Looking for strategies when Lua dissectors are getting too big

asked 2025-01-08 00:04:35 +0000

tasty_sprout
1 ●1 ●1

updated 2025-01-08 00:05:04 +0000

Hey there!

While working on my first dissector I hit Wireshark's and Lua's ressource constraints. I used up all the 200 local variables at ProtoFields, and from the looks I still have use for at least 200+ variables. At the moment the dissector has about 2000 lines of code, and I covered roughly 20% of the protocol.

I get error messages like these:

[..] too many local variables (limit is 200) ..
[..] function or expression too complex near ..

The second error is apparently from the Lua VM. According to this SO comment the Lua VM has (only) 255 registers: https://stackoverflow.com/q/54609218

There is potential to reduce the number of local variables within functions that get referenced by proto.dissector() - but the readability of the code will suffer, and I'm not sure if these non-ProtoField local variables are contributing to the exhaustion after all. Nevertheless such an optimization won't free nearly enough variables to cover the remaining 80% of the protocol.

I found this posting in which cmaynard suggested putting the variables in a Lua table but the example wasn't verbose enough for me to successfully apply. I tried putting ProtoFields in a table but I failed unpacking the content in proto.fields = {}. :(

https://osqa-ask.wireshark.org/questi...

So what are the/my options to successfully implement such a variable-heavy protocol in Wireshark?

Break up the dissector and write a dissector for each component of the protocol?
Use global variables instead of local vars?
[Your brilliant suggestions here :) ]

Thank you and have a nice day!

edit retag flag offensive close merge delete

add a comment

-- Fields local pf = { length = ProtoField.uint32("guacp.len", "Length", base.DEC, nil, 0, "The length of the message"), instructions = ProtoField.uint32("guacp.instructions", "Instructions", base.DEC, nil, 0, "The number of instructions"), instruction = ProtoField.bytes("guacp.instruction", "Instruction", base.NONE), ... } -- Register protocol fields p_guacp.fields = pf

local function dissect_instruction(tvbuf, pinfo, tree, offset, count) local instr_tree ... instr_tree = tree:add(pf.instruction, tvbuf(offset, (off + 1) - offset)):set_text("Instruction " .. count .. ": ") ... end -- dissect_instruction()

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Looking for strategies when Lua dissectors are getting too big

1 Answer

Your Answer

Question Tools

Stats

Related questions

Looking for strategies when Lua dissectors are getting too big edit

1 Answer

Your Answer

Question Tools

Stats

Related questions

Looking for strategies when Lua dissectors are getting too big