packet numbers composing this huge reassembled frame. You'll be able to look at your 500 decoded FOO messages and you'll be happy (so would I be).
CASE 2 If your last packet also contains the end of the previous message but also contains an incomplete message, then in Wireshark you will see 100 TCP frames marked as "TCP segment of a reassembled PDU" and basically even though your dissector has been able to decode all the messages (but the very last) in all those packets, no decoded FOO frame will be displayed. This is because the dissector "thinks" the dissection is not over because it is expecting the end of the last message in another packet (which is not available because the capture has ended.) This is a huge problem because it means that even though 499 FOO messages were successfully decoded, none of them will be displayed because the 500th one is incomplete!
So the question is how can you tell wireshark to just display what it has been able to dissect even if the last message was not complete? (Disabling dissector reassembly is not a solution because in this scenario you would only decode 1 message out of the hundreds actually available)
asked 10 Jul '15, 09:32
accept rate: 0%