It checks to see if the packet we have in front of us does not start with
one of the four NetBIOS over TCP/IP message types, or if it is a data
message, then looks for \0377SMB in the first four bytes ...
It seems to work well on one large trace of Samba activity that I have.
`
svn path=/trunk/; revision=536
bunch of source files.
Replace the "payload" field of a "packet_info" structure with "len" and
"captured_len" fields, which contain the total packet length and total
captured packet length (including all headers) at the current protocol
layer (i.e., if a given layer has a length field, and that length field
says its shorter than the length we got from the capture, reduce the
"pi.len" and "pi.captured_len" values appropriately). Those fields can
be used in the future if we add checks to make sure a field we're
extracting from a packet doesn't go past the end of the packet, or past
the captured part of the packet.
Get rid of the additional payload argument to some dissection functions;
use "pi.captured_len - offset" instead.
Have the END_OF_FRAME macro use "pi.captured_len" rather than
"fd->cap_len", so that "dissect the rest of the frame" becomes "dissect
the rest of the packet", and doesn't dissect end-of-frame padding such
as padding added to make an Ethernet frame 60 or more octets long. (We
might want to rename it END_OF_PACKET; if we ever want to label the
end-of-frame padding for the benefit of people curious what that extra
gunk is, we could have a separate END_OF_FRAME macro that uses
"fd->cap_len".)
svn path=/trunk/; revision=506
mechanism that is built into ethereal. Wiretap is now used to read all
file formats. Libpcap is used only for capturing.
svn path=/trunk/; revision=342
"get_nbns_name()", make sure the array into which you put the name is
"big enough" - MAXDNAME+4 is more than big enough for those error
messages.
svn path=/trunk/; revision=299
request or reply. (Redid "get_dns_name()" along the lines of the code
in the BSD resolver.)
Add code to dissect SOA RRs.
svn path=/trunk/; revision=297
line, so that they show up as SMB packets, rather than NBDS packets, in
the summary display.
Put SMB at the top level of the decode tree for NBDS packets, as is done
for NBSS packets.
svn path=/trunk/; revision=270
GCC) isn't sophisticated enough to figure out that "nbss_tree" isn't
used if "tree" is null (or doesn't trust it not to change out from under
it), so we have to initialize "nbss_tree" to NULL to squelch complaints
about it being used but uninitialized.
svn path=/trunk/; revision=264
reference the protocol tree with struct proto_tree and struct proto_item
objects. That way, the packet decoding source code file can be used with
non-gtk packet decoders, like a curses-based ethereal, e.g. I also re-arranged
some of the information in packet.h to more appropriate places (like other
packet-*.[ch] files).
svn path=/trunk/; revision=223
and NBNS requests.
Put the opcode in the COL_INFO field for DNS requests (it was already
there for NBNS requests).
Don't assume a DNS or NBNS request is neatly aligned on a 2-byte
boundary (it might not be if, for example, the packet is an FDDI
packet).
svn path=/trunk/; revision=153
for the queries or replies first, then create and add the subtree and
populate it, and, when that's done, set the length of the item
appropriately; if you add the subtree later, the subtree's top-level
node appears to have level 0, rather than 1 greater than the tree of
which it's a subtree, which causes those trees not to print correctly.
svn path=/trunk/; revision=122
in "get_nbns_name()", and have "get_nbns_name_type_class()" call it.
Use "get_nbns_name()" rather than "get_nbns_name_type_class()" in the
NBDS code, as there aren't any type or class fields in an NBDS packet.
Show the data in an NBDS datagram as raw data. (We don't have an SMB
parser yet.)
Don't dissect anything past the header if an NBDS packet is an unknown
packet type.
svn path=/trunk/; revision=117
because it is still in its infancy, but it can be compiled in optionally.
The library exists in its own subdirectory ethereal/wiretap. This patch also
edits all the packet-*.c files to remove the #include <pcap.h> line which is
unnecessary in these files. In the ethereal code, file.c is the most heavily
modified with #ifdef WITH_WIRETAP lines for the optional library.
svn path=/trunk/; revision=82
Give a detailed display of the innards of NBNS-over-UDP packets. Export
some stuff from the DNS decoder for the use of the NBNS decoder (NBNS is
DNS-like).
Give a more detailed display of the innards of DNS packets as well.
Fix a couple of minor NBNS bugs.
svn path=/trunk/; revision=55
that these are two very different implementations of NetBIOS name services and
at the protocol level are not similar. I have put the UDP protocol in
packet-nbns.c, since it will be a very big module. I have all of rfc 1002 to
read and implement. I am planning on putting many different NetBIOS over IPX
functions in packet-nbipx.c, however, since there is no RFC or published
standard. I have to hack the protocol, and as such, I do not expect it to be
as full-featured as the IP-world equivalents.
svn path=/trunk/; revision=50
Guy Harris