Ethereal-dev: RE: [ethereal-dev] phantom smb dissection

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Jeff Foster <jfoste@xxxxxxxxxxxx>
Date: Fri, 12 May 2000 12:08:06 -0500
>
>Hi,
>
>Ethereal 0.8.8 (and the current CVS) exhibit a bug whereby they 
>dissect & display data that isn't really in the packet.
>
>Take a look at the enclosed capture file. If packet 117 is displayed
>first then the TCP content should just be "Continuation data" but if
>packet 115 is displayed first and then 117 is displayed the netbios
>and session stuff from packet 115 is still being seen when 117 is
>displayed.

You are right.  The problem is that the smb dissector doesn't check 
for the end of the packet. The 'Testy' buffer stuff should handle this.

The other interesting thing is that the actual SMB data is in packet 
118.  This is a place that the 'logical' display would be needed.


Jeff Foster
jfoste@xxxxxxxxxxxx