Ethereal-dev: [Ethereal-dev] re: packet-ip.c

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Pia Sahlberg" <piabar@xxxxxxxxxxx>
Date: Wed, 26 Sep 2001 22:27:33 +0000
The only untvbuffified dissectors are the SOCKS and SMB dissectors. The SOCKS dissector only dissects TCP, and SMB would run only over TCP 
or UDP.



Unless some ICMP implementation puts more than "Internet Header
+ 64 bits of Original Data Datagram" into an ICMP message, the TCP or
UDP payload won't be in the ICMP reply, so the SOCKS and SMB dissectors
shouldn't be called.


I think most implementations add more than 8 bytes of layer 4.
I would think that many implementations would actually add up to
576 bytes.

Regarding SMB. Soon (as in within one week) I will upload a tvbuffified
version of packet-smb.c


_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp