Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 9896] New: Lua dissector tcp packet reassemble not working

Date: Wed, 19 Mar 2014 04:26:25 +0000
Bug ID 9896
Summary Lua dissector tcp packet reassemble not working on Windows, works on Linux
Classification Unclassified
Product Wireshark
Version 1.10.6
Hardware x86-64
OS Windows 7
Status UNCONFIRMED
Severity Major
Priority Low
Component Dissection engine (libwireshark)
Assignee [email protected]
Reporter [email protected]

Created attachment 12640 [details]
Lua reassemble dissector test

Build Information:
Version 1.10.6 (v1.10.6 from master-1.10)

Copyright 1998-2014 Gerald Combs <[email protected]> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GTK+ 2.24.14, with Cairo 1.10.2, with Pango 1.30.1, with
GLib 2.34.1, with WinPcap (4_1_3), with libz 1.2.5, without POSIX capabilities,
without libnl, with SMI 0.4.8, with c-ares 1.9.1, with Lua 5.1, without Python,
with GnuTLS 2.12.18, with Gcrypt 1.4.6, without Kerberos, with GeoIP, with
PortAudio V19-devel (built Mar  7 2014), with AirPcap.

Running on 64-bit Windows 7 Service Pack 1, build 7601, with WinPcap version
4.1.3 (packet.dll version 4.1.0.2980), based on libpcap version 1.0 branch
1_0_rel0b (20091008), GnuTLS 2.12.18, Gcrypt 1.4.6, without AirPcap.
Intel(R) Core(TM) i7 CPU       U 640  @ 1.20GHz, with 7989MB of physical
memory.


Built using Microsoft Visual C++ 10.0 build 40219

--
Not sure if it is the same as other bug reports such as #9851.
I have this Lua dissector and doing packet reassembling using the
pinfo.desegment_offset, pinfo.desegment_len, and the return value.

It works under the Linux Wireshark (1.10.5), but it doesn't work on Windows
Wireshark (tried both 1.10.5 and 1.10.6)

Attached test packet file, test dissector lua script, and a screenshot of the
same packet loaded in Linux and Windows, which shows the difference.

Thanks!


You are receiving this mail because:
  • You are watching all bug changes.