应用程序发送的数据报都是流式的，IP不保证同一个一个应用数据包会被抓包后在同一个IP数据包中，因此对于使用自制dissector的时候需要考虑这种情况。
Lua Dissector相关资料可以见：http://wiki.wireshark.org/Lua/Dissectors
Lua脚本书写wireshark dissector非常方便，使用Lua合并tcp数据报进行分析的样例如下，其实就是多了一个条件分支，所谓难者不会，会者不难：
local slicer = Proto("slicer","Slicer")
function slicer.dissector(tvb, pinfo, tree)
local offset = pinfo.desegment_offset or
local len = get_len() -- for tests i used a constant, but can be taken from tvb
while true do
local nxtpdu = offset + len
if nxtpdu > tvb:len() then
pinfo.desegment_len = nxtpdu - tvb:len()
pinfo.desegment_offset = offset
return
end
tree:add(slicer, tvb(offset, len))
offset = nxtpdu
if nxtpdu == tvb:len() then
return
end
end
end
local tcp_table = DissectorTable.get("tcp.port")
tcp_table:add(, slicer)
对于Lua Dissector脚本使用方法如下：
tshark
tshark -X lua_script:slicer.lua -i lo0 -f "tcp port 2506" -O aa -V
Wireshark
On OSX
Copy slicer.lua to ~/.wireshark
Add dofile(USER_DIR.."slicer to the end of .lua")/Applications/Wireshark.app/Contents/Resources/share/wireshark/init.lua
在wireshark的C语言版本中，有针对tcp合并报的相关函数，packet-tcp.c 具体见下：
/*
2152 * Loop for dissecting PDUs within a TCP stream; assumes that a PDU
2153 * consists of a fixed-length chunk of data that contains enough information
2154 * to determine the length of the PDU, followed by rest of the PDU.
2155 *
2156 * The first three arguments are the arguments passed to the dissector
2157 * that calls this routine.
2158 *
2159 * "proto_desegment" is the dissector's flag controlling whether it should
2160 * desegment PDUs that cross TCP segment boundaries.
2161 *
2162 * "fixed_len" is the length of the fixed-length part of the PDU.
2163 *
2164 * "get_pdu_len()" is a routine called to get the length of the PDU from
2165 * the fixed-length part of the PDU; it's passed "pinfo", "tvb" and "offset".
2166 *
2167 * "dissect_pdu()" is the routine to dissect a PDU.
2168 */
void
tcp_dissect_pdus(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
gboolean proto_desegment, guint fixed_len,
guint (*get_pdu_len)(packet_info *, tvbuff_t *, int),
dissector_t dissect_pdu)
{
volatile int offset = ;
int offset_before;
guint length_remaining;
guint plen;
guint length;
tvbuff_t *next_tvb;
proto_item *item=NULL;
void *pd_save; while (tvb_reported_length_remaining(tvb, offset) != ) {
/*
2186 * We use "tvb_ensure_length_remaining()" to make sure there actually
2187 * *is* data remaining. The protocol we're handling could conceivably
2188 * consists of a sequence of fixed-length PDUs, and therefore the
2189 * "get_pdu_len" routine might not actually fetch anything from
2190 * the tvbuff, and thus might not cause an exception to be thrown if
2191 * we've run past the end of the tvbuff.
2192 *
2193 * This means we're guaranteed that "length_remaining" is positive.
2194 */
length_remaining = tvb_ensure_length_remaining(tvb, offset); /*
2198 * Can we do reassembly?
2199 */
if (proto_desegment && pinfo->can_desegment) {
/*
2202 * Yes - is the fixed-length part of the PDU split across segment
2203 * boundaries?
2204 */
if (length_remaining < fixed_len) {
/*
2207 * Yes. Tell the TCP dissector where the data for this message
2208 * starts in the data it handed us and that we need "some more
2209 * data." Don't tell it exactly how many bytes we need because
2210 * if/when we ask for even more (after the header) that will
2211 * break reassembly.
2212 */
2213 pinfo->desegment_offset = offset;
2214 pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;
return;
}
} /*
2220 * Get the length of the PDU.
