Lua dissector puzzle : how to save state

As pointed out earlier, the protocol tree is rebuilt each time you click on a packet in the GUI - or more to the point, the packet is completely re-dissected/parsed each time it's clicked, as well as some other times (like when you apply a display filter).

You said you tried to use a big Lua table to store using the Field("tcp.stream") as the index - that's a pretty good idea, but doesn't go far enough... I assume all you're storing in that stream-indexed table is the last packet's length for that given TCP stream index, right? So of course when some earlier packet gets dissected a second/third time, the packet length in that table for that stream index will represent the length of the last dissected packet of the stream, which may not be the packet previous to the one being re-dissected in the GUI list.

So what you need to do is also have a Lua table indexed by packet numbers (pinfo.number), where the value of the table entry is that packet number's previous-packet length. Then in your dissector or tap function check if the current packet is already in that list for its info.number, and if it is then the previous-packet length is the value of the found entry; if an entry isn't already in that table, then go get the number from your stream-indexed table (which represents the previous packet length), replace it with the current packet's length, and put the previous-packet length into the packet-number-indexed table so it will be found if this packet gets dissected again in the future.