PDU reassambly on data read from a custom log file in lua

asked 2025-11-24 18:47:34 +0000

orf
1

Hello,

I have issues using dissect_tcp_pdus in Protocol dissectors called via DLT_USER table from data from a custom log file (details below). The same protocols and dissect_tcp_pdus works fine when I am using either life sniffing of TCP traffic or load a PCAPNG file of TCP traffic, with the protocols register for the used tcp.port. Could someone provide some hints how to use dissect_tcp_pdus for protocols used through DLT_USER table?

Detailed description:

I am reading a custom log file in lua with a custom FileHandler written in Lua. The reading works, and it maps the data from the log file to two protocols: cmd_proto and rsp_proto. The mapping is done through the DLT_USER tables. I.e. the FileHandler sets frame_info.encap to a DLT_USER value depending on data from the log file, and in the DLT_USER table I registered the correct protocol.

When I load a log file I can see all captured frames displayed correctly mapped to the two protocols. However I am not able to use the dissect_tcp_pdus function inside these protocols to perform dessegmation and reassmably. Please note that the dessegmentation and reassamblywith dissect_tcp_pdus works fine when I use the same protocols on actual TCP data.

What I have figured so far is, that if the protocol is called through DLT_USER entry, then pinfo.can_desegment is set to 0. If I overwrite this and set pinfo.can_desegment to 1 (or 2) then dissect_tcp_pdus starts to work partialy, and the frames are desegmented correctly. However reassambly of PDUs across two recorded packets still does not work. The dissection correctly recognizes the partial PDU at the end of the first packet, however it does not take that partial data into account when parsing the second packet.

What do I need to do to get this to work. Or does anybody have an idea in which direction to search for a solution?

Best regards,

Oliver

edit retag flag offensive close merge delete

add a comment

answered 2025-11-24 23:36:18 +0000

johnthacker
336 ●61 ●6

If I understand correctly, your custom log file does not have the TCP layer at all, and just has the PDUs from each frame. I presume that is from original packet data as you have partial PDUs, though I suppose PDUs could be split before sending to TCP. (That matters because without the TCP sequence number information, if this comes from actual packet data you can have reordered or missing frames.)

If so, there is no way to make tcp_dissect_pdus work. tcp_dissect_pdus is a function that puts various information into the packet_info struct that TCP uses to do reassembly. The TCP dissector does various work before calling the other protocol dissectors (including, as you noticed, setting pinfo->can_desegment if the TCP checksum is not known to be incorrect) and then does the reassembly afterwards.

If you need to dissect this protocol and reassemble it without ever calling the TCP dissector, you will need to implement reassembly in the dissector for your protocols. There are other protocols that do their own reassembly for various reasons and you can look at those. (Protocols on top of TCP prefer to have TCP do it because TCP has the sequence number that can be used to put frames in order if they are received out of order, and can be used to ignore retransmitted data.)

Comments

Your understanding is correct, the custom log file does not have the TCP layer information at all. It carries only the PDUs and they may be split across several log entries.

Thank you for the clarification. I will proceed with my own reassembly. I assume the situation for USB transfers is similar. I did use tcp_dissect_pdus on USB bulk transfers for reassambly and it did also only work partially.

Thank your for the explanation!

orf ( 2025-11-25 13:07:15 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

PDU reassambly on data read from a custom log file in lua

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

PDU reassambly on data read from a custom log file in lua edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

PDU reassambly on data read from a custom log file in lua