Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: [Wireshark-users] Lua: unique identifier for pinfo?

Date Prev · Date Next · Thread Prev · Thread Next
From: Ico Doornekamp <wireshark@xxxxxxx>
Date: Sat, 30 Jan 2021 10:52:17 +0100
Short version: In my Lua dissector I think I need to be able to uniquely
identify packets, but pinfo.number is not unique; is there any other way
to get an unique identifier for a packet?

Long version: I'm writing a dissector for a custom protocol. This
protocol multiplexes multiple logcal streams through one websocket
stream, an each of these individual streams is deflated with zlib, using
it's own individual zlib state. My dissector identifies the streams and
inflates the packets on the first dissection pass, storing the deflated
data in a global Lua table. On successive calls to .dissect(), I need to
be able to find the appropriate inflated data for each packet, and
dissect it further from there. The problem is that I need a solid way to
recognize and identify the individual packets. "pinfo.number" is not
enough, so for now I use a concationation of pinfo and a has of the tvb
data; unfortunately this is rather heavy and still not quite solid and I
have occasional false negatives in my lookup. 

Is there a better way to uniquely identify individual pinfo packets?

Thanks,

--
:wq
^X^Cy^K^X^C^C^C^C