Ethereal-dev: Re: [Ethereal-dev] Reassembly of security blob in SMB dissector

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxx>
Date: Mon, 3 Feb 2003 10:44:18 -0800
On Mon, Feb 03, 2003 at 11:51:28AM +0100, Jean-Baptiste Marchand wrote:
> Because of the token size, the SessionSetupAndX request is carried over
> two NBSS messages.

No, it's entirely inside one NBSS message.

However, the NBSS message is carried inside two TCP segments, so you
have to enable TCP reassembly; it's the "Allow subdissector to desegment
TCP streams" option for the TCP protocol.

> Looking at the SMB dissector options, it seems that fragmentation
> reassembly is currently possible for DCE/RPC PDU (carried over SMB
> named pipes) and SMB Transact payload command. Does security blob
> reassembly would fit in the same category?

No, it wouldn't, because security blobs don't have their own form of
fragmentation - they're not fragmented over SMB messages, and SMB
messages aren't fragmented over NBSS messages, so the stuff that already
exists to reassemble NBSS messages is sufficient.