1999-08-10 20:06:39 +00:00
|
|
|
/* packet-netbios.c
|
|
|
|
* Routines for NetBIOS protocol packet disassembly
|
2002-08-28 21:04:11 +00:00
|
|
|
* Jeff Foster <jfoste@woodward.com>
|
1999-08-10 20:06:39 +00:00
|
|
|
* Copyright 1999 Jeffrey C. Foster
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1999-08-10 20:06:39 +00:00
|
|
|
* derived from the packet-nbns.c
|
|
|
|
*
|
2003-04-20 11:36:16 +00:00
|
|
|
* $Id: packet-netbios.c,v 1.57 2003/04/20 11:36:14 guy Exp $
|
1999-08-10 20:06:39 +00:00
|
|
|
*
|
|
|
|
* Ethereal - Network traffic analyzer
|
2001-09-14 07:10:13 +00:00
|
|
|
* By Gerald Combs <gerald@ethereal.com>
|
1999-08-10 20:06:39 +00:00
|
|
|
* Copyright 1998 Gerald Combs
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1999-08-10 20:06:39 +00:00
|
|
|
* This program is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU General Public License
|
|
|
|
* as published by the Free Software Foundation; either version 2
|
|
|
|
* of the License, or (at your option) any later version.
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1999-08-10 20:06:39 +00:00
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
2002-08-28 21:04:11 +00:00
|
|
|
*
|
1999-08-10 20:06:39 +00:00
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifdef HAVE_CONFIG_H
|
|
|
|
# include "config.h"
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#include <stdio.h>
|
|
|
|
#include <string.h>
|
|
|
|
#include <glib.h>
|
2000-02-15 21:06:58 +00:00
|
|
|
|
2002-01-21 07:37:49 +00:00
|
|
|
#include <epan/packet.h>
|
2000-04-17 00:32:43 +00:00
|
|
|
#include "llcsaps.h"
|
2002-10-24 06:17:36 +00:00
|
|
|
#include "reassemble.h"
|
|
|
|
#include "prefs.h"
|
Have the IPX code set "pi.len" and "pi.captured_len" based on the length
in the IPX header, and have the dissectors it calls use it rather than
being passed the length as an argument.
Treat both packet type 20 ("WAN Broadcast") and 4 ("IPX", although 3 is
also "IPX", according to Network Monitor) as potentially being NetBIOS
packets.
The packet types for the IPX NetBIOS socket (0x0455) and the NWLink
sockets (0x0551 and 0x0553) are different (perhaps because there's one
socket for the 0x0455 NBIPX, so you have to do name service and datagram
service and have the packet types distinguish them, but NWLink has
separate sockets for name service and datagram service).
The packet type for name service and for datagram service are at
*different locations* in the packet, which is unfortunate if you want to
use the packet type to distinguish name service and datagram service
packets. Use the packet length, for now, to distinguish them, with
socket 0x0455.
Dissect datagram packets differently from name service packets.
Export "packet-netbios.c"'s "netbios_add_name()" routine, and use it
when dissecting NBIPX packets as well.
Label NBIPX packets as "NBIPX" rather than "NetBIOS".
svn path=/trunk/; revision=627
1999-09-02 23:17:58 +00:00
|
|
|
#include "packet-netbios.h"
|
1999-08-10 20:06:39 +00:00
|
|
|
|
|
|
|
/* Netbios command numbers */
|
|
|
|
#define NB_ADD_GROUP 0x00
|
|
|
|
#define NB_ADD_NAME 0x01
|
1999-09-03 04:37:11 +00:00
|
|
|
#define NB_NAME_IN_CONFLICT 0x02
|
1999-09-03 07:20:15 +00:00
|
|
|
#define NB_STATUS_QUERY 0x03
|
|
|
|
#define NB_TERMINATE_TRACE_R 0x07
|
1999-08-10 20:06:39 +00:00
|
|
|
#define NB_DATAGRAM 0x08
|
1999-09-03 04:37:11 +00:00
|
|
|
#define NB_DATAGRAM_BCAST 0x09
|
1999-08-10 20:06:39 +00:00
|
|
|
#define NB_NAME_QUERY 0x0a
|
1999-09-03 04:37:11 +00:00
|
|
|
#define NB_ADD_NAME_RESP 0x0d
|
1999-08-10 20:06:39 +00:00
|
|
|
#define NB_NAME_RESP 0x0e
|
1999-09-03 07:20:15 +00:00
|
|
|
#define NB_STATUS_RESP 0x0f
|
|
|
|
#define NB_TERMINATE_TRACE_LR 0x13
|
1999-08-10 20:06:39 +00:00
|
|
|
#define NB_DATA_ACK 0x14
|
1999-09-03 04:37:11 +00:00
|
|
|
#define NB_DATA_FIRST_MIDDLE 0x15
|
1999-08-10 20:06:39 +00:00
|
|
|
#define NB_DATA_ONLY_LAST 0x16
|
1999-09-03 04:37:11 +00:00
|
|
|
#define NB_SESSION_CONFIRM 0x17
|
|
|
|
#define NB_SESSION_END 0x18
|
|
|
|
#define NB_SESSION_INIT 0x19
|
|
|
|
#define NB_NO_RECEIVE 0x1a
|
|
|
|
#define NB_RECEIVE_OUTSTANDING 0x1b
|
|
|
|
#define NB_RECEIVE_CONTINUE 0x1c
|
1999-08-10 20:06:39 +00:00
|
|
|
#define NB_KEEP_ALIVE 0x1f
|
|
|
|
|
|
|
|
/* Offsets of fields in the NetBIOS header. */
|
|
|
|
#define NB_LENGTH 0
|
|
|
|
#define NB_DELIMITER 2
|
|
|
|
#define NB_COMMAND 4
|
|
|
|
#define NB_FLAGS 5
|
|
|
|
#define NB_DATA1 5
|
|
|
|
#define NB_RESYNC 6
|
|
|
|
#define NB_DATA2 6
|
|
|
|
#define NB_CALL_NAME_TYPE 7
|
|
|
|
#define NB_XMIT_CORL 8
|
|
|
|
#define NB_RESP_CORL 10
|
|
|
|
#define NB_RMT_SES 12
|
|
|
|
#define NB_LOCAL_SES 13
|
|
|
|
#define NB_RECVER_NAME 12
|
|
|
|
#define NB_SENDER_NAME 28
|
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
|
1999-08-10 20:06:39 +00:00
|
|
|
static int proto_netbios = -1;
|
2000-11-10 15:44:11 +00:00
|
|
|
static int hf_netb_cmd = -1;
|
|
|
|
static int hf_netb_hdr_len = -1;
|
|
|
|
static int hf_netb_xmit_corrl = -1;
|
|
|
|
static int hf_netb_resp_corrl = -1;
|
|
|
|
static int hf_netb_call_name_type = -1;
|
|
|
|
static int hf_netb_ack = -1;
|
|
|
|
static int hf_netb_ack_with_data = -1;
|
|
|
|
static int hf_netb_ack_expected = -1;
|
|
|
|
static int hf_netb_recv_cont_req = -1;
|
|
|
|
static int hf_netb_send_no_ack = -1;
|
|
|
|
static int hf_netb_version = -1;
|
|
|
|
static int hf_netb_largest_frame = -1;
|
2002-05-02 02:42:17 +00:00
|
|
|
static int hf_netb_nb_name = -1;
|
|
|
|
static int hf_netb_nb_name_type = -1;
|
|
|
|
static int hf_netb_status_buffer_len = -1;
|
|
|
|
static int hf_netb_status = -1;
|
2000-11-10 15:44:11 +00:00
|
|
|
static int hf_netb_name_type = -1;
|
2002-05-02 02:42:17 +00:00
|
|
|
static int hf_netb_max_data_recv_size = -1;
|
|
|
|
static int hf_netb_termination_indicator = -1;
|
|
|
|
static int hf_netb_num_data_bytes_accepted = -1;
|
2000-11-10 15:44:11 +00:00
|
|
|
static int hf_netb_local_ses_no = -1;
|
|
|
|
static int hf_netb_remote_ses_no = -1;
|
2002-05-01 09:50:44 +00:00
|
|
|
static int hf_netb_data1 = -1;
|
2000-11-10 15:44:11 +00:00
|
|
|
static int hf_netb_data2 = -1;
|
2002-10-24 06:17:36 +00:00
|
|
|
static int hf_netb_fragments = -1;
|
|
|
|
static int hf_netb_fragment = -1;
|
|
|
|
static int hf_netb_fragment_overlap = -1;
|
|
|
|
static int hf_netb_fragment_overlap_conflict = -1;
|
|
|
|
static int hf_netb_fragment_multiple_tails = -1;
|
2002-12-03 08:24:58 +00:00
|
|
|
static int hf_netb_fragment_too_long_fragment = -1;
|
2002-10-24 06:17:36 +00:00
|
|
|
static int hf_netb_fragment_error = -1;
|
1999-08-10 20:06:39 +00:00
|
|
|
|
1999-11-16 11:44:20 +00:00
|
|
|
static gint ett_netb = -1;
|
|
|
|
static gint ett_netb_name = -1;
|
|
|
|
static gint ett_netb_flags = -1;
|
|
|
|
static gint ett_netb_status = -1;
|
2002-10-24 06:17:36 +00:00
|
|
|
static gint ett_netb_fragments = -1;
|
|
|
|
static gint ett_netb_fragment = -1;
|
|
|
|
|
2002-12-03 08:24:58 +00:00
|
|
|
static const fragment_items netbios_frag_items = {
|
2002-10-24 06:17:36 +00:00
|
|
|
&ett_netb_fragment,
|
|
|
|
&ett_netb_fragments,
|
|
|
|
&hf_netb_fragments,
|
|
|
|
&hf_netb_fragment,
|
|
|
|
&hf_netb_fragment_overlap,
|
|
|
|
&hf_netb_fragment_overlap_conflict,
|
|
|
|
&hf_netb_fragment_multiple_tails,
|
2002-12-03 08:24:58 +00:00
|
|
|
&hf_netb_fragment_too_long_fragment,
|
2002-10-24 06:17:36 +00:00
|
|
|
&hf_netb_fragment_error,
|
2003-04-20 11:36:16 +00:00
|
|
|
NULL,
|
2002-10-24 06:17:36 +00:00
|
|
|
"fragments"
|
|
|
|
};
|
1999-11-16 11:44:20 +00:00
|
|
|
|
2001-11-26 04:52:51 +00:00
|
|
|
static dissector_handle_t data_handle;
|
|
|
|
|
1999-09-03 00:24:40 +00:00
|
|
|
/* The strings for the station type, used by get_netbios_name function;
|
|
|
|
many of them came from the file "NetBIOS.txt" in the Zip archive at
|
|
|
|
|
|
|
|
http://www.net3group.com/ftp/browser.zip
|
|
|
|
*/
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2002-05-02 02:42:17 +00:00
|
|
|
static const value_string nb_name_type_vals[] = {
|
1999-09-03 00:24:40 +00:00
|
|
|
{0x00, "Workstation/Redirector"},
|
|
|
|
{0x01, "Browser"},
|
2002-08-28 21:04:11 +00:00
|
|
|
{0x02, "Workstation/Redirector"},
|
1999-11-15 21:33:57 +00:00
|
|
|
/* not sure what 0x02 is, I'm seeing alot of them however */
|
2002-08-28 21:04:11 +00:00
|
|
|
/* i'm seeing them with workstation/redirection host
|
1999-11-15 21:33:57 +00:00
|
|
|
announcements */
|
1999-09-03 00:24:40 +00:00
|
|
|
{0x03, "Messenger service/Main name"},
|
|
|
|
{0x05, "Forwarded name"},
|
|
|
|
{0x06, "RAS Server service"},
|
2000-02-16 00:44:45 +00:00
|
|
|
{0x1b, "Domain Master Browser"},
|
|
|
|
{0x1c, "Domain Controllers"},
|
|
|
|
{0x1d, "Local Master Browser"},
|
1999-09-03 00:24:40 +00:00
|
|
|
{0x1e, "Browser Election Service"},
|
|
|
|
{0x1f, "Net DDE Service"},
|
|
|
|
{0x20, "Server service"},
|
|
|
|
{0x21, "RAS client service"},
|
|
|
|
{0x22, "Exchange Interchange (MSMail Connector)"},
|
|
|
|
{0x23, "Exchange Store"},
|
|
|
|
{0x24, "Exchange Directory"},
|
|
|
|
{0x2b, "Lotus Notes Server service"},
|
|
|
|
{0x30, "Modem sharing server service"},
|
|
|
|
{0x31, "Modem sharing client service"},
|
|
|
|
{0x43, "SMS Clients Remote Control"},
|
|
|
|
{0x44, "SMS Administrators Remote Control Tool"},
|
|
|
|
{0x45, "SMS Clients Remote Chat"},
|
|
|
|
{0x46, "SMS Clients Remote Transfer"},
|
|
|
|
{0x4c, "DEC Pathworks TCP/IP Service on Windows NT"},
|
|
|
|
{0x52, "DEC Pathworks TCP/IP Service on Windows NT"},
|
|
|
|
{0x6a, "Microsoft Exchange IMC"},
|
|
|
|
{0x87, "Microsoft Exchange MTA"},
|
|
|
|
{0xbe, "Network Monitor Agent"},
|
|
|
|
{0xbf, "Network Monitor Analyzer"},
|
|
|
|
{0x00, NULL}
|
|
|
|
};
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
/* Tables for reassembly of fragments. */
|
|
|
|
static GHashTable *netbios_fragment_table = NULL;
|
|
|
|
static GHashTable *netbios_reassembled_table = NULL;
|
|
|
|
|
2002-12-03 08:24:58 +00:00
|
|
|
/* defragmentation of NetBIOS Frame */
|
2002-10-24 06:17:36 +00:00
|
|
|
static gboolean netbios_defragment = TRUE;
|
|
|
|
|
1999-09-03 04:37:11 +00:00
|
|
|
/* See
|
2002-08-28 21:04:11 +00:00
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
http://www.s390.ibm.com/bookmgr-cgi/bookmgr.cmd/BOOKS/BK8P7001/CCONTENTS
|
|
|
|
|
|
|
|
and
|
1999-09-03 04:37:11 +00:00
|
|
|
|
|
|
|
http://ourworld.compuserve.com/homepages/TimothyDEvans/contents.htm
|
|
|
|
|
|
|
|
for information about the NetBIOS Frame Protocol (which is what this
|
|
|
|
module dissects). */
|
|
|
|
|
1999-08-10 20:06:39 +00:00
|
|
|
/* the strings for the command types */
|
|
|
|
|
2002-05-01 09:50:44 +00:00
|
|
|
static const value_string cmd_vals[] = {
|
|
|
|
{ NB_ADD_GROUP, "Add Group Name Query" },
|
|
|
|
{ NB_ADD_NAME, "Add Name Query" },
|
|
|
|
{ NB_NAME_IN_CONFLICT, "Name In Conflict" },
|
|
|
|
{ NB_STATUS_QUERY, "Status Query" },
|
|
|
|
{ NB_TERMINATE_TRACE_R, "Terminate Trace" },
|
|
|
|
{ NB_DATAGRAM, "Datagram" },
|
|
|
|
{ NB_DATAGRAM_BCAST, "Broadcast Datagram" },
|
|
|
|
{ NB_NAME_QUERY, "Name Query" },
|
|
|
|
{ NB_ADD_NAME_RESP, "Add Name Response" },
|
|
|
|
{ NB_NAME_RESP, "Name Recognized" },
|
|
|
|
{ NB_STATUS_RESP, "Status Response" },
|
|
|
|
{ NB_TERMINATE_TRACE_LR, "Terminate Trace" },
|
|
|
|
{ NB_DATA_ACK, "Data Ack" },
|
|
|
|
{ NB_DATA_FIRST_MIDDLE, "Data First Middle" },
|
|
|
|
{ NB_DATA_ONLY_LAST, "Data Only Last" },
|
|
|
|
{ NB_SESSION_CONFIRM, "Session Confirm" },
|
|
|
|
{ NB_SESSION_END, "Session End" },
|
|
|
|
{ NB_SESSION_INIT, "Session Initialize" },
|
|
|
|
{ NB_NO_RECEIVE, "No Receive" },
|
|
|
|
{ NB_RECEIVE_OUTSTANDING, "Receive Outstanding" },
|
|
|
|
{ NB_RECEIVE_CONTINUE, "Receive Continue" },
|
|
|
|
{ NB_KEEP_ALIVE, "Session Alive" },
|
|
|
|
{ 0, NULL }
|
2000-11-10 15:44:11 +00:00
|
|
|
};
|
|
|
|
|
2002-05-02 02:42:17 +00:00
|
|
|
static const value_string name_types[] = {
|
|
|
|
{ 0, "Unique name" },
|
|
|
|
{ 1, "Group name" },
|
|
|
|
{ 0, NULL }
|
2002-05-01 09:50:44 +00:00
|
|
|
};
|
2000-11-10 15:44:11 +00:00
|
|
|
|
|
|
|
static const true_false_string flags_set = {
|
|
|
|
"Set",
|
|
|
|
"Not set"
|
|
|
|
};
|
|
|
|
static const true_false_string flags_allowed = {
|
|
|
|
"Allowed",
|
2002-10-24 06:17:36 +00:00
|
|
|
"Not allowed"
|
2000-11-10 15:44:11 +00:00
|
|
|
};
|
|
|
|
static const true_false_string flags_yes_no = {
|
|
|
|
"Yes",
|
|
|
|
"No"
|
|
|
|
};
|
|
|
|
|
|
|
|
static const true_false_string netb_version_str = {
|
|
|
|
"2.00 or higher",
|
|
|
|
"1.xx"
|
1999-09-03 04:37:11 +00:00
|
|
|
};
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2002-05-02 02:42:17 +00:00
|
|
|
static const value_string termination_indicator_vals[] = {
|
|
|
|
{ 0x0000, "Normal session end" },
|
|
|
|
{ 0x0001, "Abnormal session end" },
|
|
|
|
{ 0, NULL }
|
|
|
|
};
|
|
|
|
|
|
|
|
static const value_string status_vals[] = {
|
|
|
|
{ 0, "Add name not in process" },
|
|
|
|
{ 1, "Add name in process" },
|
|
|
|
{ 0, NULL }
|
|
|
|
};
|
|
|
|
|
|
|
|
static const value_string max_frame_size_vals[] = {
|
|
|
|
{ 0, "516" },
|
|
|
|
{ 1, "1500" },
|
|
|
|
{ 2, "2052" },
|
|
|
|
{ 3, "4472" },
|
|
|
|
{ 4, "8144" },
|
|
|
|
{ 5, "11407" },
|
|
|
|
{ 6, "17800" }, /* 17800 in TR spec, 17749 in NBF spec */
|
|
|
|
{ 7, "65535" },
|
|
|
|
{ 0, NULL }
|
|
|
|
};
|
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
|
2002-04-24 06:03:34 +00:00
|
|
|
void capture_netbios(packet_counts *ld)
|
1999-08-10 20:06:39 +00:00
|
|
|
{
|
|
|
|
ld->netbios++;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
1999-09-03 00:24:40 +00:00
|
|
|
int
|
2002-08-02 23:36:07 +00:00
|
|
|
process_netbios_name(const guchar *name_ptr, char *name_ret)
|
1999-09-03 00:24:40 +00:00
|
|
|
{
|
1999-08-10 20:06:39 +00:00
|
|
|
int i;
|
1999-09-03 00:24:40 +00:00
|
|
|
int name_type = *(name_ptr + NETBIOS_NAME_LEN - 1);
|
2002-08-02 23:36:07 +00:00
|
|
|
guchar name_char;
|
2000-01-14 17:08:41 +00:00
|
|
|
static const char hex_digits[16] = "0123456789abcdef";
|
1999-09-03 00:24:40 +00:00
|
|
|
|
|
|
|
for (i = 0; i < NETBIOS_NAME_LEN - 1; i++) {
|
|
|
|
name_char = *name_ptr++;
|
|
|
|
if (name_char >= ' ' && name_char <= '~')
|
|
|
|
*name_ret++ = name_char;
|
|
|
|
else {
|
|
|
|
/* It's not printable; show it as <XX>, where
|
|
|
|
XX is the value in hex. */
|
|
|
|
*name_ret++ = '<';
|
|
|
|
*name_ret++ = hex_digits[(name_char >> 4)];
|
|
|
|
*name_ret++ = hex_digits[(name_char & 0x0F)];
|
|
|
|
*name_ret++ = '>';
|
|
|
|
}
|
1999-08-10 20:06:39 +00:00
|
|
|
}
|
1999-09-03 00:24:40 +00:00
|
|
|
*name_ret = '\0';
|
2002-07-22 20:52:21 +00:00
|
|
|
|
|
|
|
/* Remove trailing space characters from name. */
|
|
|
|
|
|
|
|
name_ret--;
|
|
|
|
|
|
|
|
for (i = 0; i < NETBIOS_NAME_LEN - 1; i++) {
|
|
|
|
if (*name_ret != ' ') {
|
|
|
|
*(name_ret + 1) = 0;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
name_ret--;
|
|
|
|
}
|
|
|
|
|
1999-09-03 00:24:40 +00:00
|
|
|
return name_type;
|
|
|
|
}
|
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
|
|
|
|
int get_netbios_name( tvbuff_t *tvb, int offset, char *name_ret)
|
1999-08-10 20:06:39 +00:00
|
|
|
|
1999-09-03 00:24:40 +00:00
|
|
|
{/* Extract the name string and name type. Return the name string in */
|
|
|
|
/* name_ret and return the name_type. */
|
2000-11-10 15:44:11 +00:00
|
|
|
|
|
|
|
return process_netbios_name( tvb_get_ptr( tvb, offset, NETBIOS_NAME_LEN ), name_ret);
|
1999-08-10 20:06:39 +00:00
|
|
|
}
|
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
|
1999-09-03 01:43:09 +00:00
|
|
|
/*
|
|
|
|
* Get a string describing the type of a NetBIOS name.
|
|
|
|
*/
|
|
|
|
char *
|
|
|
|
netbios_name_type_descr(int name_type)
|
|
|
|
{
|
2002-05-02 02:42:17 +00:00
|
|
|
return val_to_str(name_type, nb_name_type_vals, "Unknown");
|
1999-09-03 01:43:09 +00:00
|
|
|
}
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2001-01-15 04:39:28 +00:00
|
|
|
void netbios_add_name(char* label, tvbuff_t *tvb, int offset,
|
1999-11-30 07:45:42 +00:00
|
|
|
proto_tree *tree)
|
1999-08-10 20:06:39 +00:00
|
|
|
|
|
|
|
{/* add a name field display tree. Display the name and station type in sub-tree */
|
2002-08-28 21:04:11 +00:00
|
|
|
|
1999-08-10 20:06:39 +00:00
|
|
|
proto_tree *field_tree;
|
|
|
|
proto_item *tf;
|
1999-09-03 00:24:40 +00:00
|
|
|
char name_str[(NETBIOS_NAME_LEN - 1)*4 + 1];
|
1999-08-10 20:06:39 +00:00
|
|
|
int name_type;
|
1999-09-03 00:24:40 +00:00
|
|
|
char *name_type_str;
|
1999-08-10 20:06:39 +00:00
|
|
|
|
|
|
|
/* decode the name field */
|
2000-11-10 15:44:11 +00:00
|
|
|
name_type = get_netbios_name( tvb, offset, name_str);
|
1999-09-03 01:43:09 +00:00
|
|
|
name_type_str = netbios_name_type_descr(name_type);
|
2000-11-10 15:44:11 +00:00
|
|
|
tf = proto_tree_add_text( tree, tvb, offset, NETBIOS_NAME_LEN,
|
1999-09-03 00:24:40 +00:00
|
|
|
"%s: %s<%02x> (%s)", label, name_str, name_type, name_type_str);
|
1999-08-10 20:06:39 +00:00
|
|
|
|
1999-11-16 11:44:20 +00:00
|
|
|
field_tree = proto_item_add_subtree( tf, ett_netb_name);
|
2002-05-02 02:42:17 +00:00
|
|
|
proto_tree_add_string_format( field_tree, hf_netb_nb_name, tvb, offset,
|
2000-11-10 15:44:11 +00:00
|
|
|
15, name_str, "%s", name_str);
|
2002-05-02 02:42:17 +00:00
|
|
|
proto_tree_add_uint_format( field_tree, hf_netb_nb_name_type, tvb, offset + 15, 1, name_type,
|
1999-09-03 00:24:40 +00:00
|
|
|
"0x%02x (%s)", name_type, name_type_str);
|
1999-08-10 20:06:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
static void netbios_data_first_middle_flags( tvbuff_t *tvb, proto_tree *tree, int offset)
|
1999-08-10 20:06:39 +00:00
|
|
|
|
|
|
|
{
|
|
|
|
proto_tree *field_tree;
|
|
|
|
proto_item *tf;
|
2000-11-10 15:44:11 +00:00
|
|
|
guint flags = tvb_get_guint8( tvb, offset);
|
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
/* decode the flag field for Data First Middle packet*/
|
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
tf = proto_tree_add_text(tree, tvb, offset, 1,
|
1999-09-03 07:20:15 +00:00
|
|
|
"Flags: 0x%02x", flags);
|
1999-11-16 11:44:20 +00:00
|
|
|
field_tree = proto_item_add_subtree(tf, ett_netb_flags);
|
1999-09-03 07:20:15 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_boolean( field_tree, hf_netb_ack, tvb, offset, 1, flags);
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_boolean( field_tree, hf_netb_ack_expected, tvb, offset, 1, flags);
|
1999-09-03 07:20:15 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_boolean( field_tree, hf_netb_recv_cont_req, tvb, offset, 1, flags);
|
1999-09-03 07:20:15 +00:00
|
|
|
}
|
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
static void netbios_data_only_flags( tvbuff_t *tvb, proto_tree *tree,
|
|
|
|
int offset)
|
1999-09-03 07:20:15 +00:00
|
|
|
{
|
|
|
|
proto_tree *field_tree;
|
|
|
|
proto_item *tf;
|
2000-11-10 15:44:11 +00:00
|
|
|
guint flags = tvb_get_guint8( tvb, offset);
|
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
/* decode the flag field for Data Only Last packet*/
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
tf = proto_tree_add_text(tree, tvb, offset, 1,
|
1999-08-10 20:06:39 +00:00
|
|
|
"Flags: 0x%02x", flags);
|
1999-11-16 11:44:20 +00:00
|
|
|
field_tree = proto_item_add_subtree(tf, ett_netb_flags);
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_boolean( field_tree, hf_netb_ack, tvb, offset, 1, flags);
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_boolean( field_tree, hf_netb_ack_with_data, tvb, offset, 1, flags);
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_boolean( field_tree, hf_netb_ack_expected, tvb, offset, 1, flags);
|
1999-08-10 20:06:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
|
|
|
|
static void netbios_add_ses_confirm_flags( tvbuff_t *tvb, proto_tree *tree,
|
1999-08-10 20:06:39 +00:00
|
|
|
int offset)
|
|
|
|
{
|
|
|
|
proto_tree *field_tree;
|
|
|
|
proto_item *tf;
|
2000-11-10 15:44:11 +00:00
|
|
|
guint flags = tvb_get_guint8( tvb, offset);
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
/* decode the flag field for Session Confirm packet */
|
|
|
|
tf = proto_tree_add_text(tree, tvb, offset, 1,
|
1999-08-10 20:06:39 +00:00
|
|
|
"Flags: 0x%02x", flags);
|
1999-11-16 11:44:20 +00:00
|
|
|
field_tree = proto_item_add_subtree( tf, ett_netb_flags);
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_boolean( field_tree, hf_netb_send_no_ack, tvb, offset, 1, flags);
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_boolean( field_tree, hf_netb_version, tvb, offset, 1, flags);
|
1999-08-10 20:06:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
static void netbios_add_session_init_flags( tvbuff_t *tvb, proto_tree *tree,
|
1999-09-03 07:20:15 +00:00
|
|
|
int offset)
|
1999-08-10 20:06:39 +00:00
|
|
|
{
|
|
|
|
proto_tree *field_tree;
|
|
|
|
proto_item *tf;
|
2000-11-10 15:44:11 +00:00
|
|
|
guint flags = tvb_get_guint8( tvb, offset);
|
1999-09-03 07:20:15 +00:00
|
|
|
/* decode the flag field for Session Init packet */
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
tf = proto_tree_add_text(tree, tvb, offset, 1,
|
1999-08-10 20:06:39 +00:00
|
|
|
"Flags: 0x%02x", flags);
|
1999-11-16 11:44:20 +00:00
|
|
|
field_tree = proto_item_add_subtree(tf, ett_netb_flags);
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_boolean( field_tree, hf_netb_send_no_ack, tvb, offset, 1, flags);
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_uint( field_tree, hf_netb_largest_frame, tvb, offset, 1,
|
|
|
|
flags);
|
1999-09-03 07:20:15 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_boolean( field_tree, hf_netb_version, tvb, offset, 1, flags);
|
1999-08-10 20:06:39 +00:00
|
|
|
}
|
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
static void netbios_no_receive_flags( tvbuff_t *tvb, proto_tree *tree,
|
1999-09-03 04:37:11 +00:00
|
|
|
int offset)
|
|
|
|
|
|
|
|
{
|
|
|
|
proto_tree *field_tree;
|
|
|
|
proto_item *tf;
|
2000-11-10 15:44:11 +00:00
|
|
|
guint flags = tvb_get_guint8( tvb, offset);
|
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
/* decode the flag field for No Receive packet*/
|
1999-09-03 04:37:11 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
tf = proto_tree_add_text(tree, tvb, offset, 1,
|
1999-09-03 04:37:11 +00:00
|
|
|
"Flags: 0x%02x", flags);
|
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
if (flags & 0x02) {
|
1999-11-16 11:44:20 +00:00
|
|
|
field_tree = proto_item_add_subtree(tf, ett_netb_flags);
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_text(field_tree, tvb, offset, 1, "%s",
|
1999-09-03 07:20:15 +00:00
|
|
|
decode_boolean_bitfield(flags, 0x02, 8,
|
|
|
|
"SEND.NO.ACK data not received", NULL));
|
|
|
|
}
|
1999-09-03 04:37:11 +00:00
|
|
|
}
|
|
|
|
|
1999-08-10 20:06:39 +00:00
|
|
|
|
|
|
|
/************************************************************************/
|
|
|
|
/* */
|
|
|
|
/* The routines to display the netbios field values in the tree */
|
|
|
|
/* */
|
|
|
|
/************************************************************************/
|
|
|
|
|
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
static void nb_xmit_corrl( tvbuff_t *tvb, int offset, proto_tree *tree)
|
1999-08-10 20:06:39 +00:00
|
|
|
|
|
|
|
{/* display the transmit correlator */
|
|
|
|
|
2002-08-28 21:04:11 +00:00
|
|
|
proto_tree_add_item( tree, hf_netb_xmit_corrl, tvb, offset + NB_XMIT_CORL,
|
2002-05-01 09:50:44 +00:00
|
|
|
2, TRUE);
|
1999-08-10 20:06:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
static void nb_resp_corrl( tvbuff_t *tvb, int offset, proto_tree *tree)
|
1999-08-10 20:06:39 +00:00
|
|
|
|
|
|
|
{/* display the response correlator */
|
|
|
|
|
2002-05-01 09:50:44 +00:00
|
|
|
proto_tree_add_item( tree, hf_netb_resp_corrl, tvb, offset + NB_RESP_CORL,
|
|
|
|
2, TRUE);
|
1999-08-10 20:06:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
static void nb_call_name_type( tvbuff_t *tvb, int offset, proto_tree *tree)
|
1999-08-10 20:06:39 +00:00
|
|
|
|
|
|
|
{/* display the call name type */
|
|
|
|
|
2002-05-01 09:50:44 +00:00
|
|
|
proto_tree_add_item( tree, hf_netb_call_name_type, tvb, offset + NB_CALL_NAME_TYPE,
|
|
|
|
1, TRUE);
|
2000-11-10 15:44:11 +00:00
|
|
|
|
1999-08-10 20:06:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static guint8 nb_local_session( tvbuff_t *tvb, int offset, proto_tree *tree)
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
{/* add the local session to tree, and return its value */
|
|
|
|
|
|
|
|
guint8 local_session = tvb_get_guint8( tvb, offset + NB_LOCAL_SES);
|
2000-11-10 15:44:11 +00:00
|
|
|
|
2002-08-28 21:04:11 +00:00
|
|
|
proto_tree_add_uint( tree, hf_netb_local_ses_no, tvb, offset + NB_LOCAL_SES, 1,
|
2002-10-24 06:17:36 +00:00
|
|
|
local_session);
|
2000-11-10 15:44:11 +00:00
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
return local_session;
|
1999-08-10 20:06:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static guint8 nb_remote_session( tvbuff_t *tvb, int offset, proto_tree *tree)
|
|
|
|
|
|
|
|
{/* add the remote session to tree, and return its value */
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
guint8 remote_session = tvb_get_guint8( tvb, offset + NB_RMT_SES);
|
2000-11-10 15:44:11 +00:00
|
|
|
|
2000-11-13 03:52:16 +00:00
|
|
|
proto_tree_add_uint( tree, hf_netb_remote_ses_no, tvb, offset + NB_RMT_SES, 1,
