This is our old Q&A Site. Please post any new questions and answers at

So I wrote a dissector in Lua for a proprietary protocol that is based neither on TCP nor on UDP, it is located on top of the USB layer. In this layer, some of the packets I am dissecting here are fragmented over multiple USB URB frames. I taught my dissector to do the re-assembly itself and display the re-assembled packet contents with the last frame in the "Packet Bytes" view.

Is there an easy way to write those re-assembled buffers to a .pcapng file from my dissector?

A little more information on my use case: I am using tshark to dissect a given .pcapng file in an automated test scenario - the reassembly is kind of an intermediate step. After this, I would like to be able to open the reassembled (and filtered) packets in the Wireshark GUI.

Any help is appreciated. Thank you in advance.

asked 19 Apr '17, 05:53

patrick_oppermann's gravatar image

accept rate: 0%

Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 19 Apr '17, 05:53

question was seen: 1,099 times

last updated: 19 Apr '17, 05:53

p​o​w​e​r​e​d by O​S​Q​A