Wireshark · Ethereal-dev: [Ethereal-dev] A question in for NBSS dissector

[Huagang Xie <xie@xxxxxxxx>]

Hi, 

in packet-nbns.c


        if (pinfo->match_port == TCP_PORT_CIFS) {
                /*
                 * Windows 2000 CIFS clients can dispense completely
                 * with the NETBIOS encapsulation and directly use CIFS
                 * over TCP. As would be expected, the framing is
                 * identical, except that the length is 24 bits instead
                 * of 17. The only message types used are
                 * SESSION_MESSAGE and SESSION_KEEP_ALIVE.
                 */
                is_cifs = TRUE;
        } else {
                is_cifs = FALSE;
        }

The TCP_PORT_CIFS here is 445, but even if on port 445, the SMB/CIFS is still over NETBIOS-SS. Since this affect the "netbios-length" checking later, 

              /*
                 * We have enough data for an NBSS header.
                 * Get the flags and length of the message,
                 * and see if they're sane.
                 */
                if (is_cifs) {
                        flags = 0;
                        length = tvb_get_ntoh24(tvb, offset + 1);
                } else {
                        flags = tvb_get_guint8(tvb, offset + 1);
                        length = tvb_get_ntohs(tvb, offset + 2);
                        if (flags & NBSS_FLAGS_E)
                                length += 65536;
                }

And will make some CIFS/SMB packet over port 445 dissect as NBSS packet rather than continue dissect as "SMB/DCERPC" etc when the "flags!=0"

I will suggest to remove this (is_cifs) checking, Any idea?

Huagang

-- 
LIDS secure linux kernel
http://www.lids.org/
1024D/B6EFB028 		4731 2BF7 7735 4DBD 3771  4E24 B53B B60A B6EF B028

Attachment: pgp2TWMPiShlZ.pgp
Description: PGP signature