["Ronnie Sahlberg" <ronnie_sahlberg@xxxxxxxxxxxxxx>]

----- Original Message -----
From: "Tim Potter"
Sent: Sunday, April 13, 2003 1:49 PM
Subject: [Ethereal-dev] Re: [Ethereal-cvs] cvs commit: ethereal packet-smb.c
smb.h


> On Sat, Apr 12, 2003 at 03:14:04AM -0500, Ronnie Sahlberg wrote:
>
> >   Log:
> >   Rewrite the DCERPC over SMB reassembly completely.
>
> Hooray!  That code was seriously confusing.

Yes, it was an ugly hack thaty evolved from first just reassebmling dcerpc
over Transaction
to add Read and Writes to the ipc pipe as well as we got informed about more
and different
ways dcerpc could be transported ontop of ncacn_smb
It did reassebmle "most" dcerpc pdu's over smb but it had to be fixed
properly anyway since
i was informed about a, to me, new way dcerpc can be encapsulated ontop of a
named pipe.


i have been told that some packet analyzers out there that are so primitive
that they can not even
reassemble dcerpc over tcp.  is that true?   :-)