|
2002-10-24 06:17:36 +00:00
|
|
|
remote_session);
|
2000-11-10 15:44:11 +00:00
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
return remote_session;
|
1999-08-10 20:06:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2002-05-02 02:42:17 +00:00
|
|
|
static void nb_data1(int hf, tvbuff_t *tvb, int offset, proto_tree *tree)
|
|
|
|
|
|
|
|
{/* add the DATA1 to tree with specified hf_ value */
|
|
|
|
|
|
|
|
proto_tree_add_item( tree, hf, tvb, offset + NB_DATA1, 1, TRUE);
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
static void nb_data2(int hf, tvbuff_t *tvb, int offset, proto_tree *tree)
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2002-05-02 02:42:17 +00:00
|
|
|
{/* add the DATA2 to tree with specified hf_ value */
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2002-05-02 02:42:17 +00:00
|
|
|
proto_tree_add_item( tree, hf, tvb, offset + NB_DATA2, 2, TRUE);
|
2000-11-10 15:44:11 +00:00
|
|
|
|
1999-08-10 20:06:39 +00:00
|
|
|
}
|
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
|
|
|
|
static void nb_resync_indicator( tvbuff_t *tvb, int offset, proto_tree *tree, char *cmd_str)
|
1999-09-03 07:20:15 +00:00
|
|
|
{
|
2000-11-10 15:44:11 +00:00
|
|
|
guint16 resync_indicator = tvb_get_letohs( tvb, offset + NB_DATA2);
|
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
|
|
|
|
switch (resync_indicator) {
|
|
|
|
|
|
|
|
case 0x0000:
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_text(tree, tvb, offset + NB_DATA2, 2,
|
|
|
|
"Re-sync indicator: No re-sync");
|
1999-09-03 07:20:15 +00:00
|
|
|
break;
|
|
|
|
|
|
|
|
case 0x0001:
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_text(tree, tvb, offset + NB_DATA2, 2,
|
|
|
|
"Re-sync indicator: First '%s' following 'Receive Outstanding'", cmd_str);
|
1999-09-03 07:20:15 +00:00
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_text(tree, tvb, offset + NB_DATA2, 2,
|
1999-09-03 07:20:15 +00:00
|
|
|
"Re-sync indicator: 0x%04x", resync_indicator);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
1999-08-10 20:06:39 +00:00
|
|
|
/************************************************************************/
|
|
|
|
/* */
|
|
|
|
/* The routines called by the top level to handle individual commands */
|
|
|
|
/* */
|
|
|
|
/************************************************************************/
|
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static guint32
|
|
|
|
dissect_netb_unknown( tvbuff_t *tvb, int offset, proto_tree *tree)
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2002-05-01 09:50:44 +00:00
|
|
|
{/* Handle any unknown commands, do nothing */
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2002-05-01 09:50:44 +00:00
|
|
|
proto_tree_add_text(tree, tvb, offset + NB_COMMAND + 1, -1,
|
|
|
|
"Unknown NetBIOS command data");
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
return 0;
|
1999-08-10 20:06:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static guint32
|
|
|
|
dissect_netb_add_group_name( tvbuff_t *tvb, int offset, proto_tree *tree)
|
1999-08-10 20:06:39 +00:00
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
{/* Handle the ADD GROUP NAME QUERY command */
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2002-08-28 21:04:11 +00:00
|
|
|
nb_resp_corrl( tvb, offset, tree);
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
netbios_add_name("Group name to add", tvb, offset + NB_SENDER_NAME,
|
1999-11-30 07:45:42 +00:00
|
|
|
tree);
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
return 0;
|
1999-08-10 20:06:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static guint32
|
|
|
|
dissect_netb_add_name( tvbuff_t *tvb, int offset, proto_tree *tree)
|
1999-08-10 20:06:39 +00:00
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
{/* Handle the ADD NAME QUERY command */
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2002-08-28 21:04:11 +00:00
|
|
|
nb_resp_corrl( tvb, offset, tree);
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
netbios_add_name("Name to add", tvb, offset + NB_SENDER_NAME, tree);
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
return 0;
|
1999-08-10 20:06:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static guint32
|
|
|
|
dissect_netb_name_in_conflict( tvbuff_t *tvb, int offset, proto_tree *tree)
|
1999-09-03 04:37:11 +00:00
|
|
|
|
|
|
|
{/* Handle the NAME IN CONFLICT command */
|
|
|
|
|
2001-01-15 04:39:28 +00:00
|
|
|
netbios_add_name("Name In Conflict", tvb, offset + NB_RECVER_NAME,
|
|
|
|
tree);
|
2000-11-10 15:44:11 +00:00
|
|
|
netbios_add_name("Sender's Name", tvb, offset + NB_SENDER_NAME, tree);
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
return 0;
|
1999-09-03 07:20:15 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static guint32
|
|
|
|
dissect_netb_status_query( tvbuff_t *tvb, int offset, proto_tree *tree)
|
1999-09-03 07:20:15 +00:00
|
|
|
|
|
|
|
{/* Handle the STATUS QUERY command */
|
2000-11-10 15:44:11 +00:00
|
|
|
|
|
|
|
guint8 status_request = tvb_get_guint8( tvb, offset + NB_DATA1);
|
1999-09-03 07:20:15 +00:00
|
|
|
|
|
|
|
switch (status_request) {
|
|
|
|
|
|
|
|
case 0:
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_text(tree, tvb, offset + NB_DATA1, 1,
|
1999-09-03 07:20:15 +00:00
|
|
|
"Status request: NetBIOS 1.x or 2.0");
|
|
|
|
break;
|
|
|
|
|
|
|
|
case 1:
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_text(tree, tvb, offset + NB_DATA1, 1,
|
1999-09-03 07:20:15 +00:00
|
|
|
"Status request: NetBIOS 2.1, initial status request");
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_text(tree, tvb, offset + NB_DATA1, 1,
|
1999-09-03 07:20:15 +00:00
|
|
|
"Status request: NetBIOS 2.1, %u names received so far",
|
|
|
|
status_request);
|
|
|
|
break;
|
|
|
|
}
|
2002-05-02 02:42:17 +00:00
|
|
|
nb_data2( hf_netb_status_buffer_len, tvb, offset, tree);
|
2002-08-28 21:04:11 +00:00
|
|
|
nb_resp_corrl( tvb, offset, tree);
|
2001-01-15 04:39:28 +00:00
|
|
|
netbios_add_name("Receiver's Name", tvb, offset + NB_RECVER_NAME, tree);
|
2002-05-01 09:50:44 +00:00
|
|
|
netbios_add_name("Sender's Name", tvb, offset + NB_SENDER_NAME, tree);
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
return 0;
|
2002-05-01 09:50:44 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static guint32
|
|
|
|
dissect_netb_terminate_trace( tvbuff_t *tvb _U_, int offset _U_, proto_tree *tree _U_)
|
2002-05-01 09:50:44 +00:00
|
|
|
|
|
|
|
{/* Handle the TERMINATE TRACE command */
|
|
|
|
|
2002-05-02 02:42:17 +00:00
|
|
|
/*
|
|
|
|
* XXX - are any of the fields in this message significant?
|
2002-05-04 09:57:29 +00:00
|
|
|
* The IBM NetBIOS document shows them as "Reserved".
|
2002-05-02 02:42:17 +00:00
|
|
|
*/
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
return 0;
|
1999-09-03 04:37:11 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2002-08-02 23:36:07 +00:00
|
|
|
static guchar zeroes[10];
|
1999-09-03 07:20:15 +00:00
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static guint32
|
|
|
|
dissect_netb_datagram( tvbuff_t *tvb, int offset, proto_tree *tree)
|
1999-09-03 07:20:15 +00:00
|
|
|
|
|
|
|
{/* Handle the DATAGRAM command */
|
|
|
|
|
2001-01-15 04:39:28 +00:00
|
|
|
netbios_add_name("Receiver's Name", tvb, offset + NB_RECVER_NAME, tree);
|
1999-09-03 07:20:15 +00:00
|
|
|
/* Weird. In some datagrams, this is 10 octets of 0, followed
|
|
|
|
by a MAC address.... */
|
2000-11-10 15:44:11 +00:00
|
|
|
|
2000-11-11 06:47:07 +00:00
|
|
|
if (memcmp( tvb_get_ptr( tvb,offset + NB_SENDER_NAME, 10), zeroes, 10) == 0) {
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_text( tree, tvb, offset + NB_SENDER_NAME + 10, 6,
|
1999-09-03 07:20:15 +00:00
|
|
|
"Sender's MAC Address: %s",
|
2000-11-10 15:44:11 +00:00
|
|
|
ether_to_str( tvb_get_ptr( tvb,offset + NB_SENDER_NAME + 10, 6)));
|
1999-09-03 07:20:15 +00:00
|
|
|
} else {
|
2000-11-10 15:44:11 +00:00
|
|
|
netbios_add_name("Sender's Name", tvb, offset + NB_SENDER_NAME,
|
1999-11-30 07:45:42 +00:00
|
|
|
tree);
|
1999-09-03 07:20:15 +00:00
|
|
|
}
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
return 0;
|
1999-09-03 07:20:15 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static guint32
|
|
|
|
dissect_netb_datagram_bcast( tvbuff_t *tvb, int offset, proto_tree *tree)
|
1999-09-03 07:20:15 +00:00
|
|
|
|
|
|
|
{/* Handle the DATAGRAM BROADCAST command */
|
|
|
|
|
|
|
|
/* We assume the same weirdness can happen here.... */
|
2000-11-10 15:44:11 +00:00
|
|
|
if ( memcmp( tvb_get_ptr( tvb,offset + NB_SENDER_NAME + 10, 6), zeroes, 10) == 0) {
|
|
|
|
proto_tree_add_text( tree, tvb, offset + NB_SENDER_NAME + 10, 6,
|
1999-09-03 07:20:15 +00:00
|
|
|
"Sender's Node Address: %s",
|
2000-11-10 15:44:11 +00:00
|
|
|
ether_to_str( tvb_get_ptr( tvb,offset + NB_SENDER_NAME + 10, 6)));
|
1999-09-03 07:20:15 +00:00
|
|
|
} else {
|
2000-11-10 15:44:11 +00:00
|
|
|
netbios_add_name("Sender's Name", tvb, offset + NB_SENDER_NAME,
|
1999-11-30 07:45:42 +00:00
|
|
|
tree);
|
1999-09-03 07:20:15 +00:00
|
|
|
}
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
return 0;
|
1999-09-03 07:20:15 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static guint32
|
|
|
|
dissect_netb_name_query( tvbuff_t *tvb, int offset, proto_tree *tree)
|
1999-08-10 20:06:39 +00:00
|
|
|
|
|
|
|
{/* Handle the NAME QUERY command */
|
2000-11-10 15:44:11 +00:00
|
|
|
guint8 local_session_number = tvb_get_guint8( tvb, offset + NB_DATA2);
|
1999-09-03 07:20:15 +00:00
|
|
|
|
|
|
|
if (local_session_number == 0) {
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_text( tree, tvb, offset + NB_DATA2, 1,
|
1999-09-03 07:20:15 +00:00
|
|
|
"Local Session No.: 0 (FIND.NAME request)");
|
|
|
|
} else {
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_text( tree, tvb, offset + NB_DATA2, 1,
|
1999-09-03 07:20:15 +00:00
|
|
|
"Local Session No.: 0x%02x", local_session_number);
|
|
|
|
}
|
2000-11-10 15:44:11 +00:00
|
|
|
nb_call_name_type( tvb, offset, tree);
|
|
|
|
nb_resp_corrl( tvb, offset, tree);
|
2001-01-15 04:39:28 +00:00
|
|
|
netbios_add_name("Query Name", tvb, offset + NB_RECVER_NAME, tree);
|
1999-09-03 07:20:15 +00:00
|
|
|
if (local_session_number != 0) {
|
2000-11-10 15:44:11 +00:00
|
|
|
netbios_add_name("Sender's Name", tvb, offset + NB_SENDER_NAME,
|
1999-11-30 07:45:42 +00:00
|
|
|
tree);
|
1999-09-03 07:20:15 +00:00
|
|
|
}
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
return 0;
|
1999-08-10 20:06:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static guint32
|
|
|
|
dissect_netb_add_name_resp( tvbuff_t *tvb, int offset, proto_tree *tree)
|
1999-09-03 04:37:11 +00:00
|
|
|
|
|
|
|
{/* Handle the ADD NAME RESPONSE command */
|
|
|
|
|
2002-05-02 02:42:17 +00:00
|
|
|
nb_data1( hf_netb_status, tvb, offset, tree);
|
|
|
|
nb_data2( hf_netb_name_type, tvb, offset, tree);
|
2002-08-28 21:04:11 +00:00
|
|
|
nb_xmit_corrl( tvb, offset, tree);
|
2001-01-15 04:39:28 +00:00
|
|
|
netbios_add_name("Name to be added", tvb, offset + NB_RECVER_NAME,
|
|
|
|
tree);
|
2000-11-10 15:44:11 +00:00
|
|
|
netbios_add_name("Name to be added", tvb, offset + NB_SENDER_NAME,
|
1999-09-03 04:37:11 +00:00
|
|
|
tree);
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
return 0;
|
1999-09-03 04:37:11 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static guint32
|
|
|
|
dissect_netb_name_resp( tvbuff_t *tvb, int offset, proto_tree *tree)
|
1999-08-10 20:06:39 +00:00
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
{/* Handle the NAME RECOGNIZED command */
|
2000-11-10 15:44:11 +00:00
|
|
|
guint8 local_session_number = tvb_get_guint8( tvb, offset + NB_DATA2);
|
1999-09-03 07:20:15 +00:00
|
|
|
|
|
|
|
switch (local_session_number) {
|
1999-08-10 20:06:39 +00:00
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
case 0x00:
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_text( tree, tvb, offset + NB_DATA2, 1,
|
1999-09-03 07:20:15 +00:00
|
|
|
"State of name: No LISTEN pending, or FIND.NAME response");
|
|
|
|
break;
|
1999-08-10 20:06:39 +00:00
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
case 0xFF:
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_text( tree, tvb, offset + NB_DATA2, 1,
|
1999-09-03 07:20:15 +00:00
|
|
|
"State of name: LISTEN pending, but insufficient resources to establish session");
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_text( tree, tvb, offset + NB_DATA2, 1,
|
1999-09-03 07:20:15 +00:00
|
|
|
"Local Session No.: 0x%02x", local_session_number);
|
|
|
|
break;
|
|
|
|
}
|
2000-11-10 15:44:11 +00:00
|
|
|
nb_call_name_type( tvb, offset, tree);
|
|
|
|
nb_xmit_corrl( tvb, offset, tree);
|
1999-09-03 07:20:15 +00:00
|
|
|
if (local_session_number != 0x00 && local_session_number != 0xFF)
|
2000-11-10 15:44:11 +00:00
|
|
|
nb_resp_corrl(tvb, offset, tree);
|
2001-01-15 04:39:28 +00:00
|
|
|
netbios_add_name("Receiver's Name", tvb, offset + NB_RECVER_NAME, tree);
|
1999-09-03 07:20:15 +00:00
|
|
|
if (local_session_number != 0x00 && local_session_number != 0xFF) {
|
2000-11-10 15:44:11 +00:00
|
|
|
netbios_add_name("Sender's Name", tvb, offset + NB_SENDER_NAME,
|
1999-11-30 07:45:42 +00:00
|
|
|
tree);
|
1999-09-03 07:20:15 +00:00
|
|
|
}
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
return 0;
|
1999-08-10 20:06:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static guint32
|
|
|
|
dissect_netb_status_resp( tvbuff_t *tvb, int offset, proto_tree *tree)
|
1999-08-10 20:06:39 +00:00
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
{/* Handle the STATUS RESPONSE command */
|
2000-11-10 15:44:11 +00:00
|
|
|
guint8 status_response = tvb_get_guint8( tvb, offset + NB_DATA1);
|
1999-09-03 07:20:15 +00:00
|
|
|
proto_item *td2;
|
|
|
|
proto_tree *data2_tree;
|
|
|
|
guint16 data2;
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
nb_call_name_type( tvb, offset, tree);
|
1999-09-03 07:20:15 +00:00
|
|
|
if (status_response == 0) {
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_text(tree, tvb, offset + NB_DATA1, 1,
|
1999-09-03 07:20:15 +00:00
|
|
|
"Status response: NetBIOS 1.x or 2.0");
|
|
|
|
} else {
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_text(tree, tvb, offset + NB_DATA1, 1,
|
1999-09-03 07:20:15 +00:00
|
|
|
"Status response: NetBIOS 2.1, %u names sent so far",
|
|
|
|
status_response);
|
|
|
|
}
|
2000-11-10 15:44:11 +00:00
|
|
|
data2 = tvb_get_letohs( tvb, offset + NB_DATA2);
|
|
|
|
|
|
|
|
td2 = proto_tree_add_text(tree, tvb, offset + NB_DATA2, 2, "Status: 0x%04x",
|
1999-09-03 07:20:15 +00:00
|
|
|
data2);
|
1999-11-16 11:44:20 +00:00
|
|
|
data2_tree = proto_item_add_subtree(td2, ett_netb_status);
|
1999-09-03 07:20:15 +00:00
|
|
|
if (data2 & 0x8000) {
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_text(data2_tree, tvb, offset, 2, "%s",
|
1999-09-03 07:20:15 +00:00
|
|
|
decode_boolean_bitfield(data2, 0x8000, 8*2,
|
|
|
|
"Data length exceeds maximum frame size", NULL));
|
|
|
|
}
|
|
|
|
if (data2 & 0x4000) {
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_text(data2_tree, tvb, offset, 2, "%s",
|
1999-09-03 07:20:15 +00:00
|
|
|
decode_boolean_bitfield(data2, 0x4000, 8*2,
|
|
|
|
"Data length exceeds user's buffer", NULL));
|
|
|
|
}
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_text(data2_tree, tvb, offset, 2, "%s",
|
1999-09-03 07:20:15 +00:00
|
|
|
decode_numeric_bitfield(data2, 0x3FFF, 2*8,
|
|
|
|
"Status data length = %u"));
|
2002-08-28 21:04:11 +00:00
|
|
|
nb_xmit_corrl( tvb, offset, tree);
|
2001-01-15 04:39:28 +00:00
|
|
|
netbios_add_name("Receiver's Name", tvb, offset + NB_RECVER_NAME, tree);
|
2000-11-10 15:44:11 +00:00
|
|
|
netbios_add_name("Sender's Name", tvb, offset + NB_SENDER_NAME,
|
1999-09-03 07:20:15 +00:00
|
|
|
tree);
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
return 0;
|
1999-08-10 20:06:39 +00:00
|
|
|
}
|
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static guint32
|
|
|
|
dissect_netb_data_ack( tvbuff_t* tvb, int offset, proto_tree *tree)
|
1999-09-03 04:37:11 +00:00
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
{/* Handle the DATA ACK command */
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
nb_xmit_corrl( tvb, offset, tree);
|
|
|
|
nb_remote_session( tvb, offset, tree);
|
|
|
|
nb_local_session( tvb, offset, tree);
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
return 0;
|
1999-09-03 04:37:11 +00:00
|
|
|
}
|
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static guint32
|
|
|
|
dissect_netb_data_first_middle( tvbuff_t *tvb, int offset, proto_tree *tree)
|
1999-08-10 20:06:39 +00:00
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
{/* Handle the DATA FIRST MIDDLE command */
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
guint8 remote_session, local_session;
|
|
|
|
|
2002-05-01 09:50:44 +00:00
|
|
|
/*
|
2002-10-24 06:17:36 +00:00
|
|
|
* This is the first frame, or the middle frame, of a fragmented
|
|
|
|
* packet.
|
|
|
|
*
|
|
|
|
* XXX - there are no sequence numbers, so we have to assume
|
|
|
|
* that fragments arrive in order with no duplicates.
|
|
|
|
* In fact, 802.2 LLC is supposed to handle that, so we
|
|
|
|
* might have to have the LLC dissector do so (but the TCP
|
|
|
|
* dissector doesn't currently handle out-of-order or duplicate
|
|
|
|
* data, either).
|
2002-05-01 09:50:44 +00:00
|
|
|
*/
|
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
netbios_data_first_middle_flags( tvb, tree, offset + NB_FLAGS);
|
1999-09-03 07:20:15 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
nb_resync_indicator( tvb, offset, tree, "DATA FIRST MIDDLE");
|
|
|
|
nb_xmit_corrl( tvb, offset, tree);
|
|
|
|
nb_resp_corrl( tvb, offset, tree);
|
2002-10-24 06:17:36 +00:00
|
|
|
remote_session = nb_remote_session( tvb, offset, tree);
|
|
|
|
local_session = nb_local_session( tvb, offset, tree);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Return a combination of the remote and local session numbers,
|
|
|
|
* for use when reassembling.
|
|
|
|
*/
|
|
|
|
return (remote_session << 8) + local_session;
|
1999-08-10 20:06:39 +00:00
|
|
|
}
|
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static guint32
|
|
|
|
dissect_netb_data_only_last( tvbuff_t *tvb, int offset, proto_tree *tree)
|
1999-09-03 04:37:11 +00:00
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
{/* Handle the DATA ONLY LAST command */
|
1999-09-03 04:37:11 +00:00
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
guint8 remote_session, local_session;
|
|
|
|
|
2002-05-01 09:50:44 +00:00
|
|
|
/*
|
2002-10-24 06:17:36 +00:00
|
|
|
* This is a complete packet, or the last frame of a fragmented
|
|
|
|
* packet.
|
2002-05-01 09:50:44 +00:00
|
|
|
*/
|
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
netbios_data_only_flags( tvb, tree, offset + NB_FLAGS);
|
1999-09-03 04:37:11 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
nb_resync_indicator( tvb, offset, tree, "DATA ONLY LAST");
|
|
|
|
nb_xmit_corrl( tvb, offset, tree);
|
|
|
|
nb_resp_corrl( tvb, offset, tree);
|
2002-10-24 06:17:36 +00:00
|
|
|
remote_session = nb_remote_session( tvb, offset, tree);
|
|
|
|
local_session = nb_local_session( tvb, offset, tree);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Return a combination of the remote and local session numbers,
|
|
|
|
* for use when reassembling.
