Ethereal-users: Re: [ethereal-users] Bad NETBIOS Packets

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Mon, 23 Aug 1999 15:07:12 -0700 (PDT)
> I suspect that if you check the first bad packet the LLC Control field func
> value will be SABME. If this is true the packet are caused by the two
> network stations creating a connection at the LLC level (Data Link
> Switching).  The packets are seen as NETBIOS by the LLC dissector because
> the DSAP is 0xf0.  The dissect_netbios code could be improved to check the
> LLC control field value and ignore packets that should not be passed to it.
> I think better way would be have the LLC dissector code handle the Data Link
> Switching functions instead.

Actually, when handed a U frame, shouldn't the LLC dissector just call
the per-SAP dissectors for UI frames, not for other U frames?  This
means that "dissect_xdlc_control()" should return not just XDLC_S,
XDLC_U, or XDLC_I, but, for U frames, return something that includes the
modifier field as well.