Ethereal-users: Re: [Ethereal-users] (no subject)

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Fri, 30 Aug 2002 02:25:46 -0700
On Fri, Aug 30, 2002 at 11:47:14AM +0400, Eugene Korolev wrote:
>         Thank you very much for your reply. But I develop my own application
> with NetBIOS low-level packets. I use Ethereal as a tool for analyze
> captured packets. My question is not about using Ethereal as user. I want to
> know technical details about how Ethereal detects NetBIOS Session Message
> packets are unreassambled?

It detects it by

	1) having a mechanism that catches attempts by a dissector to
	   fetch data past the end of a packet;

	2) in some cases, reporting that as an unreassembled packet;

	3) naively assuming that NetBIOS session messages fit entirely
	   within one frame. :-)

(I.e., there's no code specific to the NetBIOS dissector to detect
that.)