Ethereal-dev: Re: [Ethereal-dev] patches for memory leaks

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 29 Oct 2003 12:46:42 -0800

On Oct 29, 2003, at 6:52 AM, sford@xxxxxxxxxxxxx wrote:


Does anybody know anything about the smb dissector?  Expecially having
to do with parsing "conversations".  It looks like it saves information
that spans multiple packets, possibly matching requests with replies.
It, and a number of other dissectors for request/reply protocols, save information about requests and matches them with the corresponding reply, in order to: 

	1) compute server response times;
2) get enough information to be able to dissect the reply (ONC RPC and DCE RPC don't include the opcode in the reply - you need the request to see that - and SMB transaction operations don't include enough information in the reply to decode the reply, either).