Wireshark lua dissector 对TCP消息包合并分析

应用程序发送的数据报都是流式的，IP不保证同一个一个应用数据包会被抓包后在同一个IP数据包中，因此对于使用自制dissector的时候需要考虑这种情况。

Lua Dissector相关资料可以见：http://wiki.wireshark.org/Lua/Dissectors

Lua脚本书写wireshark dissector非常方便，使用Lua合并tcp数据报进行分析的样例如下，其实就是多了一个条件分支，所谓难者不会，会者不难：

 local slicer = Proto("slicer","Slicer")
 function slicer.dissector(tvb, pinfo, tree)
     local offset = pinfo.desegment_offset or 

     local len = get_len() -- for tests i used a constant, but can be taken from tvb

     while true do
         local nxtpdu = offset + len

         if nxtpdu > tvb:len() then
             pinfo.desegment_len = nxtpdu - tvb:len()
             pinfo.desegment_offset = offset
             return
         end

         tree:add(slicer, tvb(offset, len))

         offset = nxtpdu

         if nxtpdu == tvb:len() then
              return
         end
     end
 end
 local tcp_table = DissectorTable.get("tcp.port")
 tcp_table:add(, slicer)

对于Lua Dissector脚本使用方法如下：

tshark

tshark -X lua_script:slicer.lua -i lo0 -f "tcp port 2506" -O aa -V

Wireshark

On OSX

Copy slicer.lua to ~/.wireshark

Add dofile(USER_DIR.."slicer.lua") to the end of /Applications/Wireshark.app/Contents/Resources/share/wireshark/init.lua

在wireshark的C语言版本中，有针对tcp合并报的相关函数，packet-tcp.c 具体见下：

/*
2152     * Loop for dissecting PDUs within a TCP stream; assumes that a PDU
2153     * consists of a fixed-length chunk of data that contains enough information
2154     * to determine the length of the PDU, followed by rest of the PDU.
2155     *
2156     * The first three arguments are the arguments passed to the dissector
2157     * that calls this routine.
2158     *
2159     * "proto_desegment" is the dissector's flag controlling whether it should
2160     * desegment PDUs that cross TCP segment boundaries.
2161     *
2162     * "fixed_len" is the length of the fixed-length part of the PDU.
2163     *
2164     * "get_pdu_len()" is a routine called to get the length of the PDU from
2165     * the fixed-length part of the PDU; it's passed "pinfo", "tvb" and "offset".
2166     *
2167     * "dissect_pdu()" is the routine to dissect a PDU.
2168     */
    void
    tcp_dissect_pdus(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
                     gboolean proto_desegment, guint fixed_len,
                     guint (*get_pdu_len)(packet_info *, tvbuff_t *, int),
                     dissector_t dissect_pdu)
    {
        volatile int offset = ;
        int offset_before;
        guint length_remaining;
        guint plen;
        guint length;
        tvbuff_t *next_tvb;
        proto_item *item=NULL;
        void *pd_save;

        while (tvb_reported_length_remaining(tvb, offset) != ) {
            /*
2186             * We use "tvb_ensure_length_remaining()" to make sure there actually
2187             * *is* data remaining.  The protocol we're handling could conceivably
2188             * consists of a sequence of fixed-length PDUs, and therefore the
2189             * "get_pdu_len" routine might not actually fetch anything from
2190             * the tvbuff, and thus might not cause an exception to be thrown if
2191             * we've run past the end of the tvbuff.
2192             *
2193             * This means we're guaranteed that "length_remaining" is positive.
2194             */
            length_remaining = tvb_ensure_length_remaining(tvb, offset);

            /*
2198             * Can we do reassembly?
2199             */
            if (proto_desegment && pinfo->can_desegment) {
                /*
2202                 * Yes - is the fixed-length part of the PDU split across segment
2203                 * boundaries?
2204                 */
                if (length_remaining < fixed_len) {
                    /*
2207                     * Yes.  Tell the TCP dissector where the data for this message
2208                     * starts in the data it handed us and that we need "some more
2209                     * data."  Don't tell it exactly how many bytes we need because
2210                     * if/when we ask for even more (after the header) that will
2211                     * break reassembly.
2212                     */
2213                    pinfo->desegment_offset = offset;
2214                    pinfo->desegment_len = DESEGMENT_ONE_MORE_SEGMENT;
                    return;
                }
            }

