Similar story for me. Docs were patchy at best, skimming existing dissectors raised more questions than it answered. Ended up implementing a stand alone tool j

Similar story for me. Docs were patchy at best, skimming existing dissectors raised more questions than it answered. Ended up implementing a stand alone tool just leveraging libpcap to parse the pcap files and then process the according TCP packets from there, dumping information to stdout. Definitely not as nice as interactively examining packets in wireshark, but at least got it done in two days and actually found the underlying problem we were trying to find. Wonder how much easier it would've been with this.