So I wrote a dissector in Lua for a proprietary protocol that is based neither on TCP nor on UDP, it is located on top of the USB layer. In this layer, some of the packets I am dissecting here are fragmented over multiple USB URB frames. I taught my dissector to do the re-assembly itself and display the re-assembled packet contents with the last frame in the "Packet Bytes" view. Is there an easy way to write those re-assembled buffers to a .pcapng file from my dissector? A little more information on my use case: I am using tshark to dissect a given .pcapng file in an automated test scenario - the reassembly is kind of an intermediate step. After this, I would like to be able to open the reassembled (and filtered) packets in the Wireshark GUI. Any help is appreciated. Thank you in advance. asked 19 Apr '17, 05:53 patrick_oppe... |