To promote my Hack In The Box Wireshark training, I’ll start to publish some Lua dissectors.
Here is a screenshot of my TCP Flags dissector. It was generated (and adapted) with my Wireshark Lua dissector generator. It displays TCP flags like Snort does.
You can clearly see the SYN – SYN/ACK – ACK phase of the first TCP connection (packets 1, 2 and 3).
Didier Stevens 