|
|
|
|
*/
|
|
|
|
return (remote_session << 8) + local_session;
|
1999-09-03 04:37:11 +00:00
|
|
|
}
|
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static guint32
|
|
|
|
dissect_netb_session_confirm( tvbuff_t *tvb, int offset, proto_tree *tree)
|
1999-09-03 04:37:11 +00:00
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
{/* Handle the SESSION CONFIRM command */
|
1999-09-03 04:37:11 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
netbios_add_ses_confirm_flags( tvb, tree, offset + NB_FLAGS);
|
1999-09-03 04:37:11 +00:00
|
|
|
|
2002-05-02 02:42:17 +00:00
|
|
|
nb_data2( hf_netb_max_data_recv_size, tvb, offset, tree);
|
2000-11-10 15:44:11 +00:00
|
|
|
nb_xmit_corrl( tvb, offset, tree);
|
|
|
|
nb_resp_corrl( tvb, offset, tree);
|
|
|
|
nb_remote_session( tvb, offset, tree);
|
|
|
|
nb_local_session( tvb, offset, tree);
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
return 0;
|
1999-09-03 07:20:15 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static guint32
|
|
|
|
dissect_netb_session_end( tvbuff_t *tvb, int offset, proto_tree *tree)
|
1999-09-03 07:20:15 +00:00
|
|
|
|
|
|
|
{/* Handle the SESSION END command */
|
|
|
|
|
2002-05-02 02:42:17 +00:00
|
|
|
nb_data2( hf_netb_termination_indicator, tvb, offset, tree);
|
2000-11-10 15:44:11 +00:00
|
|
|
nb_remote_session( tvb, offset, tree);
|
|
|
|
nb_local_session( tvb, offset, tree);
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
return 0;
|
1999-09-03 04:37:11 +00:00
|
|
|
}
|
1999-08-10 20:06:39 +00:00
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static guint32
|
|
|
|
dissect_netb_session_init( tvbuff_t *tvb, int offset, proto_tree *tree)
|
1999-08-10 20:06:39 +00:00
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
{/* Handle the SESSION INITIALIZE command */
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
netbios_add_session_init_flags( tvb, tree, offset + NB_FLAGS);
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2002-05-02 02:42:17 +00:00
|
|
|
nb_data2( hf_netb_max_data_recv_size, tvb, offset, tree);
|
2000-11-10 15:44:11 +00:00
|
|
|
nb_resp_corrl( tvb, offset, tree);
|
|
|
|
nb_xmit_corrl( tvb, offset, tree);
|
|
|
|
nb_remote_session( tvb, offset, tree);
|
|
|
|
nb_local_session( tvb, offset, tree);
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
return 0;
|
1999-08-10 20:06:39 +00:00
|
|
|
}
|
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static guint32
|
|
|
|
dissect_netb_no_receive( tvbuff_t *tvb, int offset, proto_tree *tree)
|
1999-09-03 04:37:11 +00:00
|
|
|
|
|
|
|
{/* Handle the NO RECEIVE command */
|
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
netbios_no_receive_flags( tvb, tree, offset + NB_FLAGS);
|
1999-09-03 04:37:11 +00:00
|
|
|
|
2002-05-02 02:42:17 +00:00
|
|
|
nb_data2( hf_netb_num_data_bytes_accepted, tvb, offset, tree);
|
2000-11-10 15:44:11 +00:00
|
|
|
nb_remote_session( tvb, offset, tree);
|
|
|
|
nb_local_session( tvb, offset, tree);
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
return 0;
|
1999-09-03 04:37:11 +00:00
|
|
|
}
|
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static guint32
|
|
|
|
dissect_netb_receive_outstanding( tvbuff_t *tvb, int offset, proto_tree *tree)
|
1999-09-03 04:37:11 +00:00
|
|
|
|
|
|
|
{/* Handle the RECEIVE OUTSTANDING command */
|
|
|
|
|
2002-05-02 02:42:17 +00:00
|
|
|
nb_data2( hf_netb_num_data_bytes_accepted, tvb, offset, tree);
|
2000-11-10 15:44:11 +00:00
|
|
|
nb_remote_session( tvb, offset, tree);
|
|
|
|
nb_local_session( tvb, offset, tree);
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
return 0;
|
1999-09-03 04:37:11 +00:00
|
|
|
}
|
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static guint32
|
|
|
|
dissect_netb_receive_continue( tvbuff_t *tvb, int offset, proto_tree *tree)
|
1999-09-03 04:37:11 +00:00
|
|
|
|
|
|
|
{/* Handle the RECEIVE CONTINUE command */
|
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
nb_xmit_corrl( tvb, offset, tree);
|
|
|
|
nb_remote_session( tvb, offset, tree);
|
|
|
|
nb_local_session( tvb, offset, tree);
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
return 0;
|
1999-09-03 04:37:11 +00:00
|
|
|
}
|
1999-08-10 20:06:39 +00:00
|
|
|
|
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static guint32
|
|
|
|
dissect_netb_session_alive( tvbuff_t *tvb, int offset, proto_tree *tree)
|
2002-05-01 09:50:44 +00:00
|
|
|
|
|
|
|
{/* Handle the SESSION ALIVE command */
|
|
|
|
|
2002-05-02 02:42:17 +00:00
|
|
|
/*
|
|
|
|
* XXX - all the fields are claimed to be "Reserved", but
|
|
|
|
* the session numbers appear to be non-zero in at least
|
|
|
|
* one capture, and they do appear to match session numbers
|
|
|
|
* in other messages, and I'd expect that you had to identify
|
|
|
|
* sessions in this message in any case.
|
|
|
|
*
|
|
|
|
* We show only those fields.
|
|
|
|
*/
|
2002-05-01 09:50:44 +00:00
|
|
|
nb_remote_session( tvb, offset, tree);
|
|
|
|
nb_local_session( tvb, offset, tree);
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
return 0;
|
2002-05-01 09:50:44 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
1999-08-10 20:06:39 +00:00
|
|
|
/************************************************************************/
|
|
|
|
/* */
|
|
|
|
/* The table routines called by the top level to handle commands */
|
|
|
|
/* */
|
|
|
|
/************************************************************************/
|
|
|
|
|
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static guint32 (*dissect_netb[])(tvbuff_t *, int, proto_tree *) = {
|
1999-08-10 20:06:39 +00:00
|
|
|
|
1999-09-03 07:20:15 +00:00
|
|
|
dissect_netb_add_group_name, /* Add Group Name 0x00 */
|
1999-09-03 04:37:11 +00:00
|
|
|
dissect_netb_add_name, /* Add Name 0x01 */
|
|
|
|
dissect_netb_name_in_conflict,/* Name In Conflict 0x02 */
|
1999-09-03 07:20:15 +00:00
|
|
|
dissect_netb_status_query, /* Status Query 0x03 */
|
1999-09-03 04:37:11 +00:00
|
|
|
dissect_netb_unknown, /* unknown 0x04 */
|
|
|
|
dissect_netb_unknown, /* unknown 0x05 */
|
|
|
|
dissect_netb_unknown, /* unknown 0x06 */
|
2002-05-01 09:50:44 +00:00
|
|
|
dissect_netb_terminate_trace, /* Terminate Trace 0x07 */
|
1999-09-03 04:37:11 +00:00
|
|
|
dissect_netb_datagram, /* Datagram 0x08 */
|
|
|
|
dissect_netb_datagram_bcast, /* Datagram Broadcast 0x09 */
|
|
|
|
dissect_netb_name_query, /* Name Query 0x0A */
|
|
|
|
dissect_netb_unknown, /* unknown 0x0B */
|
|
|
|
dissect_netb_unknown, /* unknown 0x0C */
|
|
|
|
dissect_netb_add_name_resp, /* Add Name Response 0x0D */
|
1999-09-03 07:20:15 +00:00
|
|
|
dissect_netb_name_resp, /* Name Recognized 0x0E */
|
|
|
|
dissect_netb_status_resp, /* Status Response 0x0F */
|
1999-09-03 04:37:11 +00:00
|
|
|
dissect_netb_unknown, /* unknown 0x10 */
|
|
|
|
dissect_netb_unknown, /* unknown 0x11 */
|
|
|
|
dissect_netb_unknown, /* unknown 0x12 */
|
2002-05-01 09:50:44 +00:00
|
|
|
dissect_netb_terminate_trace, /* Terminate Trace 0x13 */
|
1999-09-03 04:37:11 +00:00
|
|
|
dissect_netb_data_ack, /* Data Ack 0x14 */
|
|
|
|
dissect_netb_data_first_middle,/* Data First Middle 0x15 */
|
|
|
|
dissect_netb_data_only_last, /* Data Only Last 0x16 */
|
|
|
|
dissect_netb_session_confirm, /* Session Confirm 0x17 */
|
|
|
|
dissect_netb_session_end, /* Session End 0x18 */
|
|
|
|
dissect_netb_session_init, /* Session Initialize 0x19 */
|
|
|
|
dissect_netb_no_receive, /* No Receive 0x1A */
|
|
|
|
dissect_netb_receive_outstanding,/* Receive Outstanding 0x1B */
|
|
|
|
dissect_netb_receive_continue,/* Receive Continue 0x1C */
|
|
|
|
dissect_netb_unknown, /* unknown 0x1D */
|
|
|
|
dissect_netb_unknown, /* unknown 0x1E */
|
2002-05-01 09:50:44 +00:00
|
|
|
dissect_netb_session_alive, /* Session Alive 0x1f */
|
2002-08-28 21:04:11 +00:00
|
|
|
dissect_netb_unknown,
|
1999-08-10 20:06:39 +00:00
|
|
|
};
|
|
|
|
|
2001-09-28 22:43:57 +00:00
|
|
|
static heur_dissector_list_t netbios_heur_subdissector_list;
|
|
|
|
|
|
|
|
void
|
2001-09-29 00:57:36 +00:00
|
|
|
dissect_netbios_payload(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
|
2001-09-28 22:43:57 +00:00
|
|
|
{
|
|
|
|
/*
|
2001-09-29 01:19:01 +00:00
|
|
|
* Try the heuristic dissectors for NetBIOS; if none of them
|
|
|
|
* accept the packet, dissect it as data.
