Comment # 4
on bug 8164
from Pascal Quantin
The current dissector code assumes that the least significant bit of the buffer
code contains a flag indicating whether there is a dynamic content of not (as
seen here: http://wiki.wireshark.org/SMB2/BufferCode).
This does not match Microsoft documentation found in
http://msdn.microsoft.com/en-us/library/cc246482.aspx that defines those two
bytes as structureSize field that just contain a size without any flag.
When looking at MS documentation, it looks like the assumption of a flag in the
LSB is correct (only messages with dynamic content have it set). For example a
Session Setup Response message has a 8 bytes long fixed length + a variable
size for the dynamic content.
On the other hand it could make sense to change the decoding to match MS
documentation and display the 2 bytes as a length.
I do not have a strong opinion. Can anyone one knowing / using SMB2 suggest
what is the preferred display?
You are receiving this mail because:
- You are watching all bug changes.