search

ghpr-asia / wsdf

Wireshark Dissector Framework
Apache License 2.0
16 stars 9 forks source link

Is it possible to build dissectors on TCP streams? #6

Open h7x4 opened 11 months ago

h7x4 commented 11 months ago

Hello!

Thank you for making this library. It looks awesome!

I'm trying to build a packet dissector for a protocol that will for the most part be transmitted using TCP streams. Looking through the documentation and the examples, there's no mention of this kind of functionality. According to the wireshark docs, this seems to impose some constraints: https://wiki.wireshark.org/Lua/Dissectors#tcp-reassembly

If this is already possible with the current state of the library, maybe a simple example could be added?

immanuelhume commented 11 months ago

Hi @h7x4, thanks for your interest in this library :) Dissecting data from TCP streams is not possible for now as the there is no way to specify message boundaries across/within segments. Unfortunately, I don't know if it will be supported in the near future, though it wouldn't seem too difficult.

immanuelhume commented 11 months ago

For future reference, the post linked below might be useful if/when adding this feature to wsdf.

https://osqa-ask.wireshark.org/questions/53802/how-dissect-two-segments-of-one-protocol-in-the-same-packet-in-the-same-tcp-segment-lua/