Question

I have a dissector that runs above the TCP protocol and has data that flows on more than one TCP packet.

I want to assemble the data before I convert everything, so I understood that I need tcp_dissect_pdus() for it, but I can’t find documentation or examples for it.

Can anyone direct me to it or help me understand how I use it?

Answer 1

There is no wslua API for tcp_dissect_pdus. But you can implement it yourself.

If you want to assemble pdu that span two or more packets it’s rather simple:

function slicer.dissector(tvb, pinfo, tree)
    ...
    local pdu_length = get_pdu_length(...)
    if pdu_length > tvb:len() then
        pinfo.desegment_len = pdu_length - tvb:len()
    else
        do_dissection(tvb, pifo, tree)
    end
    return
end

If you don’t know exact length of the pdu you can do:

        pinfo.desegment_len = DESEGMENT_ONE_MORE_SEGMENT

You should read README.developer section 2.7.