17392c995b
I have captures with w2k speaking DCERPC without using the normal Transaction named pipes SMBs. Instead DCERPC is just implemented ontop of ordinary read/write calls. The smb dissector now examines TreeConnectAndX and stores the conversation/tid/type-of-share in a table for later access. All SMB requests examine that hash table to find out if TID in the header refers to a normal share or an IPC$ share. Initial support in read/write SMB calls to detect if the operations are for an IPC share and thus it assumes it must be DCERPC commands in the payload. Desegmentation/Reassembly of these types of calls are not implemented yet. svn path=/trunk/; revision=4952
38 lines
1.4 KiB
C
38 lines
1.4 KiB
C
/* packet-smb-pipe.h
|
|
* Declarations of routines for SMB named pipe packet dissection
|
|
* Copyright 1999, Richard Sharpe <rsharpe@ns.aus.com>
|
|
*
|
|
* $Id: packet-smb-pipe.h,v 1.10 2002/03/16 04:39:28 sahlberg Exp $
|
|
*
|
|
* Ethereal - Network traffic analyzer
|
|
* By Gerald Combs <gerald@ethereal.com>
|
|
* Copyright 1998 Gerald Combs
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU General Public License
|
|
* as published by the Free Software Foundation; either version 2
|
|
* of the License, or (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
|
*/
|
|
|
|
#ifndef _PACKET_SMB_PIPE_H_
|
|
#define _PACKET_SMB_PIPE_H_
|
|
|
|
extern gboolean
|
|
dissect_pipe_smb(tvbuff_t *sp_tvb, tvbuff_t *s_tvb, tvbuff_t *pd_tvb,
|
|
tvbuff_t *p_tvb, tvbuff_t *d_tvb, const char *pipe,
|
|
packet_info *pinfo, proto_tree *tree);
|
|
gboolean
|
|
dissect_pipe_dcerpc(tvbuff_t *d_tvb, packet_info *pinfo, proto_tree *parent_tree,
|
|
proto_tree *tree, guint32 fid);
|
|
|
|
#endif
|