Wireshark · Ethereal-dev: Re: [Ethereal-dev] RE: [Ethereal-users] ethereal v0.8.14.1 and 0.8.14 on NT4SP5 grabs a packet it GP

[Guy Harris <gharris@xxxxxxxxxxxx>]

On Sun, Dec 17, 2000 at 12:23:29AM +1000, Richard Sharpe wrote:
> Well, I have confirmed that the packet crashes Ethereal under Win95, and is
> read OK under Linux.

...but gives a rather, umm, *interesting* value for the Last Write Date
and Last Write Time - a pre-war date, and by "pre-war" I mean prior to
the Great War, i.e. 1905-05-26.

It turns out that the MSVC++ version of "gmtime()" returns NULL if
handed a date/time that predates the Epoch, and 1905-05-26 is about 64
1/2 years before the Epoch.

I shall have to check some notes at work, but I suspect that the date
and time in this reply is *not* in the weird almost-UNIX-like date and
time format used by some SMB requests and replies, but may, instead, be
in DOS date/time format.

If I apply the attached patch to "packet-smb.c", which changes the code
to assume a DOS date/time format in an SMB Get Attributes reply (and
also fixes the code that displays the date and time to use the correct
offsets when putting entries into the protocol tree), the last modified
date and time becomes 1996-08-00 16:51:56, which, although it's over
four years ago, is more likely to be correct than is a date near the
turn of the century.

I shall compare its dissection with what Microsoft's Network Monitor
claims to be the date and time.