Wireshark-users: Re: [Wireshark-users] SMB over TCP

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 17 Jun 2008 19:51:23 -0700

On Jun 17, 2008, at 8:06 AM, Eric Zeitz wrote:

Is it correct to see a netbios header in smb traffic if you disabled netbios over tcp?

It's correct to see a header that looks almost exactly like the NetBIOS-over-TCP Session Service header for regular messages preceding the SMB header.

Whether it's correct to call that a NetBIOS header, rather than an SMB- over-TCP header, is another matter; perhaps the dissector should just call it "SMB-over-TCP".