Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] Save extracted data from reassembled packets

From: Peter Smith <psmith135@xxxxxxxxx>
Date: Sun, 21 Feb 2010 21:00:26 +0200

I need to extract reassembled packet data in wireshark and either save it to file or better pass it over stdout to another program. In the latter case I guess it has to be converted to hex string for safe piping. 

I have the following code to get the reassembled WSP payload out of packet in wireshark

wsp_extractor ="wsp")
tap =,"wsp")
function tap.packet(pinfo,tvb)
local wsp_pdu =  wsp_extractor().range
if wsp_pdu then

If the reassembled data comes from several packets I get the following error:
tshark: Lua: on packet 164 Error During execution of Listener Packet Callback:
expired tvb

If the extracted data is contained within one packet I get a truncated string:

Apparently it should be a straightforward task but I am probably missing something... What am I doing wrong here?