|
2001-09-28 22:43:57 +00:00
|
|
|
*/
|
2001-09-29 01:19:01 +00:00
|
|
|
if (!dissector_try_heuristic(netbios_heur_subdissector_list,
|
2001-09-29 00:57:36 +00:00
|
|
|
tvb, pinfo, tree))
|
2001-11-26 04:52:51 +00:00
|
|
|
call_dissector(data_handle,tvb, pinfo, tree);
|
2001-09-28 22:43:57 +00:00
|
|
|
}
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
static void
|
|
|
|
dissect_netbios(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
|
1999-08-10 20:06:39 +00:00
|
|
|
|
|
|
|
{
|
2002-10-24 06:17:36 +00:00
|
|
|
proto_tree *netb_tree = NULL;
|
1999-08-10 20:06:39 +00:00
|
|
|
proto_item *ti;
|
|
|
|
guint16 hdr_len, command;
|
2002-05-01 09:50:44 +00:00
|
|
|
char *command_name;
|
1999-09-03 00:24:40 +00:00
|
|
|
char name[(NETBIOS_NAME_LEN - 1)*4 + 1];
|
|
|
|
int name_type;
|
2002-10-24 06:17:36 +00:00
|
|
|
guint16 session_id;
|
|
|
|
gboolean save_fragmented;
|
|
|
|
int len;
|
|
|
|
fragment_data *fd_head;
|
2001-09-29 00:57:36 +00:00
|
|
|
tvbuff_t *next_tvb;
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
int offset = 0;
|
|
|
|
|
|
|
|
/* load the display labels */
|
2001-12-10 00:26:21 +00:00
|
|
|
if (check_col(pinfo->cinfo, COL_PROTOCOL))
|
|
|
|
col_set_str(pinfo->cinfo, COL_PROTOCOL, "NetBIOS");
|
2000-11-10 15:44:11 +00:00
|
|
|
|
|
|
|
|
1999-08-10 20:06:39 +00:00
|
|
|
/* Find NetBIOS marker EFFF, this is done because I have seen an extra LLC */
|
|
|
|
/* byte on our network. This only checks for one extra LLC byte. */
|
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
if ( 0xefff != tvb_get_letohs(tvb, 2)){
|
1999-08-10 20:06:39 +00:00
|
|
|
++offset;
|
2000-11-10 15:44:11 +00:00
|
|
|
if ( 0xefff != tvb_get_letohs(tvb, 3)){
|
|
|
|
|
2001-12-10 00:26:21 +00:00
|
|
|
if (check_col( pinfo->cinfo, COL_INFO)) /* print bad packet */
|
|
|
|
col_set_str( pinfo->cinfo, COL_INFO, "Bad packet, no 0xEFFF marker");
|
2000-11-10 15:44:11 +00:00
|
|
|
|
|
|
|
return; /* this is an unknow packet, no marker */
|
1999-08-10 20:06:39 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
hdr_len = tvb_get_letohs(tvb, offset + NB_LENGTH);
|
|
|
|
command = tvb_get_guint8( tvb, offset + NB_COMMAND);
|
|
|
|
/* limit command so no table overflows */
|
|
|
|
command = MIN( command, sizeof( dissect_netb)/ sizeof(void *));
|
|
|
|
|
2001-12-10 00:26:21 +00:00
|
|
|
if (check_col( pinfo->cinfo, COL_INFO)) { /* print command name */
|
2002-05-01 09:50:44 +00:00
|
|
|
command_name = val_to_str(command, cmd_vals, "Unknown (0x%02x)");
|
2000-11-10 15:44:11 +00:00
|
|
|
switch ( command ) {
|
|
|
|
case NB_NAME_QUERY:
|
|
|
|
name_type = get_netbios_name( tvb, offset + 12, name);
|
2001-12-10 00:26:21 +00:00
|
|
|
col_add_fstr( pinfo->cinfo, COL_INFO, "%s for %s<%02x>",
|
2002-05-01 09:50:44 +00:00
|
|
|
command_name, name, name_type);
|
2000-11-10 15:44:11 +00:00
|
|
|
break;
|
|
|
|
|
|
|
|
case NB_NAME_RESP:
|
|
|
|
case NB_ADD_NAME:
|
|
|
|
case NB_ADD_GROUP:
|
|
|
|
name_type = get_netbios_name( tvb, offset + 28, name);
|
2001-12-10 00:26:21 +00:00
|
|
|
col_add_fstr( pinfo->cinfo, COL_INFO, "%s - %s<%02x>",
|
2002-05-01 09:50:44 +00:00
|
|
|
command_name, name, name_type);
|
2000-11-10 15:44:11 +00:00
|
|
|
break;
|
1999-08-10 20:06:39 +00:00
|
|
|
|
1999-09-03 00:24:40 +00:00
|
|
|
default:
|
2002-05-01 09:50:44 +00:00
|
|
|
col_add_fstr( pinfo->cinfo, COL_INFO, "%s",
|
|
|
|
command_name);
|
1999-09-03 00:24:40 +00:00
|
|
|
break;
|
|
|
|
}
|
1999-08-10 20:06:39 +00:00
|
|
|
}
|
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
if ( tree) {
|
2001-09-29 20:32:29 +00:00
|
|
|
ti = proto_tree_add_item(tree, proto_netbios, tvb, 0, hdr_len, FALSE);
|
1999-11-16 11:44:20 +00:00
|
|
|
netb_tree = proto_item_add_subtree(ti, ett_netb);
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_uint_format(netb_tree, hf_netb_hdr_len, tvb, offset, 2, hdr_len,
|
|
|
|
"Length: %d bytes", hdr_len);
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_tree_add_text(netb_tree, tvb, offset + 2, 2,
|
|
|
|
"Delimiter: EFFF (NetBIOS)");
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2002-05-01 09:50:44 +00:00
|
|
|
proto_tree_add_uint(netb_tree, hf_netb_cmd, tvb, offset + NB_COMMAND, 1, command);
|
2002-10-24 06:17:36 +00:00
|
|
|
}
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
/* if command in table range */
|
|
|
|
if ( command < sizeof( dissect_netb)/ sizeof(void *)) {
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
/* branch to handle commands */
|
|
|
|
session_id = (dissect_netb[ command])( tvb, offset, netb_tree);
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
offset += hdr_len; /* move past header */
|
2001-09-14 07:10:13 +00:00
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
save_fragmented = pinfo->fragmented;
|
2002-05-01 09:50:44 +00:00
|
|
|
|
|
|
|
/*
|
2002-10-24 06:17:36 +00:00
|
|
|
* Process user data in frames that have it.
|
2002-05-01 09:50:44 +00:00
|
|
|
*/
|
2002-10-24 06:17:36 +00:00
|
|
|
switch (command) {
|
|
|
|
|
|
|
|
case NB_DATAGRAM:
|
|
|
|
case NB_DATAGRAM_BCAST:
|
|
|
|
/*
|
|
|
|
* No fragmentation here.
|
|
|
|
*/
|
|
|
|
next_tvb = tvb_new_subset(tvb, offset, -1, -1);
|
|
|
|
dissect_netbios_payload(next_tvb, pinfo, tree);
|
|
|
|
break;
|
|
|
|
|
|
|
|
case NB_DATA_FIRST_MIDDLE:
|
|
|
|
case NB_DATA_ONLY_LAST:
|
|
|
|
/*
|
|
|
|
* Possibly fragmented.
|
|
|
|
*/
|
2003-03-04 06:47:10 +00:00
|
|
|
len = tvb_reported_length_remaining(tvb, offset);
|
|
|
|
if (netbios_defragment &&
|
|
|
|
tvb_bytes_exist(tvb, offset, len)) {
|
2002-10-24 06:17:36 +00:00
|
|
|
fd_head = fragment_add_seq_next(tvb, offset,
|
|
|
|
pinfo, session_id,
|
|
|
|
netbios_fragment_table,
|
|
|
|
netbios_reassembled_table,
|
|
|
|
len, command == NB_DATA_FIRST_MIDDLE);
|
|
|
|
if (fd_head != NULL) {
|
|
|
|
if (fd_head->next != NULL) {
|
|
|
|
next_tvb = tvb_new_real_data(fd_head->data,
|
|
|
|
fd_head->len, fd_head->len);
|
|
|
|
tvb_set_child_real_data_tvbuff(tvb,
|
|
|
|
next_tvb);
|
|
|
|
add_new_data_source(pinfo,
|
|
|
|
next_tvb,
|
|
|
|
"Reassembled NetBIOS");
|
|
|
|
/* Show all fragments. */
|
|
|
|
if (tree) {
|
|
|
|
show_fragment_seq_tree(fd_head,
|
|
|
|
&netbios_frag_items,
|
|
|
|
netb_tree, pinfo,
|
|
|
|
next_tvb);
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
next_tvb = tvb_new_subset(tvb,
|
|
|
|
offset, -1, -1);
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
next_tvb = NULL;
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
/*
|
2002-12-17 08:48:38 +00:00
|
|
|
* Dissect this, regardless of whether
|
|
|
|
* it's NB_DATA_FIRST_MIDDLE or
|
|
|
|
* NB_DATA_ONLY_LAST.
|
2002-10-24 06:17:36 +00:00
|
|
|
*
|
2002-12-17 08:48:38 +00:00
|
|
|
* XXX - it'd be nice to show
|
|
|
|
* NB_DATA_FIRST_MIDDLE as a fragment
|
|
|
|
* if it's not the first fragment (i.e.,
|
|
|
|
* MIDDLE rather than FIRST), and show
|
|
|
|
* NB_DATA_ONLY_LAST as a fragment if
|
|
|
|
* it's part of a fragmented datagram
|
|
|
|
* (i.e, LAST rather than ONLY), but
|
|
|
|
* we'd have to do reassembly to
|
|
|
|
* be able to determine that.
|
2002-10-24 06:17:36 +00:00
|
|
|
*/
|
2002-12-17 08:48:38 +00:00
|
|
|
next_tvb = tvb_new_subset(tvb, offset, -1, -1);
|
2002-10-24 06:17:36 +00:00
|
|
|
}
|
|
|
|
if (next_tvb != NULL)
|
|
|
|
dissect_netbios_payload(next_tvb, pinfo, tree);
|
|
|
|
else {
|
|
|
|
next_tvb = tvb_new_subset (tvb, offset, -1, -1);
|
|
|
|
call_dissector(data_handle, next_tvb, pinfo,
|
|
|
|
tree);
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
}
|
2002-05-01 09:50:44 +00:00
|
|
|
}
|
1999-08-10 20:06:39 +00:00
|
|
|
}
|
|
|
|
|
2002-10-24 06:17:36 +00:00
|
|
|
static void
|
|
|
|
netbios_init(void)
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* Initialize the fragment and reassembly tables.
