Wireshark-users: Re: [Wireshark-users] Reassembling UDP conversations

From: Stephen Fisher <stephentfisher@xxxxxxxxx>
Date: Wed, 7 May 2008 12:24:59 -0600

On Wed, May 07, 2008 at 12:23:50PM -0400, Eiland, Edward (GE, Research) wrote:

> I have a pcap file from which I want to reassemble UDP conversations. 
> It looks like this can be done by creating a post-dissector with Lua.  
> I am, however, a newbie to both wireShark and Lua.  Can anyone point 
> me to resources that will help me with this?

What do you mean by reassemble a UDP conversation?  There is already a 
feature that sounds like what you want.  It is under the Analysis menu 
called Follow UDP Stream.


Steve