Ask Your Question

Revision history [back]

How to deal with a call to dissector that returns number of bytes in buffer, instead of number of bytes dissected?


I'm working on a dissector (in Lua) for a protocol that lays between TCP and VNC. The problem is that sometimes multiple VNC messages are transferred together and that I have no way to know that there is more than a single VNC message in the buffer that I get from the TCP layer. So I have to pass them as a single buffer to the VNC dissector, which in its turn dissect only the first message and return the size of the buffer that I passed to it (and not the number of bytes it dissected). This way I can't figure out that it wasn't dissecting all the messages in the buffer, so I can't call it again with a smaller buffer that starts after the message it dissected.

Is there any way around it? Maybe there is an option to see what bytes a specific dissector already dissected or something like that? Maybe another solution?