Ethereal-dev: Re: [Ethereal-dev] DCE-RPC - multiple PDUs in a TCP segment

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Richard Sharpe <rsharpe@xxxxxxxxxxxxxxxxx>
Date: Sun, 12 Oct 2003 09:03:19 -0700 (PDT)
On Sun, 12 Oct 2003, Yaniv Kaul wrote:

> What happens if there's more than one PDU in more than one TCP segment?
> It appears that only the first PDU is dissected.

Have you enabled SMB to desegment as well as TCP? There are two SMB 
preferences, and one relates to DCERPC reassembly. 
 
> Please take a look at packet 9 of the attached capture (when enabling
> desegmentation in the TCP and DCERPC protocols).
> You can see that in location 0x7e8 a new DCERPC PDU begins. However,
> there's no call for the DCERPC dissector to dissect it.
> Could be that I don't fully understand the logic for desegmenting TCP.
> I'd appreciate if someone can perhaps point to documentation on it (other
> than packet-tcp.c).
> 
> 
> 
> 

-- 
Regards
-----
Richard Sharpe, rsharpe[at]ns.aus.com, rsharpe[at]samba.org, 
sharpe[at]ethereal.com, http://www.richardsharpe.com

Attachment: dcerpc-seg.cap
Description: Binary data

_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev