wireshark抓包和lua语言，及RTMP协议解析

最开始用netmon(microsoft network monitor 3.4)分析协议，写了一个npl脚本，协议分析快完的时候才发现，原来netmon解析会有问题（似乎会丢数据），而且npl的编程性较差。后来同事说wireshark抓包不错，就换了wireshark。

wireshark（http://www.wireshark.org）是用lua做的自定义解析，编程性要好。

写了一个RTMP包的lua解析。假设packet是从握手开始抓的：

加载时：wireshark会将包解析两遍（调用dissector），例如假设有3个RTMP包#1#2#3，则dissector初始化时会调用6次，参数依次是：#1#2#3
点击某个包时，会调用dissector，参数是该packet。例如点了#2这个包，会调用dissector。
握手完毕后，chunk时有些包不全，这时候要连着下一个包解析。

另外，解析AMF0数据时似乎会多几个0xC3字节，TCP包中有这个，但是解析成AMF结构时就将这个去掉了。在HandshakeC2这一步时，最后一个包是514bytes，解析成AMF时的tUrl的stringlength中多了一个0xC3，还有videoFunction的number值中多了一个0xC3。wireshark在解析前的TCP中也是有这两个值的，解析出来的就去掉了。是因为AMF的chunk尺寸为128，分割chunk的就是这个0xC3。（参考：http://www.acmewebworks.com/Downloads/openCS/TheAMF.pdf）。实际上是一个新的RTMP
Chunk Packet，C3表示Header为1字节，ChunkStreamId为3。

lua代码：

-- for rtmp specs 1.0
-- winlin, 2012.5.16
-- for Version 1.6.0 (SVN Rev 37592 from /trunk-1.6)

-- about winlin
if (gui_enabled()) then
-- about
function about_winlin()
browser_open_url("http://blog.csdn.net/winlinvip");
end

register_menu("Lua/Winlin", about_winlin, MENU_TOOLS_UNSORTED);
end

-- parse my rtmp
do
--[[
==============================================================================
========================global, consts and protocol===========================
==============================================================================
]]
-- define the rtmp protocol
local rtmp = Proto("AdobeRtmp", "Adobe RTMP(Real Time Messaging Protocol)");
-- the logs displayed on the LuaConsole.
debug(string.format("[global] protocol rtmp initialized."));
-- consts and pool definition.
-- const defines the server port.
local rtmpServerPort = 1935;
--[[
defines a global objects table, to stores all packets.
table(key=pkt.number, value=rtmpObject).
rtmpObject defines as:
{
id: int, the pkt.number.
src_port: int, the pkt.src_port.
type: int, the pakcet type: -1.unknown, 1.C0+C1, 2.S0+S1+S2, 3.C2, 4.ChunkPakcet.
show: bool, whether show in ui, false if analysis, otherwise true.
pre: int, previous pkt.number if it's a fragment of tcp packet. -1, uninitialized; 0, no pre; positive, the previous packet id.
refpos: int, the referenced position of previous packet. if 0, refer whole object(must refer to the pre of pre); if positive, refer to it only.
next: int, next pkt.number if it's a fragment of tcp packet. -1, uninitialized; 0, no next; positive, the next packet id.
bytes: ByteArray, the packet bytes.
packet_names: a list that contains a list of parsed names. e.g "C0+C1", "connect", "#error"
}
]]
local rtmpObjectPool = {};
-- packet decoded number, sometimes seems the wireshark will parse the packets again!
-- for example, we parsed the #4,#5,#8 packets, then the next is #4,#5,#8 again!
local rtmpTcpPacketNumber = 0;
-- defines the next packets type: 1.C0+C1, 2.S0+S1+S2, 3.C2, 4.ChunkPakcet.
-- TODO: must dynamically determinate the packet type.
local rtmpNextPacketType = 1;
-- record the parsed packet count.
local rtmpParsedPacketCount = 0;
-- record the parsed valid message length
local rtmpParsedMessageLength = 0;
-- define a global bytes pool, to reassemble the RTMP pakcets
--[[
there is a bug for ByteArray, see https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4461 TestCase:
ba = ByteArray.new("02")
ba:append(ByteArray.new("03"))
wireshark will crash! This bug causes Wireshark 1.6.1 to crash on linux and Windows.
A workaround is to use ByteArray.new(). For example, to prepend ByteArray B to ByteArray A:
A = ByteArray.new("02")
B = ByteArray.new("03")
local C = ByteArray.new( tostring(B)..tostring(A) )
]]
local rtmpBytesPool = ByteArray.new();
debug(string.format("[global] the rtmp initialized. bytes pool size=%d. server port=%d", rtmpBytesPool:len(), rtmpServerPort));
-- defines the protocol structures.
-- rtmp packet, it actually must be a rtmpHandShake or/and rtmpChunk packet.
local rtmpPacket = {
-- the handshake structure used during handshake.
rtmpHandShake = {},
-- the chunk structure is the actual packet after handshaked.
rtmpChunk = {
-- the chunk header.
ChunkHeader = {
-- basic header
BasicHeader = {
ChunkType = {},
StreamIdLow = {},
StreamIdHigh = {}
},
-- chunk message header.
ChunkMsgHeader = {
TimestampDelta = {},
MessageLength = {},
MessageTypeId = {},
MessageStreamId = {}
},
-- extended timestamp.
ExtendedTimeStamp = {}
},
-- the chunk data.
ChunkData = {}
}
};
-- alias
local rtmpChunkHeader = rtmpPacket.rtmpChunk.ChunkHeader;
local rtmpBasicHeader = rtmpPacket.rtmpChunk.ChunkHeader.BasicHeader;
local rtmpChunkType = rtmpPacket.rtmpChunk.ChunkHeader.BasicHeader.ChunkType;
local rtmpStreamIdLow = rtmpPacket.rtmpChunk.ChunkHeader.BasicHeader.StreamIdLow;
local rtmpStreamIdHigh = rtmpPacket.rtmpChunk.ChunkHeader.BasicHeader.StreamIdHigh;
local rtmpTimestampDelta = rtmpPacket.rtmpChunk.ChunkHeader.ChunkMsgHeader.TimestampDelta;
local rtmpMessageLength = rtmpPacket.rtmpChunk.ChunkHeader.ChunkMsgHeader.MessageLength;
local rtmpMessageTypeId = rtmpPacket.rtmpChunk.ChunkHeader.ChunkMsgHeader.MessageTypeId;
local rtmpMessageStreamId = rtmpPacket.rtmpChunk.ChunkHeader.ChunkMsgHeader.MessageStreamId;
local rtmpExtendedTimeStamp = rtmpPacket.rtmpChunk.ChunkHeader.ExtendedTimeStamp;
local rtmpChunkData= rtmpPacket.rtmpChunk.ChunkHeader.ChunkData;
-- defines the frame based variables
local rtmpCurrentPacket = {}; -- the current pakcet, set in the dissector, specifies the current packet.
local rtmpCurrentBuffer = {}; -- the current buffer(TvbRange object) of current packet.
local rtmpCurrentTree = {}; -- the display tree root of current pakcet.
local rtmpCurrentObject = nil; -- the current object mapped to current packet.
--[[:
the parse status of current packet.
==0 success parsed.
-1 bytes in buffer is not enouth, need more data.
-2 parse error, must clear all data in buffer.
-3 parse the chunk error, next packet must partially reference to this. see also: refpos(refence position).
]]
local rtmpCurrentStatus = 0;
debug(string.format("[global] global protocol variables and alias defined"));

