Calling a subdissector from lua when using snaplen

asked 2019-06-25 12:32:31 +0000

Xavier gravatar image

I have a lua dissector for a custom protocol containing 802.11. For performance reason, I use a snaplen shorter than packet real size.

My dissector calls the WiFi one with something like: Dissector.get("wlan"):call(buf:range(my_proto_header_size):tvb(), pinfo, tree)

The problem is that while all protocols are properly dissected, IP dissector complains about IPv4 total length exceeds packet length and that messes up TCP analysis, which I'm interested in.

Indeed when IP dissector reads reported length, it is getting the value of captured length which is much shorter, hence the error.

I tried to print buf:range(some_offset):tvb():reported_len() and it gives me the captured length so it seems that this method does not properly set reported length.

Did I miss something in my sub-dissector call to have reported length properly set? If it was a C dissector, I suppose I would use tvb_new_subset_remaining() which seems to handle reported length properly but I don't see any equivalent in lua. Can lua handle sub-tvb with reported length different than captured length?

Thanks.

edit retag flag offensive close merge delete