Ethereal-dev: Re: [Ethereal-dev] nfs : patch to snoop fhandle to filenames

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: "Dr. Uwe Girlich" <Uwe.Girlich@xxxxxxxxxxx>
Date: Mon, 14 Jan 2002 10:56:17 +0100
Hello!

On Sat, Jan 12, 2002 at 11:02:55AM +1100, Ronnie Sahlberg wrote:
> attached is a new patch for nfs name snooping, it fixes the bug where the '/'
> separating path components were sometimes missing.

> the patch snoops certain nfs and mount packets to track the fhandle to
> filename mapping.
"certain" is the important word here. It works fairly good (SYMLINK is
missing) with NFSv3 but I could not get it to work with nfsv2.pcap.gz from the
web-site. Mount version 1 is missing (that is easy to add) but somehow all the
NFSv2 LOOKUP replies don't result in a file name (packets 23+24). But there
is already a LOOKUP check in the dissect_fhandle() code. Really strange!

Bye, Uwe