-- define the decoder.
--[[
the dissctor will be invoked many times. if we has 3 packets to dissect:
1. on wireshark start: we get 6packets to dissect, in sequence of #1,#2,#3,#1,#2,#3.
for the packet list will parse the packets for #1#2#3
then the packet detail will parse the packets again for #1#2#3.
2. if user click packet #2: we get #2 to dissect.
so if #1 and #2 is one packet(separate in two tcp packet), we cannnot parse right if only click #2, but ok to click #1 then #2.
]]
function rtmp.dissector(buf, pkt, tree)
debug(string.format("[disscet] =============================================================================================="));
debug(string.format("[dissect] get a pakcet to dissect: parsed=%d id=%d, len=%d, old pool=%d, sender=%s", rtmpParsedPacketCount, pkt.number, buf:len(), rtmpBytesPool:len(), utilityRtmpDiscoverySender(pkt)));
local rtmpObject = utilityRtmpCreateOrGetObject(pkt, buf);
local buffer = utilityRtmpAppendBytesPool(rtmpObject);
-- invoke the handler when buf changed.
onRtmpBeginDissect(rtmpObject, buffer, pkt, tree);

-- set the columns info.
uiRtmpColumnProtocolSet(string.format("RTMP"));
-- the first time, must set the column text, then the append is available.
uiRtmpColumnInfoSet(string.format("RTMP: ", buf:len(), buffer:len()));

-- definese the parse offset.
local offset = 0;
local length = buffer:len();

-- dessector the packets
local root = uiRtmpTreeCreate(tree, buffer(0, buffer:len()), buffer:len());
uiRtmpTreeSetText(root, string.format("AdobeRTMP: linkups=[%s]", utilityRtmpGetObjectLinkupString(rtmpObject)));
offset = rtmpDissectAllPackets(root, buffer, offset);

if(rtmpCurrentStatus == 0) then
debug(string.format("[dissect] dissect packets success. consumed size:%d, new pool size:%d, bytes left:%d", offset, length, length - offset));
onRtmpDiessectSuccess();
elseif(rtmpCurrentStatus == -1) then
debug(string.format("[dissect] dissect some packet finished, need more bytes. consumed size:%d, pool size:%d, bytes left:%d", offset, length, length - offset));
onRtmpDiessectError(length, offset);
elseif(rtmpCurrentStatus == -2)then
critical(string.format("[dissect] dissect packet error, simply consumed all bytes in buffer!"));
onRtmpDiessectError(length, offset);
elseif(rtmpCurrentStatus == -3)then
critical(string.format("[dissect] dissect the chunk data error, this packet %d partially provides %d bytes for next.", rtmpCurrentObject.id, length - offset));
onRtmpDiessectError(length, offset);
else
critical(string.format("[dissect] unknown status=%d", rtmpCurrentStatus));
end

onRtmpDissectFinished(root, length, offset);

-- invoke the handler.
onRtmpEndDissect();
end

--[[
==============================================================================
========================defines the event handlers============================
==============================================================================
]]
--[[
when the diessector start to dissect packet, initialize the frame level variables.
]]
function onRtmpBeginDissect(rtmpObject, buf, pkt, tree)
rtmpCurrentPacket = pkt;
rtmpCurrentBuffer = buf;
rtmpCurrentTree = tree;
rtmpCurrentStatus = 0;
rtmpParsedPacketCount = rtmpParsedPacketCount + 1;
rtmpCurrentObject = rtmpObject;
-- clear the parsed packet names during every paring.
rtmpCurrentObject.packet_names = {};
end

--[[
when the diessector finish to dissect packet
]]
function onRtmpDissectFinished(root, length, offset)
-- add parsed packet names to protocol info column
local i = table.maxn(rtmpCurrentObject.packet_names) + 1;
while(i >= 0)do
local item = rtmpCurrentObject.packet_names[i];
if(item ~= nil)then
uiRtmpColumnInfoAppend(item);

if(i > 0)then
uiRtmpColumnInfoAppend(" | ");
end
end
i = i - 1;
end

-- update final status
local status = "Success";
if(rtmpCurrentStatus == -1)then
status = "#HasContinuePackets";
elseif(rtmpCurrentStatus == -2)then
status = "#ParseError";
end
uiRtmpTreeAppendText(root, string.format(" pool=%d consumed=%d available=%d status=%s", length, offset, length - offset, status));
end

--[[
when the diessector exit to dissect packet
]]
function onRtmpEndDissect()
rtmpCurrentPacket = nil;
rtmpCurrentBuffer = nil;
rtmpCurrentTree = nil;
rtmpCurrentStatus = 0;
rtmpCurrentObject = nil;
end

--[[
when the diessector dissect pakcet success.
]]
function onRtmpDiessectSuccess()
rtmpCurrentObject.show = true;
rtmpCurrentObject.next = 0;
end

--[[
when the diessector dissect pakcet error.
]]
function onRtmpDiessectError(length, offset)
-- if parsed error( for the AMF parsed error, must show it ).
if(rtmpCurrentStatus == -2)then
onRtmpDiessectSuccess();
-- if need more, show it.
elseif(rtmpCurrentStatus == -1)then
utilityRtmpAddParsedPacketName("#Partial");
rtmpCurrentObject.show = true;
rtmpCurrentObject.next = -1;
-- has a partial continue packet
elseif(rtmpCurrentStatus == -3)then
rtmpCurrentObject.show = true;
rtmpCurrentObject.next = -1;
-- the partial bytes for the next packet.
local availableBytes = length - offset;
local offsetForNextPacket = rtmpCurrentObject.bytes:len() - availableBytes;
rtmpCurrentObject.refpos = offsetForNextPacket;
end
end

--[[
==============================================================================
========================defines the parse methods=============================
==============================================================================
]]
--[[
dissector the packets from buffer and append items to root.
return the consumed bytes and set the global status rtmpCurrentStatus:
]]
function rtmpDissectAllPackets(root, buffer, offset)
rtmpCurrentStatus = 0;
local continueLoop = true;
local consumedSize = 0;
local availableSize = buffer:len() - offset;

debug(string.format("[dissect-all] start to dissect all packets. offset=%d, pool=%d, available=%d", offset, buffer:len(), availableSize));
while(continueLoop) do
local forcePacketType = -1;
-- if C2(type3) parsed success, force to parse ChunkPacket(type4)
if(rtmpCurrentObject.type == 3 and consumedSize > 0)then
forcePacketType = 4;
end

local size = rtmpDissectSinglePacket(root, buffer, offset + consumedSize, forcePacketType);

consumedSize = consumedSize + size;
availableSize = availableSize - size;

-- if error or consumed nothing, dissect packets in the next roudntrip.
continueLoop = (rtmpCurrentStatus == 0 and size > 0 and availableSize > 0);
end
debug(string.format("[dissect-all] disssect finished. offset=%d, pool=%d, consumed bytes size=%d", offset, buffer:len(), consumedSize));

return consumedSize;
end

--[[
dissector a single packet from buffer and append items to root.
return the consumed bytes and set the global status rtmpCurrentStatus.
@param forcePacketType: int value indicates the current packet type.
-1, ignore this type, the function will discovery the right type. such as 1,2,3,4.
positive, use this type. for example, a packet contains C2|ChunkPacket, and its packet type is 3(C2),
so first time, we pass -1, to parse the C2 packet.
second time, we pass 4, to force to parse the bytes in type4(ChunkPacket).
]]
function rtmpDissectSinglePacket(root, buffer, offset, forcePacketType)
-- if object contains type, use it.
-- otherwise, use the type in parse sequence.
local packetType = rtmpCurrentObject.type;
if(packetType == -1)then
packetType = rtmpNextPacketType;
end
if(forcePacketType > 0)then
packetType = forcePacketType;
end

