Let's say you have created a second dissector msgproto
. Since you don't seem to have any multiplexing between chunks and messages, you don't need to setup a dissector table. Instead, at the end of myproto_proto.dissector
you do a
msgproto.dissector:call(buffer(68, message_length-68-20):tvb, pinfo, tree)
This will pass all the chunk data to your msgproto
. In the message protocol dissector you can use the chunk protocol's fields and of course the tvb that will contain just the data of one chunk. You will now need to piece together the chunks to one gloriously huge tvb. Make the msgproto
have state:
local stateMap = {}
function msgproto.init()
stateMap = {}
end
Convert your the tvb into a ByteArray and store into the stateMap
together with the arrays from the other calls to your dissector. When you have assembled all your data into one array, let's call it oarr
, make a tvb out of it:
local otvb = ByteArray.tvb(oarr, "message data")
-- starting from 0, need to pass a tvb range, not a tvb.
stree:add(msgproto.fields.payload, otvb(0))
supposed you have payload
field of type Protofield.bytes
. This code will make a new data pane called "message data" appear next to your regular "Frame" pane at the bottom of your Wireshark window.
I'm not sure how well Wireshark will like your ultra large buffers. Apart from that, I'm quite convinced that the approach outlined above will work. I have not used the described techniques in this exact order, but I have used all the described techniques, for example to make a new byte pane filled with data deflated in pure Lua.