Wireshark-users: Re: [Wireshark-users] SMB over TCP

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 17 Jun 2008 19:51:23 -0700
On Jun 17, 2008, at 8:06 AM, Eric Zeitz wrote:

Is it correct to see a netbios header in smb traffic if you disabled netbios over tcp?
It's correct to see a header that looks almost exactly like the  
NetBIOS-over-TCP Session Service header for regular messages preceding  
the SMB header.
Whether it's correct to call that a NetBIOS header, rather than an SMB- 
over-TCP header, is another matter; perhaps the dissector should just  
call it "SMB-over-TCP".