Ask Your Question

How to deal with a call to dissector that returns number of bytes in buffer, instead of number of bytes dissected?

asked 2022-02-02 13:07:06 +0000


I'm working on a dissector (in Lua) for a protocol that lays between TCP and VNC. The problem is that sometimes multiple VNC messages are transferred together and that I have no way to know that there is more than a single VNC message in the buffer that I get from the TCP layer. So I have to pass them as a single buffer to the VNC dissector, which in its turn dissect only the first message and return the size of the buffer that I passed to it (and not the number of bytes it dissected). This way I can't figure out that it wasn't dissecting all the messages in the buffer, so I can't call it again with a smaller buffer that starts after the message it dissected.

Is there any way around it? Maybe there is an option to see what bytes a specific dissector already dissected or something like that? Maybe another solution?


edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2022-02-02 14:56:10 +0000

Jaap gravatar image

Then you probably have to make your dissector smart enough to be able to figure out how large the VNC message is. Once you know that, you ask the TCP dissector for more data until you have a complete message, which you then present to the VNC dissector. This is where dissect_tcp_pdus() comes into strength.

edit flag offensive delete link more


If the VNC dissector is returning a value representative of all data in the tvb but only dissecting a subset of that data, then isn't this a bug in the VNC dissector?

cmaynard gravatar imagecmaynard ( 2022-02-02 19:31:26 +0000 )edit

Perhaps. That should be looked into, how the VNC dissector takes in PDU's.

Jaap gravatar imageJaap ( 2022-02-04 16:08:17 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2022-02-02 13:07:06 +0000

Seen: 148 times

Last updated: Feb 02 '22