This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to export reassembled packets to a .pcapng file?

0

So I wrote a dissector in Lua for a proprietary protocol that is based neither on TCP nor on UDP, it is located on top of the USB layer. In this layer, some of the packets I am dissecting here are fragmented over multiple USB URB frames. I taught my dissector to do the re-assembly itself and display the re-assembled packet contents with the last frame in the "Packet Bytes" view.

Is there an easy way to write those re-assembled buffers to a .pcapng file from my dissector?

A little more information on my use case: I am using tshark to dissect a given .pcapng file in an automated test scenario - the reassembly is kind of an intermediate step. After this, I would like to be able to open the reassembled (and filtered) packets in the Wireshark GUI.

Any help is appreciated. Thank you in advance.

asked 19 Apr '17, 05:53

patrick_oppermann's gravatar image

patrick_oppe...
466611
accept rate: 0%