Ethereal-users: [Ethereal-users] bug with LANMAN NetShareEnum Reponse decoding

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Jesus M. Salvo Jr." <jsalvo@xxxxxxxxxxxxxxxxx>
Date: Thu, 15 Mar 2001 18:10:26 +1100

I am actually trying out lisa that comes with KDE 2.1, so that with konqueror, you can see all the hosts and available shares ( ala windows network neighborhood ).

While doing that activity, I also have ethereal 0.8.16 running to capture my packets only ( filter is: host x.x.x.x ).

Attached is a pcap file that demonstrates the bug. To see the bug:

Load the pcap file with ethereal-0.8.16

* Click on Frame 1, the Click on Frame 2
* Look at the protocol tree for Frame 2. Notice the very long list of network shares under the LANMAN protocol tree. ( And no, there are not 2048 shares on that server )
* Now click on Frame 3, then click back again to Frame 2.
* Look at the protocol tree for Frame 2. Notice that the protocol tree is now different, without the shares. The function code for Frame 2 as per protocol tree is now NetServerEnum2, while it is really a NetShareEnum function.


In any case, there seems to be 2 bugs:

* Click from frame 3 to frame 2 makes ethereal think frame 2 is NetServerEnum2 when it is actually a NetShareEnum function. * Decoding problem with NetShareEnum because there is _not_ 2048 shares on that w2k box.


Regards,

--
Jesus M. Salvo, Jr.
Senior Consultant
PGP PUBLIC KEY: http://pgp5.ai.mit.edu:11371/pks/lookup?op=get&search=0xA5BDBF92

PowerServe Pty Ltd
Level 2, 116 Miller Street
North Sydney 2060
New South Wales, Australia
Ph: (61-2) 9492 4800
Direct (61-2) 9492 4853
Fax: (61-2) 9492 4899
http://www.powerserve.com.au
Email: jsalvo@xxxxxxxxxxxxxxxxx

This email is from PowerServe Pty Limited (ACN 069 037 056)
The information contained in this email (including any attached files) may be privileged and confidential
intended for the use of the person/persons named above. If you are not the intended recipient, you are advised that any use, distribution or copying of the information is strictly prohibited. If you have received this transmission in error, please notify PowerServe Pty Limited immediately on (61 3) 9618 1222 or reply by email to the sender.

PowerServe Pty Limited does not represent or warrant that this email or any attached files are free from computer viruses or other defects. Any attached files are provided, and may only be used, on the basis that the user assumes all responsibility for any loss, damage or consequence resulting directly or indirectly from use of the attached files. In any event, the liability of PowerServe Pty Limited is limited to either the resupply of the attached files or the cost of having the attached files resupplied.

Attachment: netshareenum.pcap
Description: Binary data