Wireshark · Wireshark-dev: Re: [Wireshark-dev] How to do a multi-packet dissector

[Balint Reczey <balint.reczey@xxxxxxxxxxxx>]

Hi,

From http://wiki.wireshark.org/Lua/Dissectors :

"Like dissectors written in C, Lua dissectors can use Wireshark's 
ability to reassemble TCP streams:

    * To not use TCP reassembly, make your Lua dissector function 
return nothing (nil) or 0 (in case dissector can't dissect packet).
    * To request reassembly via the pinfo struct as described in 
README.developers, set pinfo.desegment_len and pinfo.desegment_offset 
(works from Wireshark 1.1.2)."

Cheers,
Balint

Morita, Bill wrote:
> I am writing a Lua dissector for a streaming protocol that may spread a 
> “record” over several TCP packets.
>
> What is a reasonable approach to take with this type of situation??
>
>  
>
> Thanks in advance.
>
>  
>
> ---------------
>
> Bill Morita
>
> Cube 1040
>
> 503-495-9513
>
> Bill.Morita@xxxxxxxxxx