Lua: Stateful dissection and reassembly of fragmented packets
Consider a UDP-based protocol of length-prefixed Pascal strings (<length: i8><content: i8[]>
). The strings might get fragmented across multiple packets, and require reassembly. E.g.,:
0A68656C6C6F // length: 10, partial content: "hello", remaining bytes: 5
776F726C64 // partial content: "world" => full message: "helloworld"
How could you write a dissector in Lua that can extract reassembled strings? (Assume the first frame in our capture is the start of a new string.)
Unlike dissect_tcp_pdus()
, I don't think dissect_udp_pdus()
is exposed to Lua. The documentation on pinfo.desegment_len
is very sparse, but I don't think it applies here.
There is documentation on reassembling split UDP packets but for the C API. I don't know if any of reassemble.h is available to Lua.
In my testing, it did not work to accumulate incomplete content in a global buffer because the reassembly state is affected by multiple dissection passes.
Previous discussion from 2016, though the solution comes with some caveats.