TCP Reassembly:

• https://wiki.wireshark.org/TCP_Reassembly

Offizielle Doku:

• https://wiki.wireshark.org/Lua/Dissectors#postdissectors
• Chapter 10. Lua Support in Wireshark
• Chapter 11. Wireshark’s Lua API Reference Manual

Forum:

• Calling Lua Dissectors from Lua Dissector

Anleitungen:

• https://delog.wordpress.com/2010/09/27/create-a-wireshark-dissector-in-lua/
• https://delog.wordpress.com/2012/06/25/obtain-dissection-data-field-and-fieldinfo/
• https://delog.wordpress.com/2013/05/21/dealing-with-segmented-data-in-a-wireshark-dissector-written-in-lua/
• https://delog.wordpress.com/2011/04/20/custom-dissector-for-ethertype-link-layer-and-ip-protocol/
• https://delog.wordpress.com/2017/04/25/wireshark-dissector-in-lua-for-custom-protocol-over-websockets/

Display only SYN-Packets

  tcp.flags.syn==1 && !tcp.flags.ack==1

Display SYN-ACK-Packets

  tcp.flags.syn==1 && tcp.flags.ack==1

Durch das Hinzufügen zwei weiterer 'Custom'-Spalten lässt sich die Analyse vereinfachen:

  tcp.stream
  tcp.time_delta
  

• File Format
• Dev-Libraries Ubuntu: sudo apt-get install libpcap-dev