debug(string.format(
"[dissect-one] start dissect a single packet. %s, pool size:%d, offset:%d, available=%d",
string.format("actual type:%d (logical:%d, object:%d, force:%d)", packetType, rtmpNextPacketType, rtmpCurrentObject.type, forcePacketType),
buffer:len(), offset,  buffer:len() - offset
));

local size = 0;
-- 1.C0+C1
if(packetType == 1)then
size = rtmpDissectHandShakeC0C1(root, buffer, offset);
-- 2.S0+S1+S2
elseif(packetType == 2)then
size = rtmpDissectHandShakeS0S1S2(root, buffer, offset);
-- 3.C2
elseif(packetType == 3)then
size = rtmpDissectHandShakeC2(root, buffer, offset);
-- 4.ChunkPakcet.
elseif(packetType == 4)then
size = rtmpDissectChunkPacket(root, buffer, offset);
-- invalid packet.
else
rtmpCurrentStatus = -2;
uiRtmpTreeCreate(root, buffer(offset, buffer:len()), "#Invalid Packet Type");
critical(string.format("[dissect-one] invalid packet type %d, must be 1/2/3/4.", packetType));
end

debug(string.format("[dissect-one] finished to dissect a single packet. consumed:%d", size));

return size;
end

--[[
dissector the c0c1 handshake packets from buffer and append items to root.
return the consumed bytes and set the global status rtmpCurrentStatus:
]]
function rtmpDissectHandShakeC0C1(root, buffer, offset)
local C0C1length = 1 + 1536;
local C1length = 1536;
debug(string.format("[dissect-c0c1] start to dissect the client handshake pakcet: C0C1. required %d bytes, pool size=%d", C0C1length, buffer:len()));

rtmpCurrentObject.type = 1;
if(buffer:len() < C0C1length)then
uiRtmpTreeCreate(root, buffer(offset, buffer:len() - offset), "ClientHandshake(C0C1) #Not Enough");
warn(string.format("[dissect-c0c1] failed to dissect the client handshake packet C0C1. required %d bytes, pool size=%d", C0C1length, buffer:len()));
rtmpCurrentStatus = -1;
return 0;
else
local size = 0;
local c0c1 = uiRtmpTreeCreate(root, buffer(offset, C0C1length), "ClientHandshake: C0C1");

-- C0: Version: 8 bits
local version = buffer(offset + size, 1):uint();
debug(string.format("[dissect-c0c1] c0 version decoded: version=%d", version));

-- the C0C1 must start with 0x03.
if(version ~= 0x03)then
uiRtmpTreeSetText(c0c1, "ClientHandshake: #Corrupt Pakcet");
critical(string.format("[dissect-c0c1] corrupt dissct, the C0C1 packet must startwith 0x03. actual:%d(0x%X)", version, version));
rtmpCurrentStatus = -2;
return 0;
end

uiRtmpTreeCreate(c0c1, buffer(offset + size, 1), string.format("C0(Version): %d(0x%X)", version, version));
size = size + 1;

-- C1: The C1 and S1 packets are 1536 octets long
uiRtmpTreeCreate(c0c1, buffer(offset + size, C1length), string.format("C1(Signature): size=%d(0x%X)", C1length, C1length));
size = size + C1length;

-- auto change.
utilityRtmpAddParsedPacketName("HandShake C0+C1");
rtmpNextPacketType = 2;
debug(string.format("[dissect-c0c1] C0C1 packet decoded. consumed size:%d, packet type change to:%d, object type:%d", size, rtmpNextPacketType, rtmpCurrentObject.type));

return size;
end

return 0;
end

--[[
dissector the S0S1S2 handshake packets from buffer and append items to root.
return the consumed bytes and set the global status rtmpCurrentStatus:
]]
function rtmpDissectHandShakeS0S1S2(root, buffer, offset)
local S0S1S2length = 1 + 1536 + 1536;
local S1OrS2length = 1536;
debug(string.format("[dissect-s0s1s2] start to dissect the server handshake pakcet: S0S1S2. required %d bytes, pool size=%d", S0S1S2length, buffer:len()));

rtmpCurrentObject.type = 2;
if(buffer:len() < S0S1S2length)then
uiRtmpTreeCreate(root, buffer(offset, buffer:len() - offset), "ServerHandshake(S0S1S2) #Not Enough");
warn(string.format("[dissect-s0s1s2] failed to dissect the server handshake packet s0s1s2. required %d bytes, pool size=%d", S0S1S2length, buffer:len()));
rtmpCurrentStatus = -1;
return 0;
else
local size = 0;
local s0s1s2 = uiRtmpTreeCreate(root, buffer(offset, S0S1S2length), "ServerHandshake: S0S1S2");

-- S0: Version: 8 bits
local version = buffer(offset + size, 1):uint();
debug(string.format("[dissect-s0s1s2] S0 version decoded: version=%d", version));

-- the S0S1S2 must start with 0x03.
if(version ~= 0x03)then
uiRtmpTreeSetText(s0s1s2, "ServerHandshake: #Corrupt Pakcet");
critical(string.format("[dissect-s0s1s2] corrupt dissct, the S0S1S2 packet must startwith 0x03. actual:%d(0x%X)", version, version));
rtmpCurrentStatus = -2;
return 0;
end

uiRtmpTreeCreate(s0s1s2, buffer(offset + size, 1), string.format("S0(Version): %d(0x%X)", version, version));
size = size + 1;

-- S1: The C1 and S1 packets are 1536 octets long
uiRtmpTreeCreate(s0s1s2, buffer(offset + size, S1OrS2length), string.format("C1(Signature): size=%d(0x%X)", S1OrS2length, S1OrS2length));
size = size + S1OrS2length;

-- S2: The C2 and S2 packets are 1536 octets long
uiRtmpTreeCreate(s0s1s2, buffer(offset + size, S1OrS2length), string.format("C1(Signature): size=%d(0x%X)", S1OrS2length, S1OrS2length));
size = size + S1OrS2length;

-- auto change.
utilityRtmpAddParsedPacketName("HandShake S0+S1+S2");
rtmpNextPacketType = 3;
debug(string.format("[dissect-s0s1s2] S0S1S2 packet decoded. consumed size:%d, packet type change to:%d, object type:%d", size, rtmpNextPacketType, rtmpCurrentObject.type));

return size;
end

return 0;
end

--[[
dissector the C2 handshake packets from buffer and append items to root.
return the consumed bytes and set the global status rtmpCurrentStatus:
]]
function rtmpDissectHandShakeC2(root, buffer, offset)
local C2length = 1536;
debug(string.format("[dissect-c2] start to dissect the client handshake pakcet: C2. required %d bytes, pool size=%d", C2length, buffer:len()));

rtmpCurrentObject.type = 3;
if(buffer:len() < C2length)then
uiRtmpTreeCreate(root, buffer(offset, buffer:len() - offset), "ClientHandshake(C2) #Not Enough");
warn(string.format("[dissect-c2] failed to dissect the server handshake packet c2. required %d bytes, pool size=%d", C2length, buffer:len()));
rtmpCurrentStatus = -1;
return 0;
else
local size = 0;
local c2 = uiRtmpTreeCreate(root, buffer(offset, C2length), "ClientHandshake: C2");

-- C2: The C2 and S2 packets are 1536 octets long
uiRtmpTreeCreate(c2, buffer(offset + size, C2length), string.format("C2(Signature): size=%d(0x%X)", C2length, C2length));
size = size + C2length;

