Wireshark · Ethereal-dev: [Ethereal-dev] Re: [Ethrereal-dev] packet-smb.c

Ethereal-dev: [Ethereal-dev] Re: [Ethrereal-dev] packet-smb.c

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Pia Sahlberg" <piabar@xxxxxxxxxxx>

Date: Fri, 10 Aug 2001 12:28:27 +0000

Hi list

Guy wrote:

>> @@ -11163,8 +10907,8 @@
>> {
>> static hf_register_info hf[] = {
>> { &hf_smb_cmd,
>> -     { "SMB Command", "smb.cmd",
>> -       FT_UINT8, BASE_HEX, VALS(smb_cmd_vals), 0x0, "", HFILL }}
>> +     { "SMB Command", "smb.cmd", FT_UINT8, BASE_HEX,
>> +     NULL, 0x0, "SMB Command", HFILL }}
>
>And the reason for removing the ability to compare SMB commands by name
>in a filter _expression_ is?

The reason was basically performance. Value_string searches are O(n) so instead of using it as a value_string with VALS(), it uses proto_tree_add_*_format() to print the value for that field. This makes the mapping cmd->string O(1).

I didnt think of the case where one uses the name in the display-filter.

Sorry, change it to use VALS().

Attached is another patch. This patch requires the previous smb patch.
(My tree starts to diverge from CVS now, time to try to download a nightly snapshot again)
This patch allows tvbuffification one-by-one of the command-dissectors in smb.c
As an example SMBnegprot has been tvbuffified in this patch.
(A lot of the other commands are much easier/quicker to implement).
I think it could be worth it to tvbuffify these dissectors manually, there are not really that many of them.

best regards
ronnie sahlberg

Get your FREE download of MSN Explorer at http://explorer.msn.com
diff -u -r -x *.[^ch]|nmake|am ethereal-orig/packet-smb-common.cethereal/packet-smb-common.c

--- ethereal-orig/packet-smb-common.c	Tue Aug  7 08:45:14 2001
+++ ethereal/packet-smb-common.c	Fri Aug 10 16:59:10 2001
@@ -26,6 +26,18 @@
 */

#include "packet-smb-common.h"
+#include "smb.h"
+

+int dissect_ascii_or_unicode_string(tvbuff_t *tvb, packet_info *pinfo,proto_tree *tree, int offset, int hf_index)

+{
+	struct smb_info *si = pinfo->private;
+
+	if(si->unicode){
+		return display_unicode_string(tvb, pinfo, tree, offset, hf_index);
+	}
+
+	return display_ms_string(tvb, pinfo, tree, offset, hf_index);
+}

int display_ms_string(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,int offset, int hf_index)

diff -u -r -x *.[^ch]|nmake|am ethereal-orig/packet-smb-common.hethereal/packet-smb-common.h

--- ethereal-orig/packet-smb-common.h	Tue Aug  7 08:45:14 2001
+++ ethereal/packet-smb-common.h	Fri Aug 10 14:08:36 2001
@@ -53,6 +53,8 @@

int dissect_smb_unknown(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,int offset);

+int dissect_ascii_or_unicode_string(tvbuff_t *tvb, packet_info *pinfo,proto_tree *tree, int offset, int hf_index);

+
int display_unicode_string(tvbuff_t *tvb, packet_info *pinfo,
		proto_tree *tree, int offset, int hf_index);

diff -u -r -x *.[^ch]|nmake|am ethereal-orig/packet-smb.cethereal/packet-smb.c

--- ethereal-orig/packet-smb.c	Fri Aug 10 08:34:54 2001
+++ ethereal/packet-smb.c	Fri Aug 10 17:02:16 2001
@@ -51,15 +51,67 @@

#include "packet-smb-mailslot.h"
#include "packet-smb-pipe.h"
+#include "packet-smb-common.h"

static int proto_smb = -1;
static int hf_smb_cmd = -1;
+static int hf_word_count = -1;
+static int hf_byte_count = -1;
+static int hf_dialect_buffer_format = -1;
+static int hf_dialect_name = -1;
+static int hf_dialect_index = -1;
+static int hf_sm_mode = -1;
+static int hf_sm_password = -1;
+static int hf_sm_signatures = -1;
+static int hf_sm_sig_required = -1;
+static int hf_max_trans_buf_size = -1;
+static int hf_max_raw_buf_size = -1;
+static int hf_max_mpx_count = -1;
+static int hf_max_vcs_num = -1;
+static int hf_rm_read = -1;
+static int hf_rm_write = -1;
+static int hf_session_key = -1;
+static int hf_current_server_date = -1;
+static int hf_current_server_dos_date = -1;
+static int hf_current_server_dos_time = -1;
+static int hf_server_timezone = -1;
+static int hf_encryption_key_length = -1;
+static int hf_reserved = -1;
+static int hf_encryption_key = -1;
+static int hf_primary_domain = -1;
+static int hf_oem_domain = -1;
+static int hf_server_cap_raw_mode = -1;
+static int hf_server_cap_mpx_mode = -1;
+static int hf_server_cap_unicode = -1;
+static int hf_server_cap_large_files = -1;
+static int hf_server_cap_nt_smbs = -1;
+static int hf_server_cap_rpc_remote_apis = -1;
+static int hf_server_cap_status32 = -1;
+static int hf_server_cap_level_ii_oplocks = -1;
+static int hf_server_cap_lock_and_read = -1;
+static int hf_server_cap_nt_find = -1;
+static int hf_server_cap_dfs = -1;
+static int hf_server_cap_infolevel_passthru = -1;
+static int hf_server_cap_large_readx = -1;
+static int hf_server_cap_large_writex = -1;
+static int hf_server_cap_unix = -1;
+static int hf_server_cap_reserved = -1;
+static int hf_server_cap_bulk_transfer = -1;
+static int hf_server_cap_compressed_data = -1;
+static int hf_server_cap_extended_security = -1;
+static int hf_system_time_low = -1;
+static int hf_system_time_high = -1;
+static int hf_server_guid = -1;
+static int hf_security_blob = -1;
+
+/*xxxxx*/

static gint ett_smb = -1;
static gint ett_smb_fileattributes = -1;
static gint ett_smb_capabilities = -1;
static gint ett_smb_aflags = -1;
static gint ett_smb_dialects = -1;
+static gint ett_smb_dialect = -1;
static gint ett_smb_mode = -1;
static gint ett_smb_rawmode = -1;
static gint ett_smb_flags = -1;
@@ -73,6 +125,838 @@
static gint ett_smb_writemode = -1;
static gint ett_smb_lock_type = -1;
static gint ett_smb_header = -1;
+static gint ett_smb_command = -1;
+static gint ett_smb_time_date = -1;
+
+
+#define SERVER_CAP_RAW_MODE		0x00000001
+#define SERVER_CAP_MPX_MODE		0x00000002
+#define SERVER_CAP_UNICODE		0x00000004
+#define SERVER_CAP_LARGE_FILES		0x00000008
+#define SERVER_CAP_NT_SMBS		0x00000010
+#define SERVER_CAP_RPC_REMOTE_APIS	0x00000020
+#define SERVER_CAP_STATUS32		0x00000040
+#define SERVER_CAP_LEVEL_II_OPLOCKS	0x00000080
+#define SERVER_CAP_LOCK_AND_READ	0x00000100
+#define SERVER_CAP_NT_FIND		0x00000200
+#define SERVER_CAP_DFS			0x00001000
+#define SERVER_CAP_INFOLEVEL_PASSTHRU	0x00002000
+#define SERVER_CAP_LARGE_READX		0x00004000
+#define SERVER_CAP_LARGE_WRITEX		0x00008000
+#define SERVER_CAP_UNIX			0x00800000
+#define SERVER_CAP_RESERVED		0x02000000
+#define SERVER_CAP_BULK_TRANSFER	0x20000000
+#define SERVER_CAP_COMPRESSED_DATA	0x40000000
+#define SERVER_CAP_EXTENDED_SECURITY	0x80000000
+static const true_false_string tfs_server_cap_raw_mode = {
+	"RAW MODE capability is available",
+	"Raw mode capability is NOT available"
+};
+static const true_false_string tfs_server_cap_mpx_mode = {
+	"MPX MODE capability is available",
+	"Mpx mode capability is NOT available"
+};
+static const true_false_string tfs_server_cap_unicode = {
+	"UNICODE capability is available",
+	"Unicode capability is NOT available"
+};
+static const true_false_string tfs_server_cap_large_files = {
+	"LARGE FILES capability is available",
+	"Large files capability is NOT available"
+};
+static const true_false_string tfs_server_cap_nt_smbs = {
+	"NT SMBS capability is available",
+	"Nt smbs capability is NOT available"
+};
+static const true_false_string tfs_server_cap_rpc_remote_apis = {
+	"RPC REMOTE APIS capability is available",
+	"Rpc remote apis capability is NOT available"
+};
+static const true_false_string tfs_server_cap_status32 = {
+	"STATUS32 capability is available",
+	"Status32 capability is NOT available"
+};
+static const true_false_string tfs_server_cap_level_ii_oplocks = {
+	"LEVEL II OPLOCKS capability is available",
+	"Level ii oplocks capability is NOT available"
+};
+static const true_false_string tfs_server_cap_lock_and_read = {
+	"LOCK AND READ capability is available",
+	"Lock and read capability is NOT available"
+};
+static const true_false_string tfs_server_cap_nt_find = {
+	"NT FIND capability is available",
+	"Nt find capability is NOT available"
+};
+static const true_false_string tfs_server_cap_dfs = {
+	"DFS capability is available",
+	"Dfs capability is NOT available"
+};
+static const true_false_string tfs_server_cap_infolevel_passthru = {
+	"INFOLEVEL PASSTHRU capability is available",
+	"Infolevel passthru capability is NOT available"
+};
+static const true_false_string tfs_server_cap_large_readx = {
+	"LARGE READX capability is available",
+	"Large readx capability is NOT available"
+};
+static const true_false_string tfs_server_cap_large_writex = {
+	"LARGE WRITEX capability is available",
+	"Large writex capability is NOT available"
+};
+static const true_false_string tfs_server_cap_unix = {
+	"UNIX capability is available",
+	"Unix capability is NOT available"
+};
+static const true_false_string tfs_server_cap_reserved = {
+	"Reserved",
+	"Reserved"
+};
+static const true_false_string tfs_server_cap_bulk_transfer = {
+	"BULK TRANSFER capability is available",
+	"Bulk transfer capability is NOT available"
+};
+static const true_false_string tfs_server_cap_compressed_data = {
+	"COMPRESSED DATA capability is available",
+	"Compressed data capability is NOT available"
+};
+static const true_false_string tfs_server_cap_extended_security = {
+	"EXTENDED SECURITY capability is available",
+	"Extended security capability is NOT available"
+};
+
+
+#define RAWMODE_READ	0x01
+#define RAWMODE_WRITE	0x02
+static const true_false_string tfs_rm_read = {
+	"READ raw supported",
+	"Read raw NOT supported"
+};
+static const true_false_string tfs_rm_write = {
+	"WRITE raw supported",
+	"Write raw NOT supported"
+};
+
+#define SECURITY_MODE_MODE		0x01
+#define SECURITY_MODE_PASSWORD		0x02
+#define SECURITY_MODE_SIGNATURES	0x04
+#define SECURITY_MODE_SIG_REQUIRED	0x08
+static const true_false_string tfs_sm_mode = {
+	"USER security mode",
+	"SHARE security mode"
+};
+static const true_false_string tfs_sm_password = {
+	"ENCRYPTED password. Use challenge response",
+	"PLAINTEXT password"
+};
+static const true_false_string tfs_sm_signatures = {
+	"Security signatures ENABLED",
+	"Security signatures NOT enabled"
+};
+static const true_false_string tfs_sm_sig_required = {
+	"Security signatures REQUIRED",
+	"Security signatures NOT required"
+};
+
+/*xxxxx*/
+static int

+dissect_negprot_capabilities(tvbuff_t *tvb, packet_info *pinfo, proto_tree*parent_tree, int offset)

+{
+	guint32 mask;
+	proto_item *item = NULL;
+	proto_tree *tree = NULL;
+
+	mask = tvb_get_letohl(tvb, offset);
+
+	if(parent_tree){

+ item = proto_tree_add_text(parent_tree, tvb, offset, 4, "Capabilities:0x%04x ", mask);

+		tree = proto_item_add_subtree(item, ett_smb_capabilities);
+	}
+
+	proto_tree_add_boolean(tree, hf_server_cap_raw_mode,
+			tvb, offset, 4, mask);
+	proto_tree_add_boolean(tree, hf_server_cap_mpx_mode,
+			tvb, offset, 4, mask);
+	proto_tree_add_boolean(tree, hf_server_cap_unicode,
+			tvb, offset, 4, mask);
+	proto_tree_add_boolean(tree, hf_server_cap_large_files,
+			tvb, offset, 4, mask);
+	proto_tree_add_boolean(tree, hf_server_cap_nt_smbs,
+			tvb, offset, 4, mask);
+	proto_tree_add_boolean(tree, hf_server_cap_rpc_remote_apis,
+			tvb, offset, 4, mask);
+	proto_tree_add_boolean(tree, hf_server_cap_status32,
+			tvb, offset, 4, mask);
+	proto_tree_add_boolean(tree, hf_server_cap_level_ii_oplocks,
+			tvb, offset, 4, mask);
+	proto_tree_add_boolean(tree, hf_server_cap_lock_and_read,
+			tvb, offset, 4, mask);
+	proto_tree_add_boolean(tree, hf_server_cap_nt_find,
+			tvb, offset, 4, mask);
+	proto_tree_add_boolean(tree, hf_server_cap_dfs,
+			tvb, offset, 4, mask);
+	proto_tree_add_boolean(tree, hf_server_cap_infolevel_passthru,
+			tvb, offset, 4, mask);
+	proto_tree_add_boolean(tree, hf_server_cap_large_readx,
+			tvb, offset, 4, mask);
+	proto_tree_add_boolean(tree, hf_server_cap_large_writex,
+			tvb, offset, 4, mask);
+	proto_tree_add_boolean(tree, hf_server_cap_unix,
+			tvb, offset, 4, mask);
+	proto_tree_add_boolean(tree, hf_server_cap_reserved,
+			tvb, offset, 4, mask);
+	proto_tree_add_boolean(tree, hf_server_cap_bulk_transfer,
+			tvb, offset, 4, mask);
+	proto_tree_add_boolean(tree, hf_server_cap_compressed_data,
+			tvb, offset, 4, mask);
+	proto_tree_add_boolean(tree, hf_server_cap_extended_security,
+		tvb, offset, 4, mask);
+
+	return mask;
+}
+
+static int

+dissect_time_date(tvbuff_t *tvb, packet_info *pinfo, proto_tree*parent_tree, int offset, char *str, int hf_date, int hf_dos_date, inthf_dos_time)

+{
+	guint16 dos_time, dos_date;
+	proto_item *item = NULL;
+	proto_tree *tree = NULL;
+	struct tm tm;
+	time_t t;
+	struct timeval tv;
+	char ts[256];
+
+	dos_time = tvb_get_letohs(tvb, offset);
+	dos_date = tvb_get_letohs(tvb, offset+2);
+
+	tm.tm_sec = (dos_time&0x1f)*2;
+	tm.tm_min = (dos_time>>5)&0x3f;
+	tm.tm_hour = (dos_time>>11)&0x1f;
+	tm.tm_mday = dos_date&0x1f;
+	tm.tm_mon = (dos_date>>5)&0x0f;
+	tm.tm_year = ((dos_date>>9)&0x7f)+1980;
+
+	t = mktime(&tm);
+
+	tv.tv_sec = t;
+	tv.tv_usec = 0;
+
+	if(parent_tree){
+		strftime(ts, 256, "%d %d, %Y %H:%M:%S", &tm);

+ item = proto_tree_add_text(parent_tree, tvb, offset, 4, "%s : %s", str,ts);

+		tree = proto_item_add_subtree(item, ett_smb_time_date);
+	}
+
+	proto_tree_add_time(tree, hf_date, tvb, offset, 4, &tv);
+

+ proto_tree_add_uint_format(tree, hf_dos_time, tvb, offset, 2, dos_time,"Dos Time: %02d:%02d:%02d (0x%04x)", tm.tm_hour, tm.tm_min, tm.tm_sec,dos_time);

+ proto_tree_add_uint_format(tree, hf_dos_date, tvb, offset+2, 2, dos_date,"Dos Date: %04d-%02d-%02d (0x%04x)", tm.tm_year, tm.tm_mon, tm.tm_mday,dos_date);

+
+	offset += 4;
+
+	return offset;
+}
+
+static int

+dissect_negprot_rawmode(tvbuff_t *tvb, packet_info *pinfo, proto_tree*parent_tree, int offset)

+{
+	guint16 mask;
+	proto_item *item = NULL;
+	proto_tree *tree = NULL;
+
+	mask = tvb_get_letohs(tvb, offset);
+
+	if(parent_tree){

+ item = proto_tree_add_text(parent_tree, tvb, offset, 2, "Rawmode: 0x%04x", mask);

+		tree = proto_item_add_subtree(item, ett_smb_rawmode);
+	}
+
+	proto_tree_add_boolean(tree, hf_rm_read, tvb, offset, 2, mask);
+	proto_tree_add_boolean(tree, hf_rm_write, tvb, offset, 2, mask);
+
+	offset += 2;
+
+	return offset;
+}
+
+static int

+dissect_negprot_security_mode(tvbuff_t *tvb, packet_info *pinfo, proto_tree*parent_tree, int offset, int type)

+{
+	guint16 mask = 0;
+	proto_item *item = NULL;
+	proto_tree *tree = NULL;
+
+
+	if(parent_tree){
+		switch(type){
+		case 0:
+			mask = tvb_get_letohs(tvb, offset);

+ item = proto_tree_add_text(parent_tree, tvb, offset, 2, "Security Mode:0x%04x ", mask);

+			break;
+		case 1:
+			mask = tvb_get_guint8(tvb, offset);

+ item = proto_tree_add_text(parent_tree, tvb, offset, 1, "Security Mode:0x%02x ", mask);

+			break;
+		}
+		tree = proto_item_add_subtree(item, ett_smb_mode);
+	}
+
+	proto_tree_add_boolean(tree, hf_sm_mode, tvb, offset, 2, mask);
+	proto_tree_add_boolean(tree, hf_sm_password, tvb, offset, 2, mask);
+	if(type==0){
+		offset += 2;
+		return offset;
+	}
+	proto_tree_add_boolean(tree, hf_sm_signatures, tvb, offset, 2, mask);
+	proto_tree_add_boolean(tree, hf_sm_sig_required, tvb, offset, 2, mask);
+	if(type==1){
+		offset +=1;
+		return offset;
+	}
+
+	offset += 2;
+	return offset;
+}
+
+
+static int

+dissect_smb_negprot_request(tvbuff_t *tvb, packet_info *pinfo, proto_tree*tree)

+{
+	proto_item *it = NULL;
+	proto_tree *tr = NULL;
+
+	int offset = 0;
+	int bc;
+
+	/* word count */

+ proto_tree_add_uint(tree, hf_word_count, tvb, offset, 1,tvb_get_guint8(tvb, offset));

+	offset += 1;
+
+	/* byte count */
+	bc = tvb_get_letohs(tvb, offset);
+	proto_tree_add_uint(tree, hf_byte_count, tvb, offset, 2, bc);
+	offset += 2;
+
+	if(tree){
+		it = proto_tree_add_text(tree, tvb, offset, bc, "Requested Dialects");
+		tr = proto_item_add_subtree(it, ett_smb_dialects);
+	}
+
+	while(bc){
+		int len;
+		int old_offset = offset;
+		const guint8 *str;
+		proto_item *dit = NULL;
+		proto_tree *dtr = NULL;
+
+		len = tvb_strsize(tvb, offset+1);
+		str = tvb_get_ptr(tvb, offset+1, len);
+
+		if(tr){
+			dit = proto_tree_add_text(tr, tvb, offset, len+1, "Dialect: %s", str);
+			dtr = proto_item_add_subtree(dit, ett_smb_dialect);
+		}
+
+		/* buffer format */

+ proto_tree_add_uint(dtr, hf_dialect_buffer_format, tvb, offset, 1,tvb_get_guint8(tvb, offset));

+		offset += 1;
+		bc -= 1;
+
+		/*dialect name */
+		proto_tree_add_string(dtr, hf_dialect_name, tvb, offset, len, str);
+		offset += len;
+		bc -= len;
+	}
+
+	return offset;
+}
+
+static int

+dissect_smb_negprot_response(tvbuff_t *tvb, packet_info *pinfo, proto_tree*tree)

+{
+	int wc;
+	int offset = 0;
+
+	/* word count */
+	wc = tvb_get_guint8(tvb, offset);
+	proto_tree_add_uint(tree, hf_word_count, tvb, offset, 1, wc);
+	offset += 1;
+
+	/* the server didnt understand any dialect so it must be
+	 * "PC NETWORK PROGRAM 1.0"
+	 */
+	if(wc==1){
+		guint16 dialect;
+
+		/* dialect index */
+		dialect = tvb_get_letohs(tvb, offset);
+		if(dialect==0xffff){
+			proto_tree_add_uint_format(tree, hf_dialect_index,
+				tvb, offset, 2, dialect,
+				"Selected Index: -1, PC NETWORK PROGRAM 1.0 choosen");
+		} else {
+			proto_tree_add_uint(tree, hf_dialect_index,
+				tvb, offset, 2, dialect);
+		}
+		offset += 2;
+
+		/* byte count */

+ proto_tree_add_uint(tree, hf_byte_count, tvb, offset, 2,tvb_get_letohs(tvb, offset));

+		offset += 2;
+	}
+
+
+	if(wc==13){
+		guint16 ekl;
+		guint16 dialect;
+		gint16 tz;
+
+		/* dialect index */
+		dialect = tvb_get_letohs(tvb, offset);
+      		proto_tree_add_uint_format(tree, hf_dialect_index,

+ tvb, offset, 2, dialect, "Dialect Index: %u, Greater than CORE PROTOCOLand up to LANMAN2.1", dialect);

+		offset += 2;
+
+		/* security mode */
+		offset = dissect_negprot_security_mode(tvb, pinfo, tree, offset, 0);
+
+		/* maximum transmit buffer size */
+		proto_tree_add_uint(tree, hf_max_trans_buf_size,
+			tvb, offset, 2, tvb_get_letohs(tvb, offset));
+		offset += 2;
+
+		/* maximum multiplex count */
+		proto_tree_add_uint(tree, hf_max_mpx_count,
+			tvb, offset, 2, tvb_get_letohs(tvb, offset));
+		offset += 2;
+
+		/* maximum vcs number */
+		proto_tree_add_uint(tree, hf_max_vcs_num,
+			tvb, offset, 2, tvb_get_letohs(tvb, offset));
+		offset += 2;
+
+		/* raw mode */
+		offset = dissect_negprot_rawmode(tvb, pinfo, tree, offset);
+
+		/* session key */
+		proto_tree_add_uint(tree, hf_session_key,
+			tvb, offset, 4, tvb_get_letohl(tvb, offset));
+		offset += 4;
+
+		/* current time and date at server */

+ offset = dissect_time_date(tvb, pinfo, tree, offset, "Current Time andDate at server", hf_current_server_date, hf_current_server_dos_date,hf_current_server_dos_time);

+
+		/* time zone */
+		tz = tvb_get_letohs(tvb, offset);

+ proto_tree_add_int_format(tree, hf_server_timezone, tvb, offset, 2, tz,"Server Time Zone: %d min from UTC", tz);

+		offset += 2;
+
+		/* encryption key length */
+		ekl = tvb_get_letohs(tvb, offset);
+		proto_tree_add_uint(tree, hf_encryption_key_length, tvb, offset, 2, ekl);
+		offset += 2;
+
+		/* 2 reserved bytes */

+ proto_tree_add_bytes(tree, hf_reserved, tvb, offset, 2, tvb_get_ptr(tvb,offset, 2));

+		offset += 2;
+
+
+		/* byte count */

+ proto_tree_add_uint(tree, hf_byte_count, tvb, offset, 2,tvb_get_letohs(tvb, offset));

+		offset += 2;
+
+		/* challange/ encryption key */
+		if(ekl){

+ proto_tree_add_bytes(tree, hf_encryption_key, tvb, offset, ekl,tvb_get_ptr(tvb, offset, ekl));

+			offset += ekl;
+		}
+
+		/* is this string optional ? */
+		/* primary domain */

+ offset = dissect_ascii_or_unicode_string(tvb, pinfo, tree, offset,hf_primary_domain);

+	}
+
+	if(wc==17){
+		guint16 ekl, dialect;
+		guint32 caps;
+		gint16 tz;
+
+		/* dialect index */
+		dialect = tvb_get_letohs(tvb, offset);
+      		proto_tree_add_uint_format(tree, hf_dialect_index,

+ tvb, offset, 2, dialect, "Dialect Index: %u, greater than LANMAN2.1",dialect);

+		offset += 2;
+
+		/* security mode */
+		offset = dissect_negprot_security_mode(tvb, pinfo, tree, offset, 1);
+
+		/* maximum multiplex count */
+		proto_tree_add_uint(tree, hf_max_mpx_count,
+			tvb, offset, 2, tvb_get_letohs(tvb, offset));
+		offset += 2;
+
+		/* maximum vcs number */
+		proto_tree_add_uint(tree, hf_max_vcs_num,
+			tvb, offset, 2, tvb_get_letohs(tvb, offset));
+		offset += 2;
+
+		/* maximum transmit buffer size */
+		proto_tree_add_uint(tree, hf_max_trans_buf_size,
+			tvb, offset, 4, tvb_get_letohl(tvb, offset));
+		offset += 4;
+
+		/* maximum raw buffer size */
+		proto_tree_add_uint(tree, hf_max_raw_buf_size,
+			tvb, offset, 4, tvb_get_letohl(tvb, offset));
+		offset += 4;
+
+		/* session key */
+		proto_tree_add_uint(tree, hf_session_key,
+			tvb, offset, 4, tvb_get_letohl(tvb, offset));
+		offset += 4;
+
+		/* server capabilities */
+		caps = dissect_negprot_capabilities(tvb, pinfo, tree, offset);
+		offset += 4;
+
+		/*XXX FIXME: how should these times be decoded?*/
+		/* system time low */
+		proto_tree_add_uint(tree, hf_system_time_low,
+			tvb, offset, 4, tvb_get_letohl(tvb, offset));
+		offset += 4;
+
+		/* system time high */
+		proto_tree_add_uint(tree, hf_system_time_high,
+			tvb, offset, 4, tvb_get_letohl(tvb, offset));
+		offset += 4;
+
+		/* time zone */
+		tz = tvb_get_letohs(tvb, offset);

+ proto_tree_add_int_format(tree, hf_server_timezone, tvb, offset, 2, tz,"Server Time Zone: %d min from UTC", tz);

+		offset += 2;
+
+		/* encryption key length */
+		ekl = tvb_get_guint8(tvb, offset);
+		proto_tree_add_uint(tree, hf_encryption_key_length, tvb, offset, 1, ekl);
+		offset += 1;
+
+
+		/* byte count */

+ proto_tree_add_uint(tree, hf_byte_count, tvb, offset, 2,tvb_get_letohs(tvb, offset));

+		offset += 2;
+
+		if(!(caps&SERVER_CAP_EXTENDED_SECURITY)){
+			struct smb_info *si;
+
+			/* challange/ encryption key */
+			if(ekl){

+ proto_tree_add_bytes(tree, hf_encryption_key, tvb, offset, ekl,tvb_get_ptr(tvb, offset, ekl));

+				offset += ekl;
+			}
+
+			if(tvb_length_remaining(tvb, offset)){
+				/* oem domain */
+				/* this string is special, unicode is flagged in caps */
+				si = pinfo->private;
+				si->unicode = (caps&SERVER_CAP_UNICODE);

+ offset = dissect_ascii_or_unicode_string(tvb, pinfo, tree, offset,hf_oem_domain);

+			}
+		} else {
+			int len;
+
+			/* guid */

+ proto_tree_add_bytes(tree, hf_server_guid, tvb, offset, 16,tvb_get_ptr(tvb, offset, 16));

+			offset += 16;
+
+			/* security blob */
+			len = tvb_length_remaining(tvb, offset);
+			if(len){

+ proto_tree_add_bytes(tree, hf_security_blob, tvb, offset, len,tvb_get_ptr(tvb, offset, len));

+				offset += len;
+			}
+		}
+
+	}
+
+	return offset;
+}
+
+
+/*xxxxx*/
+
+
+typedef struct _smb_function {
+	int (*request)(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree);
+	int (*response)(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree);
+} smb_function;
+
+smb_function smb_dissector[256] = {
+/* 0x00 */  {NULL, NULL},
+/* 0x01 */  {NULL, NULL},
+/* 0x02 */  {NULL, NULL},
+/* 0x03 */  {NULL, NULL},
+/* 0x04 */  {NULL, NULL},
+/* 0x05 */  {NULL, NULL},
+/* 0x06 */  {NULL, NULL},
+/* 0x07 */  {NULL, NULL},
+/* 0x08 */  {NULL, NULL},
+/* 0x09 */  {NULL, NULL},
+/* 0x0a */  {NULL, NULL},
+/* 0x0b */  {NULL, NULL},
+/* 0x0c */  {NULL, NULL},
+/* 0x0d */  {NULL, NULL},
+/* 0x0e */  {NULL, NULL},
+/* 0x0f */  {NULL, NULL},
+/* 0x10 */  {NULL, NULL},
+/* 0x11 */  {NULL, NULL},
+/* 0x12 */  {NULL, NULL},
+/* 0x13 */  {NULL, NULL},
+/* 0x14 */  {NULL, NULL},
+/* 0x15 */  {NULL, NULL},
+/* 0x16 */  {NULL, NULL},
+/* 0x17 */  {NULL, NULL},
+/* 0x18 */  {NULL, NULL},
+/* 0x19 */  {NULL, NULL},
+/* 0x1a */  {NULL, NULL},
+/* 0x1b */  {NULL, NULL},
+/* 0x1c */  {NULL, NULL},
+/* 0x1d */  {NULL, NULL},
+/* 0x1e */  {NULL, NULL},
+/* 0x1f */  {NULL, NULL},
+/* 0x20 */  {NULL, NULL},
+/* 0x21 */  {NULL, NULL},
+/* 0x22 */  {NULL, NULL},
+/* 0x23 */  {NULL, NULL},
+/* 0x24 */  {NULL, NULL},
+/* 0x25 */  {NULL, NULL},
+/* 0x26 */  {NULL, NULL},
+/* 0x27 */  {NULL, NULL},
+/* 0x28 */  {NULL, NULL},
+/* 0x29 */  {NULL, NULL},
+/* 0x2a */  {NULL, NULL},
+/* 0x2b */  {NULL, NULL},
+/* 0x2c */  {NULL, NULL},
+/* 0x2d */  {NULL, NULL},
+/* 0x2e */  {NULL, NULL},
+/* 0x2f */  {NULL, NULL},
+/* 0x30 */  {NULL, NULL},
+/* 0x31 */  {NULL, NULL},
+/* 0x32 */  {NULL, NULL},
+/* 0x33 */  {NULL, NULL},
+/* 0x34 */  {NULL, NULL},
+/* 0x35 */  {NULL, NULL},
+/* 0x36 */  {NULL, NULL},
+/* 0x37 */  {NULL, NULL},
+/* 0x38 */  {NULL, NULL},
+/* 0x39 */  {NULL, NULL},
+/* 0x3a */  {NULL, NULL},
+/* 0x3b */  {NULL, NULL},
+/* 0x3c */  {NULL, NULL},
+/* 0x3d */  {NULL, NULL},
+/* 0x3e */  {NULL, NULL},
+/* 0x3f */  {NULL, NULL},
+/* 0x40 */  {NULL, NULL},
+/* 0x41 */  {NULL, NULL},
+/* 0x42 */  {NULL, NULL},
+/* 0x43 */  {NULL, NULL},
+/* 0x44 */  {NULL, NULL},
+/* 0x45 */  {NULL, NULL},
+/* 0x46 */  {NULL, NULL},
+/* 0x47 */  {NULL, NULL},
+/* 0x48 */  {NULL, NULL},
+/* 0x49 */  {NULL, NULL},
+/* 0x4a */  {NULL, NULL},
+/* 0x4b */  {NULL, NULL},
+/* 0x4c */  {NULL, NULL},
+/* 0x4d */  {NULL, NULL},
+/* 0x4e */  {NULL, NULL},
+/* 0x4f */  {NULL, NULL},
+/* 0x50 */  {NULL, NULL},
+/* 0x51 */  {NULL, NULL},
+/* 0x52 */  {NULL, NULL},
+/* 0x53 */  {NULL, NULL},
+/* 0x54 */  {NULL, NULL},
+/* 0x55 */  {NULL, NULL},
+/* 0x56 */  {NULL, NULL},
+/* 0x57 */  {NULL, NULL},
+/* 0x58 */  {NULL, NULL},
+/* 0x59 */  {NULL, NULL},
+/* 0x5a */  {NULL, NULL},
+/* 0x5b */  {NULL, NULL},
+/* 0x5c */  {NULL, NULL},
+/* 0x5d */  {NULL, NULL},
+/* 0x5e */  {NULL, NULL},
+/* 0x5f */  {NULL, NULL},
+/* 0x60 */  {NULL, NULL},
+/* 0x61 */  {NULL, NULL},
+/* 0x62 */  {NULL, NULL},
+/* 0x63 */  {NULL, NULL},
+/* 0x64 */  {NULL, NULL},
+/* 0x65 */  {NULL, NULL},
+/* 0x66 */  {NULL, NULL},
+/* 0x67 */  {NULL, NULL},
+/* 0x68 */  {NULL, NULL},
+/* 0x69 */  {NULL, NULL},
+/* 0x6a */  {NULL, NULL},
+/* 0x6b */  {NULL, NULL},
+/* 0x6c */  {NULL, NULL},
+/* 0x6d */  {NULL, NULL},
+/* 0x6e */  {NULL, NULL},
+/* 0x6f */  {NULL, NULL},
+/* 0x70 */  {NULL, NULL},
+/* 0x71 */  {NULL, NULL},
+/* 0x72 */  {dissect_smb_negprot_request, dissect_smb_negprot_response},
+/* 0x73 */  {NULL, NULL},
+/* 0x74 */  {NULL, NULL},
+/* 0x75 */  {NULL, NULL},
+/* 0x76 */  {NULL, NULL},
+/* 0x77 */  {NULL, NULL},
+/* 0x78 */  {NULL, NULL},
+/* 0x79 */  {NULL, NULL},
+/* 0x7a */  {NULL, NULL},
+/* 0x7b */  {NULL, NULL},
+/* 0x7c */  {NULL, NULL},
+/* 0x7d */  {NULL, NULL},
+/* 0x7e */  {NULL, NULL},
+/* 0x7f */  {NULL, NULL},
+/* 0x80 */  {NULL, NULL},
+/* 0x81 */  {NULL, NULL},
+/* 0x82 */  {NULL, NULL},
+/* 0x83 */  {NULL, NULL},
+/* 0x84 */  {NULL, NULL},
+/* 0x85 */  {NULL, NULL},
+/* 0x86 */  {NULL, NULL},
+/* 0x87 */  {NULL, NULL},
+/* 0x88 */  {NULL, NULL},
+/* 0x89 */  {NULL, NULL},
+/* 0x8a */  {NULL, NULL},
+/* 0x8b */  {NULL, NULL},
+/* 0x8c */  {NULL, NULL},
+/* 0x8d */  {NULL, NULL},
+/* 0x8e */  {NULL, NULL},
+/* 0x8f */  {NULL, NULL},
+/* 0x90 */  {NULL, NULL},
+/* 0x91 */  {NULL, NULL},
+/* 0x92 */  {NULL, NULL},
+/* 0x93 */  {NULL, NULL},
+/* 0x94 */  {NULL, NULL},
+/* 0x95 */  {NULL, NULL},
+/* 0x96 */  {NULL, NULL},
+/* 0x97 */  {NULL, NULL},
+/* 0x98 */  {NULL, NULL},
+/* 0x99 */  {NULL, NULL},
+/* 0x9a */  {NULL, NULL},
+/* 0x9b */  {NULL, NULL},
+/* 0x9c */  {NULL, NULL},
+/* 0x9d */  {NULL, NULL},
+/* 0x9e */  {NULL, NULL},
+/* 0x9f */  {NULL, NULL},
+/* 0xa0 */  {NULL, NULL},
+/* 0xa1 */  {NULL, NULL},
+/* 0xa2 */  {NULL, NULL},
+/* 0xa3 */  {NULL, NULL},
+/* 0xa4 */  {NULL, NULL},
+/* 0xa5 */  {NULL, NULL},
+/* 0xa6 */  {NULL, NULL},
+/* 0xa7 */  {NULL, NULL},
+/* 0xa8 */  {NULL, NULL},
+/* 0xa9 */  {NULL, NULL},
+/* 0xaa */  {NULL, NULL},
+/* 0xab */  {NULL, NULL},
+/* 0xac */  {NULL, NULL},
+/* 0xad */  {NULL, NULL},
+/* 0xae */  {NULL, NULL},
+/* 0xaf */  {NULL, NULL},
+/* 0xb0 */  {NULL, NULL},
+/* 0xb1 */  {NULL, NULL},
+/* 0xb2 */  {NULL, NULL},
+/* 0xb3 */  {NULL, NULL},
+/* 0xb4 */  {NULL, NULL},
+/* 0xb5 */  {NULL, NULL},
+/* 0xb6 */  {NULL, NULL},
+/* 0xb7 */  {NULL, NULL},
+/* 0xb8 */  {NULL, NULL},
+/* 0xb9 */  {NULL, NULL},
+/* 0xba */  {NULL, NULL},
+/* 0xbb */  {NULL, NULL},
+/* 0xbc */  {NULL, NULL},
+/* 0xbd */  {NULL, NULL},
+/* 0xbe */  {NULL, NULL},
+/* 0xbf */  {NULL, NULL},
+/* 0xc0 */  {NULL, NULL},
+/* 0xc1 */  {NULL, NULL},
+/* 0xc2 */  {NULL, NULL},
+/* 0xc3 */  {NULL, NULL},
+/* 0xc4 */  {NULL, NULL},
+/* 0xc5 */  {NULL, NULL},
+/* 0xc6 */  {NULL, NULL},
+/* 0xc7 */  {NULL, NULL},
+/* 0xc8 */  {NULL, NULL},
+/* 0xc9 */  {NULL, NULL},
+/* 0xca */  {NULL, NULL},
+/* 0xcb */  {NULL, NULL},
+/* 0xcc */  {NULL, NULL},
+/* 0xcd */  {NULL, NULL},
+/* 0xce */  {NULL, NULL},
+/* 0xcf */  {NULL, NULL},
+/* 0xd0 */  {NULL, NULL},
+/* 0xd1 */  {NULL, NULL},
+/* 0xd2 */  {NULL, NULL},
+/* 0xd3 */  {NULL, NULL},
+/* 0xd4 */  {NULL, NULL},
+/* 0xd5 */  {NULL, NULL},
+/* 0xd6 */  {NULL, NULL},
+/* 0xd7 */  {NULL, NULL},
+/* 0xd8 */  {NULL, NULL},
+/* 0xd9 */  {NULL, NULL},
+/* 0xda */  {NULL, NULL},
+/* 0xdb */  {NULL, NULL},
+/* 0xdc */  {NULL, NULL},
+/* 0xdd */  {NULL, NULL},
+/* 0xde */  {NULL, NULL},
+/* 0xdf */  {NULL, NULL},
+/* 0xe0 */  {NULL, NULL},
+/* 0xe1 */  {NULL, NULL},
+/* 0xe2 */  {NULL, NULL},
+/* 0xe3 */  {NULL, NULL},
+/* 0xe4 */  {NULL, NULL},
+/* 0xe5 */  {NULL, NULL},
+/* 0xe6 */  {NULL, NULL},
+/* 0xe7 */  {NULL, NULL},
+/* 0xe8 */  {NULL, NULL},
+/* 0xe9 */  {NULL, NULL},
+/* 0xea */  {NULL, NULL},
+/* 0xeb */  {NULL, NULL},
+/* 0xec */  {NULL, NULL},
+/* 0xed */  {NULL, NULL},
+/* 0xee */  {NULL, NULL},
+/* 0xef */  {NULL, NULL},
+/* 0xf0 */  {NULL, NULL},
+/* 0xf1 */  {NULL, NULL},
+/* 0xf2 */  {NULL, NULL},
+/* 0xf3 */  {NULL, NULL},
+/* 0xf4 */  {NULL, NULL},
+/* 0xf5 */  {NULL, NULL},
+/* 0xf6 */  {NULL, NULL},
+/* 0xf7 */  {NULL, NULL},
+/* 0xf8 */  {NULL, NULL},
+/* 0xf9 */  {NULL, NULL},
+/* 0xfa */  {NULL, NULL},
+/* 0xfb */  {NULL, NULL},
+/* 0xfc */  {NULL, NULL},
+/* 0xfd */  {NULL, NULL},
+/* 0xfe */  {NULL, NULL},
+/* 0xff */  {NULL, NULL}
+};
+
+
+
+/* XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+ * Everything tvbuffified above this line
+ * XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+ */
+


/*
@@ -1915,6 +2799,8 @@

}

+
+
/* Generated by build-dissect.pl Vesion 0.6 27-Jun-1999, ACT */
void

dissect_ssetup_andx_smb(const u_char *pd, int offset, frame_data *fd,proto_tree *parent, proto_tree *tree, struct smb_info si, int max_data, intSMB_offset, int errcode)

@@ -2799,548 +3685,6 @@

}

-void

-dissect_negprot_smb(const u_char *pd, int offset, frame_data *fd,proto_tree *parent, proto_tree *tree, struct smb_info si, int max_data, intSMB_offset, int errcode)

-{
-  guint8        wct, enckeylen;
-  guint16       bcc, mode, rawmode, dialect;
-  guint32       caps;
-  proto_tree    *dialects = NULL, *mode_tree, *caps_tree, *rawmode_tree;
-  proto_item    *ti;
-  const char    *str;
-  char          *ustr;
-  int           ustr_len;
-
-  wct = pd[offset];    /* Should be 0, 1 or 13 or 17, I think */
-
-  if (!((wct == 0) && si.request) && !((wct == 1) && !si.request) &&
-      !((wct == 13) && !si.request) && !((wct == 17) && !si.request)) {
-    if (tree) {
-

- proto_tree_add_text(tree, NullTVB, offset, 1, "Invalid NegotiateProtocol format. WCT should be zero or 1 or 13 or 17 ..., not %u", wct);

-
-      proto_tree_add_text(tree, NullTVB, offset, END_OF_FRAME, "Data");
-
-      return;
-    }
-  }
-
-  if (tree) {
-

- proto_tree_add_text(tree, NullTVB, offset, 1, "Word Count (WCT): %d",wct);

-
-  }
-
-  if (!si.request && errcode != 0) return;  /* No more info ... */
-
-  offset += 1;
-
-  /* Now decode the various formats ... */
-
-  switch (wct) {
-
-  case 0:     /* A request */
-
-    bcc = GSHORT(pd, offset);
-
-    if (tree) {
-

- proto_tree_add_text(tree, NullTVB, offset, 2, "Byte Count (BCC): %u",bcc);

-
-    }
-
-    offset += 2;
-
-    if (tree) {
-

- ti = proto_tree_add_text(tree, NullTVB, offset, END_OF_FRAME,"Dialects");

-      dialects = proto_item_add_subtree(ti, ett_smb_dialects);
-
-    }
-
-    while (IS_DATA_IN_FRAME(offset)) {
-      const char *str;
-
-      if (tree) {
-

- proto_tree_add_text(dialects, NullTVB, offset, 1, "Dialect Marker: %d",pd[offset]);

-
-      }
-
-      offset += 1;
-
-      str = pd + offset;
-
-      if (tree) {
-

- proto_tree_add_text(dialects, NullTVB, offset, strlen(str)+1, "Dialect:%s", str);

-
-      }
-
-      offset += strlen(str) + 1;
-
-    }
-    break;
-
-  case 1:     /* PC NETWORK PROGRAM 1.0 */
-
-    dialect = GSHORT(pd, offset);
-
-    if (tree) {  /* Hmmmm, what if none of the dialects is recognized */
-
-      if (dialect == 0xFFFF) { /* Server didn't like them dialects */
-

- proto_tree_add_text(tree, NullTVB, offset, 2, "Supplied dialects notrecognized");

-
-      }
-      else {
-

- proto_tree_add_text(tree, NullTVB, offset, 2, "Dialect Index: %u, PCNETWORK PROTGRAM 1.0", dialect);

-
-      }
-
-    }
-
-    offset += 2;
-
-    bcc = GSHORT(pd, offset);
-
-    if (tree) {
-

- proto_tree_add_text(tree, NullTVB, offset, 2, "Byte Count (BCC): %u",bcc);

-
-    }
-
-    break;
-
-  case 13:    /* Greater than Core and up to and incl LANMAN2.1  */
-
-    if (tree) {
-

- proto_tree_add_text(tree, NullTVB, offset, 2, "Dialect Index: %u,Greater than CORE PROTOCOL and up to LANMAN2.1", GSHORT(pd, offset));

-
-    }
-
-    /* Much of this is similar to response 17 below */
-
-    offset += 2;
-
-    mode = GSHORT(pd, offset);
-
-    if (tree) {
-

- ti = proto_tree_add_text(tree, NullTVB, offset, 2, "Security Mode:0x%04x", mode);

-      mode_tree = proto_item_add_subtree(ti, ett_smb_mode);
-      proto_tree_add_text(mode_tree, NullTVB, offset, 2, "%s",
-			  decode_boolean_bitfield(mode, 0x0001, 16,
-						  "Security  = User",
-						  "Security  = Share"));
-      proto_tree_add_text(mode_tree, NullTVB, offset, 2, "%s",
-			  decode_boolean_bitfield(mode, 0x0002, 16,
-						  "Passwords = Encrypted",
-						  "Passwords = Plaintext"));
-
-    }
-
-    offset += 2;
-
-    if (tree) {
-

- proto_tree_add_text(tree, NullTVB, offset, 2, "Max buffer size:%u", GSHORT(pd, offset));

-
-    }
-
-    offset += 2;
-
-    if (tree) {
-

- proto_tree_add_text(tree, NullTVB, offset, 2, "Max multiplex count:%u", GSHORT(pd, offset));

-
-    }
-
-    offset += 2;
-
-    if (tree) {
-

- proto_tree_add_text(tree, NullTVB, offset, 2, "Max vcs:%u", GSHORT(pd, offset));

-
-    }
-
-    offset += 2;
-
-    rawmode = GSHORT(pd, offset);
-
-    if (tree) {
-

- ti = proto_tree_add_text(tree, NullTVB, offset, 2, "Raw Mode:0x%04x", rawmode);

-      rawmode_tree = proto_item_add_subtree(ti, ett_smb_rawmode);
-      proto_tree_add_text(rawmode_tree, NullTVB, offset, 2, "%s",
-			  decode_boolean_bitfield(rawmode, 0x01, 16,
-						  "Read Raw supported",
-						  "Read Raw not supported"));
-      proto_tree_add_text(rawmode_tree, NullTVB, offset, 2, "%s",
-			  decode_boolean_bitfield(rawmode, 0x02, 16,
-						  "Write Raw supported",
-						  "Write Raw not supported"));
-
-    }
-
-    offset += 2;
-
-    if (tree) {
-

- proto_tree_add_text(tree, NullTVB, offset, 4, "Session key:%08x", GWORD(pd, offset));

-
-    }
-
-    offset += 4;
-
-    /* Now the server time, two short parameters ... */
-
-    if (tree) {
-
-      proto_tree_add_text(tree, NullTVB, offset, 2, "Server Time: %s",
-			dissect_dos_time(GSHORT(pd, offset)));
-      proto_tree_add_text(tree, NullTVB, offset + 2, 2, "Server Date: %s",
-			dissect_dos_date(GSHORT(pd, offset + 2)));
-
-    }
-
-    offset += 4;
-
-    /* Server Time Zone, SHORT */
-
-    if (tree) {
-

- proto_tree_add_text(tree, NullTVB, offset, 2, "Server time zone: %imin from UTC",

-			  (signed short)GSSHORT(pd, offset));
-
-    }
-
-    offset += 2;
-
-    /* Challenge Length */
-
-    enckeylen = GSHORT(pd, offset);
-
-    if (tree) {
-

- proto_tree_add_text(tree, NullTVB, offset, 2, "Challenge Length: %u",enckeylen);

-
-    }
-
-    offset += 2;
-
-    if (tree) {
-

- proto_tree_add_text(tree, NullTVB, offset, 2, "Reserved: %u (MBZ)",GSHORT(pd, offset));

-
-    }
-
-    offset += 2;
-
-    bcc = GSHORT(pd, offset);
-
-    if (tree) {
-

- proto_tree_add_text(tree, NullTVB, offset, 2, "Byte Count (BCC): %u",bcc);

-
-    }
-
-    offset += 2;
-
-    if (enckeylen) { /* only if non-zero key len */
-
-      str = pd + offset;
-
-      if (tree) {
-
-	proto_tree_add_text(tree, NullTVB, offset, enckeylen, "Challenge: %s",
-				bytes_to_str(str, enckeylen));
-      }
-
-      offset += enckeylen;
-
-    }
-
-    /* Primary Domain ... */
-
-    str = pd + offset;
-
-    if (tree) {
-

- proto_tree_add_text(tree, NullTVB, offset, strlen(str)+1, "PrimaryDomain: %s", str);

-
-    }
-
-    break;
-
-  case 17:    /* Greater than LANMAN2.1 */
-
-    if (tree) {
-

- proto_tree_add_text(tree, NullTVB, offset, 2, "Dialect Index: %u,Greater than LANMAN2.1", GSHORT(pd, offset));

-
-    }
-
-    offset += 2;
-
-    mode = GBYTE(pd, offset);
-
-    if (tree) {
-

- ti = proto_tree_add_text(tree, NullTVB, offset, 1, "Security Mode:0x%02x", mode);

-      mode_tree = proto_item_add_subtree(ti, ett_smb_mode);
-      proto_tree_add_text(mode_tree, NullTVB, offset, 1, "%s",
-			  decode_boolean_bitfield(mode, 0x01, 8,
-						  "Security  = User",
-						  "Security  = Share"));
-      proto_tree_add_text(mode_tree, NullTVB, offset, 1, "%s",
-			  decode_boolean_bitfield(mode, 0x02, 8,
-						  "Passwords = Encrypted",
-						  "Passwords = Plaintext"));
-      proto_tree_add_text(mode_tree, NullTVB, offset, 1, "%s",
-			  decode_boolean_bitfield(mode, 0x04, 8,
-						  "Security signatures enabled",
-						  "Security signatures not enabled"));
-      proto_tree_add_text(mode_tree, NullTVB, offset, 1, "%s",
-			  decode_boolean_bitfield(mode, 0x08, 8,
-						  "Security signatures required",
-						  "Security signatures not required"));
-
-    }
-
-    offset += 1;
-
-    if (tree) {
-

- proto_tree_add_text(tree, NullTVB, offset, 2, "Max multiplex count:%u", GSHORT(pd, offset));

-
-    }
-
-    offset += 2;
-
-    if (tree) {
-

- proto_tree_add_text(tree, NullTVB, offset, 2, "Max vcs:%u", GSHORT(pd, offset));

-
-    }
-
-    offset += 2;
-
-    if (tree) {
-

- proto_tree_add_text(tree, NullTVB, offset, 2, "Max buffer size:%u", GWORD(pd, offset));

-
-    }
-
-    offset += 4;
-
-    if (tree) {
-

- proto_tree_add_text(tree, NullTVB, offset, 4, "Max raw size:%u", GWORD(pd, offset));

-
-    }
-
-    offset += 4;
-
-    if (tree) {
-

- proto_tree_add_text(tree, NullTVB, offset, 4, "Session key:%08x", GWORD(pd, offset));

-
-    }
-
-    offset += 4;
-
-    caps = GWORD(pd, offset);
-
-    if (tree) {
-

- ti = proto_tree_add_text(tree, NullTVB, offset, 4, "Capabilities:0x%04x", caps);

-      caps_tree = proto_item_add_subtree(ti, ett_smb_capabilities);
-      proto_tree_add_text(caps_tree, NullTVB, offset, 4, "%s",
-			  decode_boolean_bitfield(caps, 0x0001, 32,
-						  "Raw Mode supported",
-						  "Raw Mode not supported"));
-      proto_tree_add_text(caps_tree, NullTVB, offset, 4, "%s",
-			  decode_boolean_bitfield(caps, 0x0002, 32,
-						  "MPX Mode supported",
-						  "MPX Mode not supported"));
-      proto_tree_add_text(caps_tree, NullTVB, offset, 4, "%s",
-			  decode_boolean_bitfield(caps, 0x0004, 32,
-						  "Unicode supported",
-						  "Unicode not supported"));
-      proto_tree_add_text(caps_tree, NullTVB, offset, 4, "%s",
-			  decode_boolean_bitfield(caps, 0x0008, 32,
-						  "Large files supported",
-						  "Large files not supported"));
-      proto_tree_add_text(caps_tree, NullTVB, offset, 4, "%s",
-			  decode_boolean_bitfield(caps, 0x0010, 32,
-						  "NT LM 0.12 SMBs supported",
-						  "NT LM 0.12 SMBs not supported"));
-      proto_tree_add_text(caps_tree, NullTVB, offset, 4, "%s",
-			  decode_boolean_bitfield(caps, 0x0020, 32,
-						  "RPC remote APIs supported",
-						  "RPC remote APIs not supported"));
-      proto_tree_add_text(caps_tree, NullTVB, offset, 4, "%s",
-			  decode_boolean_bitfield(caps, 0x0040, 32,
-						  "NT status codes supported",
-						  "NT status codes  not supported"));
-      proto_tree_add_text(caps_tree, NullTVB, offset, 4, "%s",
-			  decode_boolean_bitfield(caps, 0x0080, 32,
-						  "Level 2 OpLocks supported",
-						  "Level 2 OpLocks not supported"));
-      proto_tree_add_text(caps_tree, NullTVB, offset, 4, "%s",
-			  decode_boolean_bitfield(caps, 0x0100, 32,
-						  "Lock&Read supported",
-						  "Lock&Read not supported"));
-      proto_tree_add_text(caps_tree, NullTVB, offset, 4, "%s",
-			  decode_boolean_bitfield(caps, 0x0200, 32,
-						  "NT Find supported",
-						  "NT Find not supported"));
-      proto_tree_add_text(caps_tree, NullTVB, offset, 4, "%s",
-			  decode_boolean_bitfield(caps, 0x1000, 32,
-						  "DFS supported",
-						  "DFS not supported"));
-      proto_tree_add_text(caps_tree, NullTVB, offset, 4, "%s",
-			  decode_boolean_bitfield(caps, 0x4000, 32,
-						  "Large READX supported",
-						  "Large READX not supported"));
-      proto_tree_add_text(caps_tree, NullTVB, offset, 4, "%s",
-			  decode_boolean_bitfield(caps, 0x8000, 32,
-						  "Large WRITEX supported",
-						  "Large WRITEX not supported"));
-      proto_tree_add_text(caps_tree, NullTVB, offset, 4, "%s",
-			  decode_boolean_bitfield(caps, 0x80000000, 32,
-						  "Extended security exchanges supported",
-						  "Extended security exchanges not supported"));
-    }
-
-    offset += 4;
-
-    /* Server time, 2 WORDS */
-
-    if (tree) {
-

- proto_tree_add_text(tree, NullTVB, offset, 4, "System Time Low:0x%08x", GWORD(pd, offset));- proto_tree_add_text(tree, NullTVB, offset + 4, 4, "System Time High:0x%08x", GWORD(pd, offset + 4));

-
-    }
-
-    offset += 8;
-
-    /* Server Time Zone, SHORT */
-
-    if (tree) {
-

- proto_tree_add_text(tree, NullTVB, offset, 2, "Server time zone: %imin from UTC",

-			  (signed short)GSSHORT(pd, offset));
-
-    }
-
-    offset += 2;
-
-    /* Encryption key len */
-
-    enckeylen = pd[offset];
-
-    if (tree) {
-

- proto_tree_add_text(tree, NullTVB, offset, 1, "Encryption key len:%u", enckeylen);

-
-    }
-
-    offset += 1;
-
-    bcc = GSHORT(pd, offset);
-
-    if (tree) {
-

- proto_tree_add_text(tree, NullTVB, offset, 2, "Byte count (BCC): %u",bcc);

-
-    }
-
-    offset += 2;
-
-    if (caps & 0x80000000) {
-      /* Extended security */
-
-      /* GUID */
-
-      if (tree) {
-
-	/* XXX - show it in GUID form, with dashes or whatever */
-	proto_tree_add_text(tree, NullTVB, offset, 16, "GUID: %s",
-				bytes_to_str(&pd[offset], 16));
-
-      }
-
-      offset += 16;
-
-      /* Security blob */
-      /* XXX - is this ASN.1-encoded?  Is it a Kerberos data structure,
-	 at least in NT 5.0-and-later server replies? */
-
-      if (bcc > 16) {
-	bcc -= 16;
-
-	if (tree) {
-
-	  proto_tree_add_text(tree, NullTVB, offset, bcc, "Security blob: %s",
-				bytes_to_str(&pd[offset], bcc));
-
-	}
-      }
-    } else {
-      /* Non-extended security */
-
-      if (enckeylen) { /* only if non-zero key len */
-
-	/* Encryption challenge key */
-
-	str = pd + offset;
-
-	if (tree) {
-

- proto_tree_add_text(tree, NullTVB, offset, enckeylen, "Challengeencryption key: %s",

-				bytes_to_str(str, enckeylen));
-
-	}
-
-	offset += enckeylen;
-
-      }
-
-      /* The domain, a null terminated string; Unicode if "caps" has
-	 the 0x0004 bit set, ASCII (OEM character set) otherwise.
-	XXX - for now, we just handle the ISO 8859-1 subset of Unicode. */
-
-      str = pd + offset;
-
-      if (tree) {
-
-	if (caps & 0x0004) {
-	  ustr = unicode_to_str(str, &ustr_len);

- proto_tree_add_text(tree, NullTVB, offset, ustr_len+2, "OEM domain name:%s", ustr);

-	} else {

- proto_tree_add_text(tree, NullTVB, offset, strlen(str)+1, "OEM domainname: %s", str);

-	}
-
-      }
-    }
-
-    break;
-
-  default:    /* Baddd */
-
-    if (tree)

- proto_tree_add_text(tree, NullTVB, offset, 1, "Bad format, shouldnever get here");

-    return;
-
-  }
-
-}
-
void

dissect_deletedir_smb(const u_char *pd, int offset, frame_data *fd,proto_tree *parent, proto_tree *tree, struct smb_info si, int max_data, intSMB_offset, int errcode)


@@ -10291,7 +10635,7 @@
  dissect_unknown_smb,      /* unknown SMB 0x6f */
  dissect_treecon_smb,      /* SMBtcon tree connect */
  dissect_tdis_smb,         /* SMBtdis tree disconnect */
-  dissect_negprot_smb,      /* SMBnegprot negotiate a protocol */
+  dissect_unknown_smb,

dissect_ssetup_andx_smb, /* SMBsesssetupX Session Set Up & X (includingUser Logon) */

  dissect_logoff_andx_smb,  /* SMBlogof Logoff & X */
  dissect_tcon_andx_smb,    /* SMBtconX tree connect and X */
@@ -10589,15 +10933,18 @@
#define SMB_FLAGS_DIRN 0x80

void

-dissect_smb(const u_char *pd, int offset, frame_data *fd, proto_tree *tree,int max_data)+dissect_smb(const u_char *pd, int offset, frame_data *fd, proto_tree*parent_tree, int max_data)

{
-	proto_tree      *smb_tree = tree, *flags_tree, *flags2_tree;
-	proto_item      *ti, *tf;
+	proto_tree      *smb_tree = NULL, *tree = NULL, *flags_tree, *flags2_tree;
+	proto_item      *item = NULL, *ti = NULL, *tf = NULL;
	guint8          cmd, errcls, errcode1, flags;
	guint16         flags2, errcode, tid, pid, uid, mid;
	guint32         status;
	int             SMB_offset = offset;
+	int		old_offset = offset;
	struct smb_info si;
+	int (*new_dissector)(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree);
+

	OLD_CHECK_DISPLAY_AS_DATA(proto_smb, pd, offset, fd, tree);

@@ -10617,20 +10964,29 @@

	}

+	if (parent_tree) {

+ item = proto_tree_add_item(parent_tree, proto_smb, NullTVB, offset,END_OF_FRAME, FALSE);

+
+	  tree = proto_item_add_subtree(item, ett_smb);
+	}
+
	if (tree) {
+	  ti = proto_tree_add_text(tree, NullTVB, offset,
+		END_OF_FRAME, "SMB Header  : %s (0x%02x) %s",
+		decode_smb_name(cmd), cmd,
+		(pi.match_port==pi.destport)?"Request":"Response");

- ti = proto_tree_add_item(tree, proto_smb, NullTVB, offset, END_OF_FRAME,FALSE);

-	  smb_tree = proto_item_add_subtree(ti, ett_smb);
+	  smb_tree = proto_item_add_subtree(ti, ett_smb_header);

	  /* 0xFFSMB is actually a 1 byte msg type and 3 byte server
	   * component ... SMB is only one used
	   */

-	  proto_tree_add_text(smb_tree, NullTVB, offset, 1, "Message Type: 0xFF");

- proto_tree_add_text(smb_tree, NullTVB, offset+1, 3, "Server Component:SMB");

-
	}

+	proto_tree_add_text(smb_tree, NullTVB, offset, 1, "Message Type: 0xFF");

+ proto_tree_add_text(smb_tree, NullTVB, offset+1, 3, "Server Component:SMB");

+
	offset += 4;  /* Skip the marker */

	if (tree) {
@@ -10789,7 +11145,9 @@

	}

-	if (flags2 & 0x8000) si.unicode = TRUE; /* Mark them as Unicode */
+	if (flags2 & 0x8000) {
+		si.unicode = TRUE; /* Mark them as Unicode */
+	}

	offset += 2;

@@ -10887,10 +11245,35 @@

	offset += 2;

+	new_dissector = (pi.match_port==pi.destport)?
+		smb_dissector[cmd].request:smb_dissector[cmd].response;
+
	/* Now vector through the table to dissect them */
-
-	(dissect[cmd])(pd, offset, fd, tree, smb_tree, si, max_data,
-		       SMB_offset, errcode);
+	if(new_dissector){
+  		tvbuff_t *next_tvb;
+		proto_item *cmd_item = NULL;
+		proto_tree *cmd_tree = NULL;
+
+		/* we need the unicode flag */
+		pi.private = &si;
+
+		proto_item_set_len(ti, offset-old_offset);
+
+		next_tvb = tvb_create_from_top(offset);
+		if (tree) {
+			cmd_item = proto_tree_add_text(tree, NullTVB, offset,
+				END_OF_FRAME, "SMB Command : %s (0x%02x) %s",
+				decode_smb_name(cmd), cmd,
+				(pi.match_port==pi.destport)?"Request":"Response");
+
+			cmd_tree = proto_item_add_subtree(cmd_item, ett_smb_command);
+		}
+		(*new_dissector)(next_tvb, &pi, cmd_tree);
+	} else {
+		/* call old dissector */
+		(dissect[cmd])(pd, offset, fd, tree, tree, si, max_data,
+			       SMB_offset, errcode);
+	}
}

/*** External routines called during the registration process */
@@ -10908,7 +11291,201 @@
	static hf_register_info hf[] = {
	  { &hf_smb_cmd,
	    { "SMB Command", "smb.cmd", FT_UINT8, BASE_HEX,
-	    NULL, 0x0, "SMB Command", HFILL }}
+	    NULL, 0x0, "SMB Command", HFILL }},
+
+	  { &hf_word_count,
+		{ "Word Count", "smb.word_count", FT_UINT8, BASE_DEC,
+		NULL, 0, "SMB Word Count", HFILL }},
+
+	  { &hf_byte_count,
+		{ "Byte Count", "smb.byte_count", FT_UINT16, BASE_DEC,
+		NULL, 0, "SMB Byte Count", HFILL }},
+
+	  { &hf_dialect_buffer_format,
+		{ "Buffer Format", "smb.dialect.buffer_format", FT_UINT8, BASE_HEX,
+		NULL, 0, "Buffer Format for this dialect", HFILL }},
+
+	  { &hf_dialect_name,
+		{ "Name", "smb.dialect.name", FT_STRING, BASE_NONE,
+		NULL, 0, "Name of dialect", HFILL }},
+
+	  { &hf_dialect_index,
+		{ "Selected Index", "smb.dialect.index", FT_UINT16, BASE_DEC,
+		NULL, 0, "Index of selected dialect", HFILL }},
+
+	  { &hf_sm_mode,
+		{ "Mode", "smb.sm.mode", FT_BOOLEAN, 16,

+ TFS(&tfs_sm_mode), SECURITY_MODE_MODE, "User or Share security mode?",HFILL }},

+
+	  { &hf_sm_password,
+		{ "Password", "smb.sm.password", FT_BOOLEAN, 16,

+ TFS(&tfs_sm_password), SECURITY_MODE_PASSWORD, "Encrypted or plaintextpasswords?", HFILL }},

+
+	  { &hf_sm_signatures,
+		{ "Signatures", "smb.sm.signatures", FT_BOOLEAN, 16,

+ TFS(&tfs_sm_signatures), SECURITY_MODE_SIGNATURES, "Are securitysignatures enabled?", HFILL }},

+
+	  { &hf_sm_sig_required,
+		{ "Sig Req", "smb.sm.sig_required", FT_BOOLEAN, 16,

+ TFS(&tfs_sm_sig_required), SECURITY_MODE_SIG_REQUIRED, "Are securitysignatures required?", HFILL }},

+
+	  { &hf_max_trans_buf_size,
+		{ "Max TBuffer", "smb.max_trans", FT_UINT32, BASE_DEC,
+		NULL, 0, "Max transmit buffer size", HFILL }},
+
+	  { &hf_max_raw_buf_size,
+		{ "Max Raw Buffer", "smb.max_raw", FT_UINT32, BASE_DEC,
+		NULL, 0, "Max raw buffer size", HFILL }},
+
+	  { &hf_max_mpx_count,
+		{ "Max Mpx", "smb.max_mpx", FT_UINT16, BASE_DEC,
+		NULL, 0, "Max pending multiplexed requests", HFILL }},
+
+	  { &hf_max_vcs_num,
+		{ "Max VCs", "smb.max_vcs", FT_UINT16, BASE_DEC,
+		NULL, 0, "Max VCs between client and server", HFILL }},
+
+	  { &hf_rm_read,
+		{ "Read", "smb.rm.read", FT_BOOLEAN, 16,
+		TFS(&tfs_rm_read), RAWMODE_READ, "Is rawmode READ supported?", HFILL }},
+
+	  { &hf_rm_write,
+		{ "Write", "smb.rm.write", FT_BOOLEAN, 16,

