Ethereal-dev: Re: [Ethereal-dev] SMBpatch for read/write and x

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxx>
Date: Wed, 28 Nov 2001 12:35:45 -0800 (PST)
> > I assume this is some optimization, if dissecting in the tree under the 
> > protocol branch: proto_pipe, then ONLY check hf_index entries
> > registred for proto_pipe and ignore anything else.
> 
> But if I type in "smb" as a filter string (a good trick btw) I get
> all smbs and all msrpc transactions.  By your reasoning above I should
> only get the SMB transactions and not the msrpc ones?

Yes, I'd consider it a bug if the filter "smb.fid" didn't show me *ALL*
packets with an "smb.fid" field, *regardless* of whether they're under
the "smb" protocol tree or not; at least for me, and I infer for you as
well, it violates the Principle of Least Astonishment.