ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Possibility to modify buffer?

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 16 Sep 2009 18:33:56 -0700

On Sep 16, 2009, at 2:00 AM, Christian Gurk wrote:

That works so far. Now, if the checksum is ok (no frameerror) I would
like to decrypt the data and pass it to the next dissector to evaluate
the content of the frame further.

You would need to allocate a new tvbuff, and a blob big enough to hold all the decrypted data, and decrypt the data into the blob and attach that blob to the tvbuff, and hand *that* tvbuff to the next dissector. You cannot modify the data in a tvbuff handed to you.

I don't know the details of how to do that in a Lua dissector.