            /*
2220             * Get the length of the PDU.
2221             */
            plen = (*get_pdu_len)(pinfo, tvb, offset);
            if (plen < fixed_len) {
                /*
2225                 * Either:
2226                 *
2227                 *  1) the length value extracted from the fixed-length portion
2228                 *     doesn't include the fixed-length portion's length, and
2229                 *     was so large that, when the fixed-length portion's
2230                 *     length was added to it, the total length overflowed;
2231                 *
2232                 *  2) the length value extracted from the fixed-length portion
2233                 *     includes the fixed-length portion's length, and the value
2234                 *     was less than the fixed-length portion's length, i.e. it
2235                 *     was bogus.
2236                 *
2237                 * Report this as a bounds error.
2238                 */
                show_reported_bounds_error(tvb, pinfo, tree);
                return;
            }

            /*
2244             * Do not display the the PDU length if it crosses the boundary of the
2245             * packet and no more packets are available.
2246             *
2247             * XXX - we don't necessarily know whether more packets are
2248             * available; we might be doing a one-pass read through the
2249             * capture in TShark, or we might be doing a live capture in
2250             * Wireshark.
2251             */
    #if 0
            if (length_remaining >= plen || there are more packets)
            {
    #endif
                    /*
2257                     * Display the PDU length as a field
2258                     */
                    item=proto_tree_add_uint(pinfo->tcp_tree, hf_tcp_pdu_size,
                                             tvb, offset, plen, plen);
                    PROTO_ITEM_SET_GENERATED(item);
    #if 0
            } else {
                    item = proto_tree_add_text(pinfo->tcp_tree, tvb, offset, -,
                        "PDU Size: %u cut short at %u",plen,length_remaining);
                    PROTO_ITEM_SET_GENERATED(item);
            }
    #endif

            /* give a hint to TCP where the next PDU starts
2272             * so that it can attempt to find it in case it starts
2273             * somewhere in the middle of a segment.
2274             */
            if(!pinfo->fd->flags.visited && tcp_analyze_seq) {
                guint remaining_bytes;
                remaining_bytes=tvb_reported_length_remaining(tvb, offset);
                if(plen>remaining_bytes) {
                    pinfo->want_pdu_tracking=;
                    pinfo->bytes_until_next_pdu=plen-remaining_bytes;
                }
            }

            /*
2285             * Can we do reassembly?
2286             */
            if (proto_desegment && pinfo->can_desegment) {
                /*
2289                 * Yes - is the PDU split across segment boundaries?
2290                 */
                if (length_remaining < plen) {
                    /*
2293                     * Yes.  Tell the TCP dissector where the data for this message
2294                     * starts in the data it handed us, and how many more bytes we
2295                     * need, and return.
2296                     */
                    pinfo->desegment_offset = offset;
                    pinfo->desegment_len = plen - length_remaining;
                    return;
                }
            }

            /*
2304             * Construct a tvbuff containing the amount of the payload we have
2305             * available.  Make its reported length the amount of data in the PDU.
2306             *
2307             * XXX - if reassembly isn't enabled. the subdissector will throw a
2308             * BoundsError exception, rather than a ReportedBoundsError exception.
2309             * We really want a tvbuff where the length is "length", the reported
2310             * length is "plen", and the "if the snapshot length were infinite"
2311             * length is the minimum of the reported length of the tvbuff handed
2312             * to us and "plen", with a new type of exception thrown if the offset
2313             * is within the reported length but beyond that third length, with
2314             * that exception getting the "Unreassembled Packet" error.
2315             */
            length = length_remaining;
            if (length > plen)
                length = plen;
            next_tvb = tvb_new_subset(tvb, offset, length, plen);

            /*
2322             * Dissect the PDU.
2323             *
2324             * Catch the ReportedBoundsError exception; if this particular message
2325             * happens to get a ReportedBoundsError exception, that doesn't mean
2326             * that we should stop dissecting PDUs within this frame or chunk of
2327             * reassembled data.
2328             *
2329             * If it gets a BoundsError, we can stop, as there's nothing more to
2330             * see, so we just re-throw it.
2331             */
            pd_save = pinfo->private_data;
            TRY {
                (*dissect_pdu)(next_tvb, pinfo, tree);
            }
            CATCH(BoundsError) {
                RETHROW;
            }
            CATCH(ReportedBoundsError) {
                /*  Restore the private_data structure in case one of the
2341                 *  called dissectors modified it (and, due to the exception,
2342                 *  was unable to restore it).
2343                 */
                pinfo->private_data = pd_save;
                show_reported_bounds_error(tvb, pinfo, tree);
            }
            ENDTRY;

            /*
2350             * Step to the next PDU.
2351             * Make sure we don't overflow.
2352             */
            offset_before = offset;
            offset += plen;
            if (offset <= offset_before)
                break;
        }
    }