Revision history [back]

Regarding " I used up all the 200 local variables at ProtoFields, and from the looks I still have use for at least 200+ variables." ...

You can use a table to group them all into a single variable, for example, a snippet from the Guacamole dissector I wrote and published on the Wireshark wiki:

-- Fields
local pf = {
    length = ProtoField.uint32("guacp.len", "Length", base.DEC, nil, 0, "The length of the message"),
    instructions = ProtoField.uint32("guacp.instructions", "Instructions", base.DEC, nil, 0, "The number of instructions"),
    instruction = ProtoField.bytes("guacp.instruction", "Instruction", base.NONE),
    ...
}

-- Register protocol fields
p_guacp.fields = pf

And an example usage:

local function dissect_instruction(tvbuf, pinfo, tree, offset, count)
    local instr_tree

    ...
    instr_tree = tree:add(pf.instruction, tvbuf(offset, (off + 1) - offset)):set_text("Instruction " .. count .. ": ")
    ...

end -- dissect_instruction()

Maybe see how far you get with this idea and reply again if you're still hitting resource limits?