-- auto change.
utilityRtmpAddParsedPacketName("HandShake C2");
rtmpNextPacketType = 4;
debug(string.format("[dissect-c2] C2 packet decoded. consumed size:%d, packet type change to:%d, object type:%d", size, rtmpNextPacketType, rtmpCurrentObject.type));

return size;
end

return 0;
end

--[[
dissector the chunk pakcet(common packet) from buffer and append items to tree.
return the consumed bytes and set the global status rtmpCurrentStatus:
]]
function rtmpDissectChunkPacket(tree, buffer, offset)
local size = 0;

debug(string.format("[dissect-chunk] start to dissect a chunk stream. pool size:%d, offset:%d, available:%d", buffer:len(), offset, buffer:len() - offset));
local root = uiRtmpTreeCreate(tree, buffer(offset, buffer:len() - offset), nil);

-- parse chunk header
size = size + rtmpParseChunkHeader(root, buffer, offset + size);
-- if parse chunk header success, parse chunk data.
if(rtmpCurrentStatus == 0)then
-- parse chunk data
size = size + rtmpParseChunkData(root, buffer, offset + size);
-- if packet parsed success, update desc
if(rtmpCurrentStatus == 0)then
warn(string.format("[dissect-chunk] parse chunk packet success. pool size=%d, offset=%d, consumed=%d, available=%d", buffer:len(), offset, size, buffer:len() - offset - size));
uiRtmpTreeSetText(root, string.format("RTMP: size=%d(0x%X)", size, size));
-- only after the packet is dissected success, set the name and size.
utilityRtmpAddParsedPacketName(utilityRtmpMessageTypeIdDesc(rtmpMessageTypeId));
uiRtmpTreeSetLength(root, size);
else
warn(string.format("[dissect-chunk] parse chunk data error. consumed size=%d(will reset to 0), status=%d", size, rtmpCurrentStatus));
size = 0;
uiRtmpTreeSetText(root, string.format("RTMP: #Partial"));
end
-- if not success, only consume 0bytes, the high-level function knows how to process it.
else
-- force to drop the corrupted datas.
-- the header must not parsed failed: maybe some corrupt datas! I donot know why.
-- TODO: fix the corrupt data.
-- there are more 2bytes at the end of packet, it is from:
-- the TCP data is 514bytes, which contains(AMF0objects) such sequence(0x0120): 74 63 55 72 6C 02 C3 00 1F 72 74 6D 70 3A
-- the 02 is string type, C3 00 is string length, decoded as: (type)string (length)193 (value).rtmp:
-- but in the parsed packets the C3 is removed! the parsed packet sequence is(0x0120): 74 63 55 72 6C 02 00 1F 72 74 6D 70 3A
-- and decoded is: (type)string (length)31 (value)rtmp:
-- so, must ensure the amf decode success.
rtmpCurrentStatus = -2;
utilityRtmpAddParsedPacketName("#Error");
warn(string.format("[dissect-chunk] parse chunk header error. consumed size=%d(will reset to 0), status=%d", size, rtmpCurrentStatus));
size = 0;
uiRtmpTreeSetText(root, string.format("RTMP: #Parse ChunkHeader Error"));
end

if(rtmpCurrentObject.type == -1)then
rtmpCurrentObject.type = 4;
end
debug(string.format("[dissect-chunk] chunk dissect finihsed. next type is:%d, object type:%d", rtmpNextPacketType, rtmpCurrentObject.type));

return size;
end

--[[
dissector the chunk header from buffer and append items to tree.
return the consumed bytes and set the global status rtmpCurrentStatus:
]]
--[[
Chunk Format
Each chunk consists of a header and data. The header itself is broken
down into three parts:
+-------------+----------------+-------------------+--------------+
| Basic header|Chunk Msg Header|Extended Time Stamp| Chunk Data |
+-------------+----------------+-------------------+--------------+
Figure 5 Chunk Format.
]]
function rtmpParseChunkHeader(root, buf, offset)
local size = 0;
local ChunkHeader = uiRtmpTreeCreate(root, buf(offset + size, 0), string.format("ChunkHeader"));

-- parse basic header
size = size + rtmpParseBasicHeader(ChunkHeader, buf, offset + size);
if(rtmpCurrentStatus ~= 0)then
return 0;
end
-- parse chunk message header
size = size + rtmpParseChunkMsgHeader(ChunkHeader, buf, offset + size);
if(rtmpCurrentStatus ~= 0)then
return 0;
end
-- parse extended timestamp
size = size + rtmpParseExtendedTimeStamp(ChunkHeader, buf, offset + size);
if(rtmpCurrentStatus ~= 0)then
return 0;
end

uiRtmpTreeSetLength(ChunkHeader, size);
uiRtmpTreeSetText(ChunkHeader, string.format("ChunkHeader: size=%d(0x%X)", size, size));
return size;
end

--[[
Chunk basic header: 1 to 3 bytes
This field encodes the chunk stream ID and the chunk type. Chunk
type determines the format of the encoded message header. The
length depends entirely on the chunk stream ID, which is a
variable-length field.
]]
function rtmpParseBasicHeader(ChunkHeader, buf, offset)
local size = 0;
local BasicHeader = uiRtmpTreeCreate(ChunkHeader, buf(offset + size, size), string.format("BasicHeader"));

size =  size + rtmpParseChunkType(BasicHeader, buf, offset + size);
if(rtmpCurrentStatus ~= 0)then
return 0;
end
size =  size + rtmpParseStreamIdLow(BasicHeader, buf, offset + size);
if(rtmpCurrentStatus ~= 0)then
return 0;
end
size =  size + rtmpParseStreamIdHigh(BasicHeader, buf, offset + size);
if(rtmpCurrentStatus ~= 0)then
return 0;
end

uiRtmpTreeSetLength(BasicHeader, size);
uiRtmpTreeSetText(BasicHeader, string.format("BasicHeader: size=%d(0x%X)", size, size));
return size;
end

--[[
the chunk type is represented by fmt field
fmt: 2 bits
This field identifies one of four format used by the ‘chunk message
header’.The ‘chunk message header’ for each of the chunk types is
explained in the next section.
]]
function rtmpParseChunkType(BasicHeader, buf, offset)
-- check the buffer overflow.
if(offset + 1 > buf:len())then
warn("[dissect-chunk] need more bytes by chunk type. buf:%d offset:%d reqired:%d", buf:len(), offset, 1);
rtmpCurrentStatus = -1;
return 0;
end

-- UINT8 ChunkType:2 // 2bits
rtmpChunkType = buf(offset, 1):bitfield(0, 2);
uiRtmpTreeCreate(BasicHeader, buf(offset, 1), string.format("ChunkType: %d (0x%x) %s", rtmpChunkType, rtmpChunkType, utilityRtmpChunkTypeDesc(rtmpChunkType)));
return 0;
end

--[[
[0, 63] The IDs 0, 1, and 2 are reserved.
0: StreamIdHigh is 1bytes.
1: StreamIdHigh is 2bytes.
2-63: StreamIdHigh is 0bytes.
Chunk stream IDs 2-63 can be encoded in the 1-byte version of this field.
0 1 2 3 4 5 6 7
+-+-+-+-+-+-+-+-+
|fmt| cs id |
+-+-+-+-+-+-+-+-+
Figure 6 Chunk basic header 1
]]
function rtmpParseStreamIdLow(BasicHeader, buf, offset)
-- check the buffer overflow.
if(offset + 1 > buf:len())then
warn("[dissect-chunk] need more bytes by chunk stream id low. buf:%d offset:%d reqired:%d", buf:len(), offset, 1);
rtmpCurrentStatus = -1;
return 0;
end

-- UINT8 StreamIdLow:6 // 6bits
rtmpStreamIdLow = buf(offset, 1):bitfield(2, 6);
uiRtmpTreeCreate(BasicHeader, buf(offset, 1), string.format("StreamIdLow: %d (0x%x) %s", rtmpStreamIdLow, rtmpStreamIdLow, utilityRtmpStreamIdLowDescrition(rtmpStreamIdLow)));
return 1;
end

