Ethereal-users: [Ethereal-users] how to tell the difference of SMB srvsvc/NetrShareEnum and winr

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Zuwei Liu <zuwei@xxxxxxxxxxxxxxxxxxxx>
Date: Tue, 18 Nov 2003 20:34:15 -0800
Hi,
I had a problem to recognize SMB NamedPipe packet between srvsvc/NetrShareEnum and winreg/OpenKey. They both have Pipe protocol code 0x26(TransNmPipe) in Trans packet, and both have opnum 15 in DCE RPC packet. Is there a way to find out whether the packet contains SRVSVC or WINREGpacket from some field? 

Thank you

Mike