Wireshark · Wireshark-users: [Wireshark-users] Lua Field API and multiple occurences

[Holger Freyther <holger@xxxxxxxxxxx>]

Good Morning,

I am currently writing an analysis script in Lua for GSM Abis RSL. For
releasing a radio channel there is a "RF Channel Release" command and
a "RF Channel Release ACK" response. I want to calculate the time that
passed between these two.

Currently I am doing:

 local tap = Listener.new("ip", "gsm_abis_rsl.msg_type == 0x2e ||
                      gsm_abis_rsl.msg_type == 0x33 ")
 local ip_src_field = Field.new("ip.src")
 local ip_dst_field = Field.new("ip.dst")
 local frame_field  = Field.new("frame.number")
 local time_field   = Field.new("frame.time_epoch")
 local rsl_field    = Field.new("gsm_abis_rsl.msg_type")
 local cbits_field  = Field.new("gsm_abis_rsl.ch_no_Cbits")
 local ts_field     = Field.new("gsm_abis_rsl.ch_no_TN")

 local connections = {}

 tap.packet(pinfo,tvb,ip)
    if rsl == "46" then
      handle_release(....)
    elseif rsl == "51" then
      handle_release_ack(...)
    end
 end

My issue is that using this approach I can miss RSL packets. The
equipment we have is using TCP/IP to transport the rsl messages
and there is a small header (16 bit length, one byte tag) in front
of each of the RSL messages.

What happens from time to time is that inside a single frame and
TCP packet there are multiple RSL messages. And when this happens
rsl_field() will only give me value of the first RSL message.

Is there a way to get all the values?


holger