--[[
winlin: if StreamIdLow is not enough, use the high.
]]
function rtmpParseStreamIdHigh(BasicHeader, buf, offset)
local size = 0;

-- UINT8 StreamIdHigh: 0, 1, 2 bytes
if(rtmpStreamIdLow == 0) then
--[[
Value 0 indicates the ID in the range of 64–319 (the second byte + 64).
Chunk stream IDs 64-319 can be encoded in the 2-byte version of this
field. ID is computed as (the second byte + 64).
0                   1
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|fmt| 0       | cs id - 64      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 7 Chunk basic header 2
This field contains the chunk stream ID minus 64.
]]
-- UINT8 StreamIdHigh // 1bytes
size = 1;
-- check the buffer overflow.
if(offset + size > buf:len())then
warn("[dissect-chunk] need more bytes by chunk stream id high. buf:%d offset:%d reqired:%d", buf:len(), offset, size);
rtmpCurrentStatus = -1;
return 0;
end
rtmpStreamIdHigh = buf(offset, size):uint();
uiRtmpTreeCreate(BasicHeader, buf(offset, size), string.format("StreamIdHigh: %d (%x)", rtmpStreamIdHigh, rtmpStreamIdHigh));
elseif(rtmpStreamIdLow == 1) then
--[[
Value 1 indicates the ID in the range of 64–65599 ((the third byte)*256 + the second byte + 64).
Chunk stream IDs 64-65599 can be encoded in the 3-byte version of
this field. ID is computed as ((the third byte)*256 + the second byte + 64).
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|fmt| 1 | cs id - 64 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 8 Chunk basic header 3
This field contains the chunk stream ID minus 64.
]]
-- UINT16 StreamIdHigh // 2bytes
size = 2;
-- check the buffer overflow.
if(offset + size > buf:len())then
warn("[dissect-chunk] need more bytes by chunk stream id high. buf:%d offset:%d reqired:%d", buf:len(), offset, size);
rtmpCurrentStatus = -1;
return 0;
end
rtmpStreamIdHigh = buf(offset, size):uint();
uiRtmpTreeCreate(BasicHeader, buf(offset, size), string.format("StreamIdHigh: %d (%x)", rtmpStreamIdHigh, rtmpStreamIdHigh));
else
-- RtmpNone StreamIdHigh; // 0bytes
rtmpStreamIdHigh = -1;
uiRtmpTreeCreate(BasicHeader, buf(offset, size), string.format("StreamIdHigh: None"));
end

return size;
end

--[[
There are four different formats for the chunk message header,
selected by the "fmt" field in the chunk basic header.
]]
function rtmpParseChunkMsgHeader(ChunkHeader, buf, offset)
local size = 0;
local ChunkMsgHeader = uiRtmpTreeCreate(ChunkHeader, buf(offset + size, size), string.format("ChunkMsgHeader"));

size =  size + rtmpParseTimestampDelta(ChunkMsgHeader, buf, offset + size);
if(rtmpCurrentStatus ~= 0)then
return 0;
end
size =  size + rtmpParseMessageLength(ChunkMsgHeader, buf, offset + size);
if(rtmpCurrentStatus ~= 0)then
return 0;
end
size =  size + rtmpParseMessageTypeId(ChunkMsgHeader, buf, offset + size);
if(rtmpCurrentStatus ~= 0)then
return 0;
end
size =  size + rtmpParseMessageStreamId(ChunkMsgHeader, buf, offset + size);
if(rtmpCurrentStatus ~= 0)then
return 0;
end

uiRtmpTreeSetLength(ChunkMsgHeader, size);
uiRtmpTreeSetText(ChunkMsgHeader, string.format("ChunkMsgHeader: size=%d(0x%X)", size, size));
return size;
end

--[[
timestamp delta: 3 bytes
For a type-1 or type-2 chunk, the difference between the previous
chunk's timestamp and the current chunk's timestamp is sent here.
If the delta is greater than or equal to 16777215 (hexadecimal
0x00ffffff), this value MUST be 16777215, and the ‘extended
timestamp header’ MUST be present. Otherwise, this value SHOULD be
the entire delta.
]]
function rtmpParseTimestampDelta(ChunkMsgHeader, buf, offset)
local size = 0;

if(rtmpChunkType == 0 or rtmpChunkType == 1 or rtmpChunkType == 2) then
-- UINT24 TimestampDelta; // 3bytes
size = 3;
-- check the buffer overflow.
if(offset + size > buf:len())then
warn("[dissect-chunk] need more bytes by timestamp delta. buf:%d offset:%d reqired:%d", buf:len(), offset, size);
rtmpCurrentStatus = -1;
return 0;
end
rtmpTimestampDelta = buf(offset, size):uint();
uiRtmpTreeCreate(ChunkMsgHeader, buf(offset, size), string.format("TimestampDelta: %d (0x%x)", rtmpTimestampDelta, rtmpTimestampDelta));
else
-- RtmpNone TimestampDelta; // 0bytes
rtmpTimestampDelta = -1;
uiRtmpTreeCreate(ChunkMsgHeader, buf(offset, size), string.format("TimestampDelta: None"));
end

return size;
end

--[[
message length: 3 bytes
For a type-0 or type-1 chunk, the length of the message is sent
here.
Note that this is generally not the same as the length of the chunk
payload. The chunk payload length is the maximum chunk size for all
but the last chunk, and the remainder (which may be the entire
length, for small messages) for the last chunk.
]]
function rtmpParseMessageLength(ChunkMsgHeader, buf, offset)
local size = 0;

if(rtmpChunkType == 0 or rtmpChunkType == 1) then
-- UINT24 MessageLength; // 3bytes
size = 3;
-- check the buffer overflow.
if(offset + size > buf:len())then
warn("[dissect-chunk] need more bytes by message length. buf:%d offset:%d reqired:%d", buf:len(), offset, size);
rtmpCurrentStatus = -1;
return 0;
end
rtmpMessageLength = buf(offset, size):uint();
debug(string.format("[dissect-chunk] the message length parsed. len=%d, previous=%d", rtmpMessageLength, rtmpParsedMessageLength));
rtmpParsedMessageLength = rtmpMessageLength;
uiRtmpTreeCreate(ChunkMsgHeader, buf(offset, size), string.format("MessageLength: %d (0x%x)", rtmpMessageLength, rtmpMessageLength));
else
-- RtmpNone MessageLength; // 0bytes
rtmpMessageLength = -1;
warn(string.format("[dissect-chunk] the message length parse failed, use previous=%d", rtmpParsedMessageLength));
uiRtmpTreeCreate(ChunkMsgHeader, buf(offset, size), string.format("MessageLength: None"));
end

return size;
end

--[[
message type id: 1 byte
For a type-0 or type-1 chunk, type of the message is sent here.
]]
function rtmpParseMessageTypeId(ChunkMsgHeader, buf, offset)
local size = 0;

if(rtmpChunkType == 0 or rtmpChunkType == 1) then
-- UINT8 MessageTypeId; // 1bytes
size = 1;
-- check the buffer overflow.
if(offset + size > buf:len())then
warn("[dissect-chunk] need more bytes by message type id. buf:%d offset:%d reqired:%d", buf:len(), offset, size);
rtmpCurrentStatus = -1;
return 0;
end
rtmpMessageTypeId = buf(offset, size):uint();
uiRtmpTreeCreate(ChunkMsgHeader, buf(offset, size), string.format("MessageTypeId: %d (0x%x) %s", rtmpMessageTypeId, rtmpMessageTypeId, utilityRtmpMessageTypeIdDesc(rtmpMessageTypeId)));
else
-- RtmpNone MessageTypeId; // 0bytes
rtmpMessageTypeId = -1;
uiRtmpTreeCreate(ChunkMsgHeader, buf(offset, size), string.format("MessageTypeId: None"));
end

