Wireshark · Wireshark-users: Re: [Wireshark-users] LUA dissector - combine data from 2 UDP packets, display issue

["Maynard, Chris" <Christopher.Maynard@xxxxxxx>]

I download the fragproto.lua implementation from the OSQA question and tested it against the data provided; it seemed to work fine.  Without knowing more details about your own dissector, it’s rather difficult to provide more help.  Can you share the basics along with some simple test data?

 

- Chris

 

From: Wireshark-users <wireshark-users-bounces@xxxxxxxxxxxxx> On Behalf Of Michael Poroger
Sent: Friday, July 31, 2020 12:02 PM
To: Community support list for Wireshark <wireshark-users@xxxxxxxxxxxxx>
Subject: Re: [Wireshark-users] LUA dissector - combine data from 2 UDP packets, display issue

 

Something I build by myself. The idea is similar to this implementation (in the answer) - just storing the data between packet X-1 to packet X.

 

Not sure about the actual implementation (as already on weekend), but I think that this is not persistent storage, as if the data in the packet is complete, the storage is set to an empty one. In any case, if packet X-1 does not contain complete data,  this data is available for packet X.

 

-----------------------------
Michael Poroger

"Science is not only knowledge, science is also to be dare"
Shimon Peres

 

 

On Fri, Jul 31, 2020 at 5:27 PM Jeff Morriss <jeff.morriss.ws@xxxxxxxxx> wrote:

 

 

On Fri, Jul 31, 2020 at 8:58 AM Michael Poroger <bezenchu@xxxxxxxxx> wrote:

Hello users :)

I've successfully created a dissector which combines data from 2 UDP packets. Every time I select this kind of packet, I'm getting an error on the packet details on the custom protocol section.

Only when I select the previous packet and then the current packet, I can see the dissection as I expect and without any error.

How to solve the issue?

Probably a question better for the -dev list but...

 

Are you using epan's reassembly routines or something you built yourself?  If it's something you built yourself, are you storing the reassembled data in persistent storage which is available when (re)dissecting the 2nd frame (where the reassembled data is used)?

 

 

 

 

 

 

 

 

 

 

CONFIDENTIALITY NOTICE: This message is the property of International Game Technology PLC and/or its subsidiaries and may contain proprietary, confidential or trade secret information. This message is intended solely for the use of the addressee. If you are not the intended recipient and have received this message in error, please delete this message from your system. Any unauthorized reading, distribution, copying, or other use of this message or its attachments is strictly prohibited.