["Ronnie Sahlberg" <sahlberg@xxxxxxxxxxxxxxxx>]

Hi list,

New attempt for dcerpc request response matching.

This one holds three hash tables.
First hashtable is used to store BIND requests.
Second table is used to store CALLs,
Third table stores both calls and requests and is indexed by pinfo->fd->num

It should work better than the previous one. I hope.
As before it offers a pointer which can be used by subdissectors to store
persistent data between requests and responses.

Guy, can you test this one and see if it works better than the previous
one/original one for your capture?
Tim, Todd, do you have any comments?


I tried to make the changes to the dissector for dcerpc over datagram
transports look reasonably correct but have not been
able to test that part. It may well be broken.

Attachment: dcerpc.patch
Description: Binary data