return size;
end

--[[
message stream id: 4 bytes
For a type-0 chunk, the message stream ID is stored. Message stream
ID is stored in little-endian format. Typically, all messages in
the same chunk stream will come from the same message stream. While
it is possible to multiplex separate message streams into the same
chunk stream, this defeats all of the header compression. However,
if one message stream is closed and another one subsequently
opened, there is no reason an existing chunk stream cannot be
reused by sending a new type-0 chunk.
]]
function rtmpParseMessageStreamId(ChunkMsgHeader, buf, offset)
local size = 0;

if(rtmpChunkType == 0) then
-- UINT32 MessageStreamId; // 4bytes
size = 4;
-- check the buffer overflow.
if(offset + size > buf:len())then
warn("[dissect-chunk] need more bytes by message stream id. buf:%d offset:%d reqired:%d", buf:len(), offset, size);
rtmpCurrentStatus = -1;
return 0;
end
-- WINLIN: in little-endian format.
rtmpMessageStreamId = buf(offset, size):le_uint();
uiRtmpTreeCreate(ChunkMsgHeader, buf(offset, size), string.format("MessageStreamId: %d (0x%x)", rtmpMessageStreamId, rtmpMessageStreamId));
else
-- RtmpNone MessageStreamId; // 0bytes
rtmpMessageStreamId = -1;
uiRtmpTreeCreate(ChunkMsgHeader, buf(offset, size), string.format("MessageStreamId: None"));
end

return size;
end

--[[
ExtendedTimeStamp
This field is transmitted only when the normal time stamp in the
chunk message header is set to 0x00ffffff. If normal time stamp is
set to any value less than 0x00ffffff, this field MUST NOT be
present. This field MUST NOT be present if the timestamp field is not
present. Type 3 chunks MUST NOT have this field.
0 or 4 bytes
]]
function rtmpParseExtendedTimeStamp(ChunkHeader, buf, offset)
local size = 0;

if(rtmpTimestampDelta == 0x00ffffff) then
-- UINT32 ExtendedTimeStamp; // 4bytes
size = 4;
-- check the buffer overflow.
if(offset + size > buf:len())then
warn("[dissect-chunk] need more bytes by extended timestamp. buf:%d offset:%d reqired:%d", buf:len(), offset, size);
rtmpCurrentStatus = -1;
return 0;
end
rtmpExtendedTimeStamp = buf(offset, size):uint();
uiRtmpTreeCreate(ChunkHeader, buf(offset, size), string.format("ExtendedTimeStamp: %d(0x%X) (size=%d)", rtmpExtendedTimeStamp, rtmpExtendedTimeStamp, size));
else
-- RtmpNone ExtendedTimeStamp; // 0bytes
rtmpExtendedTimeStamp = -1;
uiRtmpTreeCreate(ChunkHeader, buf(offset, 0), string.format("ExtendedTimeStamp: None (size=%d)", size));
end

return size;
end

--[[
]]
function rtmpParseChunkData(root, buf, offset)
local size = 0;

-- if require more message, consumed 0.
if(buf:len() < offset + rtmpParsedMessageLength)then
warn(string.format("[dissect-chunk] the chunk data need more bytes to parse. pool size=%d, offset=%d, available=%d, required=%d", buf:len(), offset, buf:len() - offset, rtmpParsedMessageLength));
-- we think if chunk data cannot parse, it's error: a TCP packet must contains a whole chunk.
rtmpCurrentStatus = -3;
utilityRtmpAddParsedPacketName("#Partial");

return size;
end

-- consume the message data
size = rtmpParsedMessageLength;

local ChunkData = uiRtmpTreeCreate(root, buf(offset, size), string.format("ChunkData: size=%d(0x%x)", size, size));
debug(string.format("[dissect-chunk] the chunk data dissect success. pool size=%d, consumed size=%d", buf:len(), size));

return size;
end

--[[
==============================================================================
========================defines the ui methods================================
==============================================================================
]]
-- set the PacketList protocol column text
function uiRtmpColumnProtocolSet(msg)
if(rtmpCurrentObject.show)then
rtmpCurrentPacket.cols.protocol:set(msg);
end
end
-- set the PacketList info column text
function uiRtmpColumnInfoSet(msg)
if(rtmpCurrentObject.show)then
rtmpCurrentPacket.cols.info:set(msg);
end
end
-- append the PacketList info column text
function uiRtmpColumnInfoAppend(msg)
if(rtmpCurrentObject.show)then
rtmpCurrentPacket.cols.info:append(msg);
end
end
-- set the PacketDetail tree item size.
function uiRtmpTreeSetLength(root, size)
if(rtmpCurrentObject.show and root ~= nil)then
root:set_len(size);
end
end
-- set the PacketDetail tree item text.
function uiRtmpTreeSetText(root, msg)
if(rtmpCurrentObject.show and root ~= nil)then
root:set_text(msg);
end
end
-- append the PacketDetail tree item text.
function uiRtmpTreeAppendText(root, msg)
if(rtmpCurrentObject.show and root ~= nil)then
root:append_text(msg);
end
end
-- create the PacketDetail sub tree item.
function uiRtmpTreeCreate(tree, buf, msg)
if(rtmpCurrentObject.show and tree ~= nil)then
if(buf ~= nil)then
if(msg ~= nil)then
return tree:add(rtmp, buf, msg);
else
return tree:add(rtmp, buf);
end
else
return tree:add(rtmp);
end
else
return nil;
end
end

--[[
==============================================================================
========================defines the utility methods===========================
==============================================================================
]]
--[[
value: rtmpChunkType (BasicHeader.ChunkType)
]]
function utilityRtmpChunkTypeDesc(rtmpChunkType)
local value = rtmpChunkType;

if(value == 0x00) then
return "NewChunkAndMessage: start of a new chunk stream for new message.";
elseif(value == 0x01) then
return "SameMessageStream: same stream ID, variable-sized message streams.";
elseif(value == 0x02) then
return "RegisterTimeDelta: only timestamp delta, constant-sized message streams.";
elseif(value == 0x03) then
return "SameAsPreviousChunk: no header, take values from the preceding chunk.";
else
return "UnknownChunkType";
end
end
--[[
value: rtmpStreamIdLow (BasicHeader.StreamIdLow)
]]
function utilityRtmpStreamIdLowDescrition(rtmpStreamIdLow)
local value = rtmpStreamIdLow;

if(value == 0x02) then
return "(low-level message)"; -- 2: low-level message; otherwise, normal message.
else
return "";
end
end
--[[
value: rtmpMessageTypeId (ChunkMsgHeader.MessageTypeId)
]]
function utilityRtmpMessageTypeIdDesc(rtmpMessageTypeId)
local value = rtmpMessageTypeId;

--[[
5. Protocol Control Messages
RTMP reserves message type IDs 1-7 for protocol control messages.
These messages contain information needed by the RTM Chunk Stream
protocol or RTMP itself. Protocol messages with IDs 1 & 2 are
reserved for usage with RTM Chunk Stream protocol. Protocol messages
with IDs 3-6 are reserved for usage of RTMP. Protocol message with ID
7 is used between edge server and origin server.
]]
if(value == 0x01) then
return "Set Chunk Size";
elseif(value == 0x02) then
return "Abort Message";
elseif(value == 0x03) then
return "Acknowledgement";
elseif(value == 0x04) then
return "User Control Message";
elseif(value == 0x05) then
return "Window Acknowledgement Size";
elseif(value == 0x06) then
return "Set Peer Bandwidth";
elseif(value == 0x07) then
return "Edge And Origin Server Command";
--[[
3. Types of messages
The server and the client send messages over the network to
communicate with each other. The messages can be of any type which
includes audio messages, video messages, command messages, shared
object messages, data messages, and user control messages.
]]
--[[
3.1. Command message
Command messages carry the AMF-encoded commands between the client
and the server. These messages have been assigned message type value
of 20 for AMF0 encoding and message type value of 17 for AMF3
encoding. These messages are sent to perform some operations like
connect, createStream, publish, play, pause on the peer. Command
messages like onstatus, result etc. are used to inform the sender
about the status of the requested commands. A command message
consists of command name, transaction ID, and command object that
contains related parameters. A client or a server can request Remote
Procedure Calls (RPC) over streams that are communicated using the
command messages to the peer.
]]
elseif(value == 17) then
return "AMF3 Command Message.";
elseif(value == 20) then
return "AMF0 Command Message.";
--[[
3.2. Data message
The client or the server sends this message to send Metadata or any
user data to the peer. Metadata includes details about the
data(audio, video etc.) like creation time, duration, theme and so
on. These messages have been assigned message type value of 18 for
AMF0 and message type value of 15 for AMF3.
]]
elseif(value == 18) then
return "AMF3 Data Message.";
elseif(value == 15) then
return "AMF0 Data Message.";
--[[
3.3. Shared object message
A shared object is a Flash object (a collection of name value pairs)
that are in synchronization across multiple clients, instances, and
so on. The message types kMsgContainer=19 for AMF0 and
kMsgContainerEx=16 for AMF3 are reserved for shared object events.
Each message can contain multiple events.
]]
--[[
3.4. Audio message
The client or the server sends this message to send audio data to the
peer. The message type value of 8 is reserved for audio messages.
]]
elseif(value == 8) then
return "Audio message";
--[[
3.5. Video message
The client or the server sends this message to send video data to the
peer. The message type value of 9 is reserved for video messages.
These messages are large and can delay the sending of other type of
messages. To avoid such a situation, the video message is assigned
the lowest priority.
]]
elseif(value == 9) then
return "Video message";
--[[
3.6. Aggregate message
An aggregate message is a single message that contains a list of submessages.
The message type value of 22 is reserved for aggregate
messages.
]]
elseif(value == 22) then
return "Aggregate message";
--[[
3.7. User Control message
The client or the server sends this message to notify the peer about
the user control events. For information about the message format,
refer to the User Control Messages section in the RTMP Message
Foramts draft.
]]
else
return "Unknown Message Type";
end
end

--[[
print all linkups.
]]
function utilityRtmpGetObjectLinkupString(rtmpObject)
if(rtmpObject == nil or rtmpObject.pre == 0)then
return string.format("%d", rtmpObject.id);
end

-- get the whole link.
local previousLinks = string.format("%d(%d)", rtmpObject.id, rtmpObject.bytes:len());
local ppreviousObj = rtmpObject;
while(ppreviousObj.pre > 0)do
ppreviousObj = rtmpObjectPool[ppreviousObj.pre];
previousLinks = string.format("%d(%d)=>%s", ppreviousObj.id, ppreviousObj.bytes:len() - ppreviousObj.refpos, previousLinks);

-- break the partial refer
if(ppreviousObj.refpos > 0)then
break;
end
end

return previousLinks;
end

--[[
setup the linkups.
]]
function utilityRtmpSetupObjectLinkups(rtmpObject)
-- then setup the link of objects.
local previousObject = nil;
local currentId = rtmpObject.id - 1;
while(currentId >= 0)do
local obj = rtmpObjectPool[currentId];

if(obj ~= nil)then
-- if the next of obj is uninitialized, it must has a next packet.
if(obj.next == -1)then
previousObject = obj;
-- set the link.
previousObject.next = rtmpObject.id;
rtmpObject.pre = previousObject.id;
debug(string.format("[oopool] setup the linkup: %s", utilityRtmpGetObjectLinkupString(rtmpObject)));
end
end

currentId = currentId -1;
end
if(previousObject == nil)then
rtmpObject.pre = 0;
debug(string.format("[oopool] no previous pakcet found, set packet %d to single packet.", rtmpObject.id));
end
end

--[[
if object specified by pktNumber exists, get it, otherwise create a new object and push to pool
]]
function utilityRtmpCreateOrGetObject(pkt, buf)
local rtmpObject = rtmpObjectPool[pkt.number];

if(rtmpObject == nil) then
-- create a new rtmp object
rtmpObject = {
id = pkt.number,
src_port = pkt.src_port,
type = -1,
show = false,
pre = -1,
refpos = 0,
next = -1,
bytes = nil,
packet_names = {}
};

-- convert buf(Tvb) to ByteArray.
local bufByteArray = buf(0, buf:len()):bytes();
rtmpObject.bytes = ByteArray.new(tostring(bufByteArray));
debug(string.format("[oopool] nil found, create a new object."));

utilityRtmpSetupObjectLinkups(rtmpObject);

rtmpObjectPool[pkt.number] = rtmpObject;
debug(string.format("[oopool] create a new rtmp object in oo pool. id=%d, buf=%d", rtmpObject.id, rtmpObject.bytes:len()));
else
debug(string.format("[oopool] get a exists object in oo pool. id=%d, buf=%d", rtmpObject.id, rtmpObject.bytes:len()));
end

return rtmpObject;
end

--[[
insert a packet name to the current object.
]]
function utilityRtmpAddParsedPacketName(parsedPacketName)
info(string.format("[utility] add parsed packet name to object(%d): %s", rtmpCurrentObject.id, parsedPacketName));

-- insert to the head.
table.insert(rtmpCurrentObject.packet_names, 0, parsedPacketName);
end

--[[
append the buffer to the pool.
]]
function utilityRtmpAppendBytesPool(rtmpObject)
debug(string.format("[pool] start to initialize bytes pool. object.bytes=%d", rtmpObject.bytes:len()));
if(rtmpObject.bytes:len() <=  0)then
critical(string.format("[pool] the pakcet buffer must not be empty, actual size=%d", 0));
return;
end

-- clear the bytes pool and push all link bytes to pool
rtmpBytesPool = ByteArray.new();
local currentObject = rtmpObject;
while(currentObject ~= nil)do
-- must insert the object bytes in the front of pool.
rtmpBytesPool = ByteArray.new(tostring(currentObject.bytes) .. tostring(rtmpBytesPool));

currentObject = rtmpObjectPool[currentObject.pre];
-- append the partially bytes.
if(currentObject ~= nil)then
local refpos = currentObject.refpos;

-- refer to the only previous object.
if(refpos > 0)then
-- append the partial bytes.
local length = currentObject.bytes:len();
warn(string.format("[pool] get the partiical bytes from previous object: id=%d offset=%d length=%d part-bytes=%d", currentObject.id, refpos, length, length-refpos));
local partBytes = currentObject.bytes:subset(refpos, length - refpos);
rtmpBytesPool = ByteArray.new(tostring(partBytes) .. tostring(rtmpBytesPool));

-- break the loop.
currentObject = nil;
end
end
end
debug(string.format("[pool] linkup of object(%d) is %s. pool size=%d", rtmpObject.id, utilityRtmpGetObjectLinkupString(rtmpObject), rtmpBytesPool:len()));

-- return the TvbRange
return rtmpBytesPool:tvb("");
end

--[[
whether the pakcet is from server.
]]
function utilityRtmpIsFromServer(pkt)
return pkt.src_port == rtmpServerPort;
end