2221 */
plen = (*get_pdu_len)(pinfo, tvb, offset);
if (plen < fixed_len) {
/*
2225 * Either:
2226 *
2227 * 1) the length value extracted from the fixed-length portion
2228 * doesn't include the fixed-length portion's length, and
2229 * was so large that, when the fixed-length portion's
2230 * length was added to it, the total length overflowed;
2231 *
2232 * 2) the length value extracted from the fixed-length portion
2233 * includes the fixed-length portion's length, and the value
2234 * was less than the fixed-length portion's length, i.e. it
2235 * was bogus.
2236 *
2237 * Report this as a bounds error.
2238 */
show_reported_bounds_error(tvb, pinfo, tree);
return;
} /*
2244 * Do not display the the PDU length if it crosses the boundary of the
2245 * packet and no more packets are available.
2246 *
2247 * XXX - we don't necessarily know whether more packets are
2248 * available; we might be doing a one-pass read through the
2249 * capture in TShark, or we might be doing a live capture in
2250 * Wireshark.
2251 */
#if 0
if (length_remaining >= plen || there are more packets)
{
#endif
/*
2257 * Display the PDU length as a field
2258 */
item=proto_tree_add_uint(pinfo->tcp_tree, hf_tcp_pdu_size,
tvb, offset, plen, plen);
PROTO_ITEM_SET_GENERATED(item);
#if 0
} else {
item = proto_tree_add_text(pinfo->tcp_tree, tvb, offset, -,
"PDU Size: %u cut short at %u",plen,length_remaining);
PROTO_ITEM_SET_GENERATED(item);
}
#endif /* give a hint to TCP where the next PDU starts
2272 * so that it can attempt to find it in case it starts
2273 * somewhere in the middle of a segment.
2274 */
if(!pinfo->fd->flags.visited && tcp_analyze_seq) {
guint remaining_bytes;
remaining_bytes=tvb_reported_length_remaining(tvb, offset);
if(plen>remaining_bytes) {
pinfo->want_pdu_tracking=;
pinfo->bytes_until_next_pdu=plen-remaining_bytes;
}
} /*
2285 * Can we do reassembly?
2286 */
if (proto_desegment && pinfo->can_desegment) {
/*
2289 * Yes - is the PDU split across segment boundaries?
2290 */
if (length_remaining < plen) {
/*
2293 * Yes. Tell the TCP dissector where the data for this message
2294 * starts in the data it handed us, and how many more bytes we
2295 * need, and return.
2296 */
pinfo->desegment_offset = offset;
pinfo->desegment_len = plen - length_remaining;
return;
}
} /*
2304 * Construct a tvbuff containing the amount of the payload we have
2305 * available. Make its reported length the amount of data in the PDU.
2306 *
2307 * XXX - if reassembly isn't enabled. the subdissector will throw a
2308 * BoundsError exception, rather than a ReportedBoundsError exception.
2309 * We really want a tvbuff where the length is "length", the reported
2310 * length is "plen", and the "if the snapshot length were infinite"
2311 * length is the minimum of the reported length of the tvbuff handed
2312 * to us and "plen", with a new type of exception thrown if the offset
2313 * is within the reported length but beyond that third length, with
2314 * that exception getting the "Unreassembled Packet" error.
2315 */
length = length_remaining;
if (length > plen)
length = plen;
next_tvb = tvb_new_subset(tvb, offset, length, plen); /*
2322 * Dissect the PDU.
2323 *
2324 * Catch the ReportedBoundsError exception; if this particular message
2325 * happens to get a ReportedBoundsError exception, that doesn't mean
2326 * that we should stop dissecting PDUs within this frame or chunk of
2327 * reassembled data.
2328 *
2329 * If it gets a BoundsError, we can stop, as there's nothing more to
2330 * see, so we just re-throw it.
2331 */
pd_save = pinfo->private_data;
TRY {
(*dissect_pdu)(next_tvb, pinfo, tree);
}
CATCH(BoundsError) {
RETHROW;
}
CATCH(ReportedBoundsError) {
/* Restore the private_data structure in case one of the
2341 * called dissectors modified it (and, due to the exception,
2342 * was unable to restore it).
2343 */
pinfo->private_data = pd_save;
show_reported_bounds_error(tvb, pinfo, tree);
}
ENDTRY; /*
2350 * Step to the next PDU.
2351 * Make sure we don't overflow.
2352 */
offset_before = offset;
offset += plen;
if (offset <= offset_before)
break;
}
}