Hello, Guy Harris!
Should I wait for other packets if NetBIOS Session Message was
reassembled with truncated end? Do you know another methods to detect the
total number of NetBIOS Session Message Response packets? What method is
used by Windows?
Eugene
----- Original Message -----
From: "Guy Harris" <gharris@xxxxxxxxx>
To: "Eugene Korolev" <korolev@xxxxxxxxxxx>
Cc: "ethereal users" <ethereal-users@xxxxxxxxxxxx>; "Visser, Martin
(Sydney)" <Martin.Visser@xxxxxx>
Sent: Friday, August 30, 2002 1:25 PM
Subject: Re: [Ethereal-users] (no subject)
> On Fri, Aug 30, 2002 at 11:47:14AM +0400, Eugene Korolev wrote:
> > Thank you very much for your reply. But I develop my own
application
> > with NetBIOS low-level packets. I use Ethereal as a tool for analyze
> > captured packets. My question is not about using Ethereal as user. I
want to
> > know technical details about how Ethereal detects NetBIOS Session
Message
> > packets are unreassambled?
>
> It detects it by
>
> 1) having a mechanism that catches attempts by a dissector to
> fetch data past the end of a packet;
>
> 2) in some cases, reporting that as an unreassembled packet;
>
> 3) naively assuming that NetBIOS session messages fit entirely
> within one frame. :-)
>
> (I.e., there's no code specific to the NetBIOS dissector to detect
> that.)
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
> -
>
>