--[[
discovery the sender name. return "server" if from server, otherwise "client".
]]
function utilityRtmpDiscoverySender(pkt)
if(utilityRtmpIsFromServer(pkt)) then
return "server";
else
return "client";
end
end

--[[
==============================================================================
========================register protocol parser==============================
==============================================================================
]]
--[[
]]
-- register to dissector table
if(true) then
local tcp_port_table = DissectorTable.get("tcp.port");
tcp_port_table:add(1935, rtmp);
tcp_port_table:add(1985, rtmp);
end
end

自己解析的RTMP，用C++解析的结果：

[winlin@dev6 protocol]$ ./rtmp_mock_player
Usage: ./mock_client <host> <port> <vhost> <app> <stream>
host: the host to connect to.
port: the port to connect to.
vhost: the vhost to connect to.
app: the app to connect to.
stream: the stream to play.
default to ./mock-client 192.168.100.145 1935 winlin.cn vod mp4:sample1_1500kbps.f4v
mock client is a mock rtmp-client, such as the flash player, which is used to test the rtmp server
socket init success
socket connect success
start handshake...
[client] handshake: c0c1 sent to server.
[server] handshake: s0s1s2 recv from server.
[client] handshake c2 sent to server. finished!
[client] connect to app: vod, tcUrl=rtmp://winlin.cn:1935/vod
[client] connect to server success

//Real Time Messaging Protocol (Window Acknowledgement Size 2500000)
chunk:
basicHeader:
chunkType(2bits):0(0x00)
chunkStreamId(6bits):2(0x02)
chunkMsgHeader:
timeStampDelta:0(0x00000000)
messageLength:4(0x00000004)
messageType:5(0x05)
messageStreamId:0(0x00000000)
extendedTimestamp:
EmptyExtendedTimestamp:Null
chunkData:
length:4(0x00000004)
payload:4bytes 00 26 25 A0
[server] get a server response
[client] ack size set success

// Real Time Messaging Protocol (Set Peer Bandwidth 2500000,Dynamic)
chunk:
basicHeader:
chunkType(2bits):0(0x00)
chunkStreamId(6bits):2(0x02)
chunkMsgHeader:
timeStampDelta:0(0x00000000)
messageLength:5(0x00000005)
messageType:6(0x06)
messageStreamId:0(0x00000000)
extendedTimestamp:
EmptyExtendedTimestamp:Null
chunkData:
length:5(0x00000005)
payload:5bytes 00 26 25 A0 02
[server] get a server response

// Real Time Messaging Protocol (AMF0 Command _result('NetConnection.Connect.Success'))
chunk:
basicHeader:
chunkType(2bits):0(0x00)
chunkStreamId(6bits):3(0x03)
chunkMsgHeader:
timeStampDelta:0(0x00000000)
messageLength:240(0x000000F0)
messageType:20(0x14)
messageStreamId:0(0x00000000)
extendedTimestamp:
EmptyExtendedTimestamp:Null
chunkData:
length:128(0x00000080)
payload:128bytes 02 00 07 5F 72 65 73 75 6C 74 00 3F F0 00 00 00 ...
// continue...........
chunk:
basicHeader:
chunkType(2bits):3(0x03)
chunkStreamId(6bits):3(0x03)
chunkMsgHeader:
EmptyChunkMsgHeader:Null
extendedTimestamp:
EmptyExtendedTimestamp:Null
chunkData:
length:112(0x00000070)
payload:112bytes 6E 65 63 74 2E 53 75 63 63 65 73 73 00 0B 64 65 ...
[server] get a server response

// Real Time Messaging Protocol (AMF0 Command onBWDone())
chunk:
basicHeader:
chunkType(2bits):0(0x00)
chunkStreamId(6bits):3(0x03)
chunkMsgHeader:
timeStampDelta:0(0x00000000)
messageLength:21(0x00000015)
messageType:20(0x14)
messageStreamId:0(0x00000000)
extendedTimestamp:
EmptyExtendedTimestamp:Null
chunkData:
length:21(0x00000015)
payload:21bytes 02 00 08 6F 6E 42 57 44 6F 6E 65 00 00 00 00 00 ...
[server] get a server response
[server] no packet!
[client] create stream success

// For CreateStream()
// Real Time Messaging Protocol (AMF0 Command _result())
chunk:
basicHeader:
chunkType(2bits):0(0x00)
chunkStreamId(6bits):3(0x03)
chunkMsgHeader:
timeStampDelta:0(0x00000000)
messageLength:29(0x0000001D)
messageType:20(0x14)
messageStreamId:0(0x00000000)
extendedTimestamp:
EmptyExtendedTimestamp:Null
chunkData:
length:29(0x0000001D)
payload:29bytes 02 00 07 5F 72 65 73 75 6C 74 00 40 00 00 00 00 ...
[server] get a server response
[client] play success

// Real Time Messaging Protocol (Set Chunk Size 1024)
chunk:
basicHeader:
chunkType(2bits):0(0x00)
chunkStreamId(6bits):2(0x02)
chunkMsgHeader:
timeStampDelta:0(0x00000000)
messageLength:4(0x00000004)
messageType:1(0x01)
messageStreamId:0(0x00000000)
extendedTimestamp:
EmptyExtendedTimestamp:Null
chunkData:
length:4(0x00000004)
payload:4bytes 00 00 04 00
[debug] set chunk buffer size to 1024
[server] get a server response
[client] set buffer length success

// Real Time Messaging Protocol (User Control Message Stream Is Recorded 1)
chunk:
basicHeader:
chunkType(2bits):0(0x00)
chunkStreamId(6bits):2(0x02)
chunkMsgHeader:
timeStampDelta:0(0x00000000)
messageLength:6(0x00000006)
messageType:4(0x04)
messageStreamId:0(0x00000000)
extendedTimestamp:
EmptyExtendedTimestamp:Null
chunkData:
length:6(0x00000006)
payload:6bytes 00 04 00 00 00 01
[server] get a server response

// Real Time Messaging Protocol (User Control Message Stream Begin 1)
chunk:
basicHeader:
chunkType(2bits):0(0x00)
chunkStreamId(6bits):2(0x02)
chunkMsgHeader:
timeStampDelta:0(0x00000000)
messageLength:6(0x00000006)
messageType:4(0x04)
messageStreamId:0(0x00000000)
extendedTimestamp:
EmptyExtendedTimestamp:Null
chunkData:
length:6(0x00000006)
payload:6bytes 00 00 00 00 00 01
[server] get a server response

// Real Time Messaging Protocol (AMF0 Command onStatus('NetStream.Play.Reset'))
chunk:
basicHeader:
chunkType(2bits):0(0x00)
chunkStreamId(6bits):4(0x04)
chunkMsgHeader:
timeStampDelta:0(0x00000000)
messageLength:182(0x000000B6)
messageType:20(0x14)
messageStreamId:1(0x00000001)
extendedTimestamp:
EmptyExtendedTimestamp:Null
chunkData:
length:182(0x000000B6)
payload:182bytes 02 00 08 6F 6E 53 74 61 74 75 73 00 00 00 00 00 ...
[server] get a server response

// Real Time Messaging Protocol (AMF0 Command onStatus('NetStream.Play.Start'))
chunk:
basicHeader:
chunkType(2bits):0(0x00)
chunkStreamId(6bits):5(0x05)
chunkMsgHeader:
timeStampDelta:0(0x00000000)
messageLength:176(0x000000B0)
messageType:20(0x14)
messageStreamId:1(0x00000001)
extendedTimestamp:
EmptyExtendedTimestamp:Null
chunkData:
length:176(0x000000B0)
payload:176bytes 02 00 08 6F 6E 53 74 61 74 75 73 00 00 00 00 00 ..