|
|
|
|
*/
|
|
|
|
fragment_table_init(&netbios_fragment_table);
|
|
|
|
reassembled_table_init(&netbios_reassembled_table);
|
|
|
|
}
|
1999-08-10 20:06:39 +00:00
|
|
|
|
|
|
|
void proto_register_netbios(void)
|
|
|
|
{
|
1999-11-16 11:44:20 +00:00
|
|
|
static gint *ett[] = {
|
|
|
|
&ett_netb,
|
|
|
|
&ett_netb_name,
|
|
|
|
&ett_netb_flags,
|
|
|
|
&ett_netb_status,
|
2002-10-24 06:17:36 +00:00
|
|
|
&ett_netb_fragments,
|
|
|
|
&ett_netb_fragment,
|
1999-11-16 11:44:20 +00:00
|
|
|
};
|
1999-08-10 20:06:39 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
static hf_register_info hf_netb[] = {
|
|
|
|
{ &hf_netb_cmd,
|
2002-05-01 09:50:44 +00:00
|
|
|
{ "Command", "netbios.command", FT_UINT8, BASE_HEX, VALS(cmd_vals), 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"", HFILL }},
|
2002-05-01 09:50:44 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
{ &hf_netb_hdr_len,
|
|
|
|
{ "Header Length", "netbios.hdr_len", FT_UINT16, BASE_DEC, NULL, 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"", HFILL }},
|
2000-11-10 15:44:11 +00:00
|
|
|
|
|
|
|
{ &hf_netb_xmit_corrl,
|
2002-05-01 09:50:44 +00:00
|
|
|
{ "Transmit Correlator", "netbios.xmit_corrl", FT_UINT16, BASE_HEX, NULL, 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"", HFILL }},
|
2000-11-10 15:44:11 +00:00
|
|
|
|
|
|
|
{ &hf_netb_resp_corrl,
|
2002-05-01 09:50:44 +00:00
|
|
|
{ "Response Correlator", "netbios.resp_corrl", FT_UINT16, BASE_HEX, NULL, 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"", HFILL }},
|
2002-05-01 09:50:44 +00:00
|
|
|
|
2000-11-10 15:44:11 +00:00
|
|
|
{ &hf_netb_call_name_type,
|
2002-05-02 02:42:17 +00:00
|
|
|
{ "Caller's Name Type", "netbios.call_name_type", FT_UINT8, BASE_HEX, VALS(name_types), 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"", HFILL }},
|
2002-05-01 09:50:44 +00:00
|
|
|
|
2002-05-02 02:42:17 +00:00
|
|
|
{ &hf_netb_nb_name_type,
|
|
|
|
{ "NetBIOS Name Type", "netbios.nb_name_type", FT_UINT8, BASE_HEX, VALS(nb_name_type_vals), 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"", HFILL }},
|
2002-05-01 09:50:44 +00:00
|
|
|
|
2002-05-02 02:42:17 +00:00
|
|
|
{ &hf_netb_nb_name,
|
|
|
|
{ "NetBIOS Name", "netbios.nb_name", FT_STRING, BASE_NONE, NULL, 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"", HFILL }},
|
2000-11-10 15:44:11 +00:00
|
|
|
|
|
|
|
{ &hf_netb_ack,
|
|
|
|
{ "Acknowledge", "netbios.ack", FT_BOOLEAN, 8, TFS( &flags_set), 0x08,
|
2001-06-18 02:18:27 +00:00
|
|
|
"", HFILL }},
|
2000-11-10 15:44:11 +00:00
|
|
|
|
|
|
|
{ &hf_netb_ack_with_data,
|
2002-08-28 21:04:11 +00:00
|
|
|
{ "Acknowledge with data", "netbios.ack_with_data", FT_BOOLEAN, 8, TFS( &flags_allowed), 0x04,
|
2001-06-18 02:18:27 +00:00
|
|
|
"", HFILL }},
|
2000-11-10 15:44:11 +00:00
|
|
|
|
|
|
|
{ &hf_netb_ack_expected,
|
|
|
|
{ "Acknowledge expected", "netbios.ack_expected", FT_BOOLEAN, 8,
|
2001-06-18 02:18:27 +00:00
|
|
|
TFS( &flags_yes_no), 0x02, "", HFILL }},
|
2000-11-10 15:44:11 +00:00
|
|
|
|
|
|
|
{ &hf_netb_recv_cont_req,
|
|
|
|
{ "RECEIVE_CONTINUE requested", "netbios.recv_cont_req", FT_BOOLEAN, 8,
|
2001-06-18 02:18:27 +00:00
|
|
|
TFS( &flags_yes_no), 0x01, "", HFILL }},
|
2000-11-10 15:44:11 +00:00
|
|
|
|
|
|
|
{ &hf_netb_send_no_ack,
|
|
|
|
{ "Handle SEND.NO.ACK", "netbios.send_no_ack", FT_BOOLEAN, 8,
|
2001-06-18 02:18:27 +00:00
|
|
|
TFS( &flags_yes_no), 0x80, "", HFILL }},
|
2000-11-10 15:44:11 +00:00
|
|
|
|
|
|
|
{ &hf_netb_version,
|
|
|
|
{ "NetBIOS Version", "netbios.version", FT_BOOLEAN, 8,
|
2001-06-18 02:18:27 +00:00
|
|
|
TFS( &netb_version_str), 0x01, "", HFILL }},
|
2000-11-10 15:44:11 +00:00
|
|
|
|
|
|
|
{ &hf_netb_largest_frame,
|
2002-05-02 02:42:17 +00:00
|
|
|
{ "Largest Frame", "netbios.largest_frame", FT_UINT8, BASE_DEC, VALS(max_frame_size_vals), 0x0E,
|
|
|
|
"", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_netb_status_buffer_len,
|
|
|
|
{ "Length of status buffer", "netbios.status_buffer_len", FT_UINT16, BASE_DEC, NULL, 0x0,
|
|
|
|
"", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_netb_status,
|
|
|
|
{ "Status", "netbios.status", FT_UINT8, BASE_DEC, VALS(status_vals), 0x0,
|
|
|
|
"", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_netb_name_type,
|
|
|
|
{ "Name type", "netbios.name_type", FT_UINT16, BASE_DEC, VALS(name_types), 0x0,
|
|
|
|
"", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_netb_max_data_recv_size,
|
|
|
|
{ "Maximum data receive size", "netbios.max_data_recv_size", FT_UINT16, BASE_DEC, NULL, 0x0,
|
|
|
|
"", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_netb_termination_indicator,
|
|
|
|
{ "Termination indicator", "netbios.termination_indicator", FT_UINT16, BASE_HEX, VALS(termination_indicator_vals), 0x0,
|
|
|
|
"", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_netb_num_data_bytes_accepted,
|
|
|
|
{ "Number of data bytes accepted", "netbios.num_data_bytes_accepted", FT_UINT16, BASE_DEC, NULL, 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"", HFILL }},
|
2000-11-10 15:44:11 +00:00
|
|
|
|
|
|
|
{ &hf_netb_local_ses_no,
|
2002-05-01 09:50:44 +00:00
|
|
|
{ "Local Session No.", "netbios.local_session", FT_UINT8, BASE_HEX, NULL, 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"", HFILL }},
|
2000-11-10 15:44:11 +00:00
|
|
|
|
|
|
|
{ &hf_netb_remote_ses_no,
|
2002-05-01 09:50:44 +00:00
|
|
|
{ "Remote Session No.", "netbios.remote_session", FT_UINT8, BASE_HEX, NULL, 0x0,
|
|
|
|
"", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_netb_data1,
|
|
|
|
{ "DATA1 value", "netbios.data1", FT_UINT8, BASE_HEX, NULL, 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"", HFILL }},
|
2000-11-13 03:52:16 +00:00
|
|
|
|
|
|
|
{ &hf_netb_data2,
|
2002-05-01 09:50:44 +00:00
|
|
|
{ "DATA2 value", "netbios.data2", FT_UINT16, BASE_HEX, NULL, 0x0,
|
2001-06-18 02:18:27 +00:00
|
|
|
"", HFILL }},
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
{ &hf_netb_fragment_overlap,
|
2002-12-03 08:24:58 +00:00
|
|
|
{ "Fragment overlap", "netbios.fragment.overlap", FT_BOOLEAN, BASE_NONE,
|
|
|
|
NULL, 0x0, "Fragment overlaps with other fragments", HFILL }},
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
{ &hf_netb_fragment_overlap_conflict,
|
2002-12-03 08:24:58 +00:00
|
|
|
{ "Conflicting data in fragment overlap", "netbios.fragment.overlap.conflict",
|
2002-10-24 06:17:36 +00:00
|
|
|
FT_BOOLEAN, BASE_NONE,
|
2002-12-03 08:24:58 +00:00
|
|
|
NULL, 0x0, "Overlapping fragments contained conflicting data", HFILL }},
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
{ &hf_netb_fragment_multiple_tails,
|
2002-12-03 08:24:58 +00:00
|
|
|
{ "Multiple tail fragments found", "netbios.fragment.multipletails",
|
2002-10-24 06:17:36 +00:00
|
|
|
FT_BOOLEAN, BASE_NONE,
|
2002-12-03 08:24:58 +00:00
|
|
|
NULL, 0x0, "Several tails were found when defragmenting the packet", HFILL }},
|
2002-10-24 06:17:36 +00:00
|
|
|
|
2002-12-03 08:24:58 +00:00
|
|
|
{ &hf_netb_fragment_too_long_fragment,
|
|
|
|
{ "Fragment too long", "netbios.fragment.toolongfragment", FT_BOOLEAN, BASE_NONE,
|
|
|
|
NULL, 0x0, "Fragment contained data past end of packet", HFILL }},
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
{ &hf_netb_fragment_error,
|
2002-12-19 11:22:38 +00:00
|
|
|
{"Defragmentation error", "netbios.fragment.error", FT_FRAMENUM, BASE_NONE,
|
2002-12-03 08:24:58 +00:00
|
|
|
NULL, 0x0, "Defragmentation error due to illegal fragments", HFILL }},
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
{ &hf_netb_fragment,
|
2002-12-19 11:22:38 +00:00
|
|
|
{ "NetBIOS Fragment", "netbios.fragment", FT_FRAMENUM, BASE_NONE,
|
2002-10-24 06:17:36 +00:00
|
|
|
NULL, 0x0, "NetBIOS Fragment", HFILL }},
|
|
|
|
|
|
|
|
{ &hf_netb_fragments,
|
|
|
|
{ "NetBIOS Fragments", "netbios.fragments", FT_NONE, BASE_NONE,
|
|
|
|
NULL, 0x0, "NetBIOS Fragments", HFILL }},
|
|
|
|
};
|
|
|
|
module_t *netbios_module;
|
2000-11-10 15:44:11 +00:00
|
|
|
|
2001-01-03 06:56:03 +00:00
|
|
|
proto_netbios = proto_register_protocol("NetBIOS", "NetBIOS", "netbios");
|
2002-08-28 21:04:11 +00:00
|
|
|
proto_register_subtree_array(ett, array_length(ett));
|
2000-11-10 15:44:11 +00:00
|
|
|
proto_register_field_array(proto_netbios, hf_netb, array_length(hf_netb));
|
2001-09-28 22:43:57 +00:00
|
|
|
|
|
|
|
register_heur_dissector_list("netbios", &netbios_heur_subdissector_list);
|
2002-10-24 06:17:36 +00:00
|
|
|
|
|
|
|
netbios_module = prefs_register_protocol(proto_netbios, NULL);
|
|
|
|
prefs_register_bool_preference(netbios_module, "defragment",
|
|
|
|
"Defragment all NetBIOS messages spanning multiple frames",
|
2002-12-03 08:24:58 +00:00
|
|
|
"Whether the NetBIOS dissector should defragment all messages spanning multiple frames",
|
2002-10-24 06:17:36 +00:00
|
|
|
&netbios_defragment);
|
|
|
|
|
|
|
|
register_init_routine(netbios_init);
|
1999-08-10 20:06:39 +00:00
|
|
|
}
|
2000-04-17 00:32:43 +00:00
|
|
|
|
|
|
|
void
|
|
|
|
proto_reg_handoff_netbios(void)
|
|
|
|
{
|
2001-12-03 04:00:26 +00:00
|
|
|
dissector_handle_t netbios_handle;
|
|
|
|
|
|
|
|
netbios_handle = create_dissector_handle(dissect_netbios,
|
|
|
|
proto_netbios);
|
|
|
|
dissector_add("llc.dsap", SAP_NETBIOS, netbios_handle);
|
2001-11-26 04:52:51 +00:00
|
|
|
data_handle = find_dissector("data");
|
2000-04-17 00:32:43 +00:00
|
|
|
}
|