+ TFS(&tfs_rm_write), RAWMODE_WRITE, "Is rawmode WRITE supported?", HFILL}},

+
+	  { &hf_session_key,
+		{ "Session Key", "smb.session_key", FT_UINT32, BASE_HEX,
+		NULL, 0, "Unique token identifying this session", HFILL }},
+
+	  { &hf_current_server_date,
+		{ "Current Date", "smb.server.current.date", FT_ABSOLUTE_TIME, BASE_NONE,
+		NULL, 0, "Current date and time at server", HFILL }},
+
+	  { &hf_current_server_dos_date,
+		{ "Current Date", "smb.server.current.dos.date", FT_UINT16, BASE_HEX,
+		NULL, 0, "Current date at server, DOS format", HFILL }},
+
+	  { &hf_current_server_dos_time,
+		{ "Current Time", "smb.server.current.dos.time", FT_UINT16, BASE_HEX,
+		NULL, 0, "Current time at server, DOS format", HFILL }},
+
+	  { &hf_server_timezone,
+		{ "Time Zone", "smb.server.timezone", FT_INT16, BASE_DEC,
+		NULL, 0, "Current timezone at server.", HFILL }},
+
+	  { &hf_encryption_key_length,
+		{ "Key Length", "smb.encryption.key.length", FT_UINT16, BASE_DEC,

+ NULL, 0, "Encryption key length (must be 0 if not LM2.1 dialect)", HFILL}},

+
+	  { &hf_reserved,
+		{ "Reserved", "smb.reserved", FT_BYTES, BASE_HEX,
+		NULL, 0, "Reserved (MUST be zero)", HFILL }},
+
+	  { &hf_encryption_key,
+		{ "Encryption Key", "smb.encryption.key", FT_BYTES, BASE_HEX,

+ NULL, 0, "Challange/Response Encryption Key (for LM2.1 dialect)", HFILL}},

+
+	  { &hf_primary_domain,
+		{ "Primary Domain", "smb.primary.domain", FT_STRING, BASE_NONE,
+		NULL, 0, "The Server's Primary Domain", HFILL }},
+
+	  { &hf_oem_domain,
+		{ "OEM Domain", "smb.oem.domain", FT_STRING, BASE_NONE,

+ NULL, 0, "The Server's OEM Domain (Present only for non-extendedsecurity)", HFILL }},

+
+	  { &hf_server_cap_raw_mode,
+		{ "Raw Mode", "smb.server.cap.raw_mode", FT_BOOLEAN, 32,

+ TFS(&tfs_server_cap_raw_mode), SERVER_CAP_RAW_MODE, "Is RAW MODEcapability supported?", HFILL }},

+
+	  { &hf_server_cap_mpx_mode,
+		{ "MPX Mode", "smb.server.cap.mpx_mode", FT_BOOLEAN, 32,

+ TFS(&tfs_server_cap_mpx_mode), SERVER_CAP_MPX_MODE, "Is MPX MODEcapability supported?", HFILL }},

+
+	  { &hf_server_cap_unicode,
+		{ "Unicode", "smb.server.cap.unicode", FT_BOOLEAN, 32,

+ TFS(&tfs_server_cap_unicode), SERVER_CAP_UNICODE, "Is UNICODE capabilitysupported?", HFILL }},

+
+	  { &hf_server_cap_large_files,
+		{ "Large Files", "smb.server.cap.large_files", FT_BOOLEAN, 32,

+ TFS(&tfs_server_cap_large_files), SERVER_CAP_LARGE_FILES, "Is LARGE FILEScapability supported?", HFILL }},

+
+	  { &hf_server_cap_nt_smbs,
+		{ "NT Smbs", "smb.server.cap.nt_smbs", FT_BOOLEAN, 32,

+ TFS(&tfs_server_cap_nt_smbs), SERVER_CAP_NT_SMBS, "Is NT SMBS capabilitysupported?", HFILL }},

+
+	  { &hf_server_cap_rpc_remote_apis,
+		{ "RPC Remote APIs", "smb.server.cap.rpc_remote_apis", FT_BOOLEAN, 32,

+ TFS(&tfs_server_cap_rpc_remote_apis), SERVER_CAP_RPC_REMOTE_APIS, "Is RPCREMOTE APIS capability supported?", HFILL }},

+
+	  { &hf_server_cap_status32,
+		{ "Status32", "smb.server.cap.status32", FT_BOOLEAN, 32,

+ TFS(&tfs_server_cap_status32), SERVER_CAP_STATUS32, "Is STATUS32capability supported?", HFILL }},

+
+	  { &hf_server_cap_level_ii_oplocks,
+		{ "Level 2 Oplocks", "smb.server.cap.level_2_oplocks", FT_BOOLEAN, 32,

+ TFS(&tfs_server_cap_level_ii_oplocks), SERVER_CAP_LEVEL_II_OPLOCKS, "IsLEVEL II OPLOCKS capability supported?", HFILL }},

+
+	  { &hf_server_cap_lock_and_read,
+		{ "Lock and Read", "smb.server.cap.lock_and_read", FT_BOOLEAN, 32,

+ TFS(&tfs_server_cap_lock_and_read), SERVER_CAP_LOCK_AND_READ, "Is LOCKAND READ capability supported?", HFILL }},

+
+	  { &hf_server_cap_nt_find,
+		{ "NT Find", "smb.server.cap.nt_find", FT_BOOLEAN, 32,

+ TFS(&tfs_server_cap_nt_find), SERVER_CAP_NT_FIND, "Is NT FIND capabilitysupported?", HFILL }},

+
+	  { &hf_server_cap_dfs,
+		{ "DFS", "smb.server.cap.dfs", FT_BOOLEAN, 32,

+ TFS(&tfs_server_cap_dfs), SERVER_CAP_DFS, "Is DFS capability supported?",HFILL }},

+
+	  { &hf_server_cap_infolevel_passthru,

+ { "Infolevel Passthru", "smb.server.cap.infolevel_passthru", FT_BOOLEAN,32,+ TFS(&tfs_server_cap_infolevel_passthru), SERVER_CAP_INFOLEVEL_PASSTHRU,"Is INFOLEVEL PASSTHRU capability supported?", HFILL }},

+
+	  { &hf_server_cap_large_readx,
+		{ "Large ReadX", "smb.server.cap.large_readx", FT_BOOLEAN, 32,

+ TFS(&tfs_server_cap_large_readx), SERVER_CAP_LARGE_READX, "Is LARGE READXcapability supported?", HFILL }},

+
+	  { &hf_server_cap_large_writex,
+		{ "Large WriteX", "smb.server.cap.large_writex", FT_BOOLEAN, 32,

+ TFS(&tfs_server_cap_large_writex), SERVER_CAP_LARGE_WRITEX, "Is LARGEWRITEX capability supported?", HFILL }},

+
+	  { &hf_server_cap_unix,
+		{ "Unix", "smb.server.cap.unix", FT_BOOLEAN, 32,

+ TFS(&tfs_server_cap_unix), SERVER_CAP_UNIX , "Is UNIX capabilitysupported?", HFILL }},

+
+	  { &hf_server_cap_reserved,
+		{ "Reserved", "smb.server.cap.reserved", FT_BOOLEAN, 32,
+		TFS(&tfs_server_cap_reserved), SERVER_CAP_RESERVED, "RESERVED", HFILL }},
+
+	  { &hf_server_cap_bulk_transfer,
+		{ "Bulk Transfer", "smb.server.cap.bulk_transfer", FT_BOOLEAN, 32,

+ TFS(&tfs_server_cap_bulk_transfer), SERVER_CAP_BULK_TRANSFER, "Is BULKTRANSFER capability supported?", HFILL }},

+
+	  { &hf_server_cap_compressed_data,
+		{ "Compressed Data", "smb.server.cap.compressed_data", FT_BOOLEAN, 32,

+ TFS(&tfs_server_cap_compressed_data), SERVER_CAP_COMPRESSED_DATA, "IsCOMPRESSED DATA capability supported?", HFILL }},

+
+	  { &hf_server_cap_extended_security,

+ { "Extended Security", "smb.server.cap.extended_security", FT_BOOLEAN,32,+ TFS(&tfs_server_cap_extended_security), SERVER_CAP_EXTENDED_SECURITY, "IsEXTENDED SECURITY capability supported?", HFILL }},

+
+	  { &hf_system_time_low,
+		{ "System Time Low", "smb.system.time.low", FT_UINT32, BASE_HEX,
+		NULL, 0, "Low part of system time", HFILL }},
+
+	  { &hf_system_time_high,
+		{ "System Time High", "smb.system.time.high", FT_UINT32, BASE_HEX,
+		NULL, 0, "High part of system time", HFILL }},
+
+	  { &hf_server_guid,
+		{ "Server GUID", "smb.server.guid", FT_BYTES, BASE_HEX,
+		NULL, 0, "Globally unique identifier for this server", HFILL }},
+
+	  { &hf_security_blob,
+		{ "Security Blob", "smb.security.blob", FT_BYTES, BASE_HEX,
+		NULL, 0, "Security blob", HFILL }},
+
+/*xxxxx*/
	};
	static gint *ett[] = {
		&ett_smb,
@@ -10916,6 +11493,7 @@
		&ett_smb_capabilities,
		&ett_smb_aflags,
		&ett_smb_dialects,
+		&ett_smb_dialect,
		&ett_smb_mode,
		&ett_smb_rawmode,
		&ett_smb_flags,
@@ -10928,6 +11506,9 @@
		&ett_smb_action,
		&ett_smb_writemode,
		&ett_smb_lock_type,
+		&ett_smb_header,
+		&ett_smb_command,
+		&ett_smb_time_date,
	};

	proto_smb = proto_register_protocol("SMB (Server Message Block Protocol)",

Follow-Ups:
- Re: [Ethereal-dev] Re: [Ethrereal-dev] packet-smb.c
  - From: Guy Harris

Prev by Date: Re: [Ethereal-dev] asn.1 compiler used???
Next by Date: [Ethereal-dev] patch - idl2eth - CORBA IDL Union support
Previous by thread: [Ethereal-dev] Debug dissector
Next by thread: Re: [Ethereal-dev] Re: [Ethrereal-dev] packet-smb.c
Index(es):
- Date
- Thread

Riverbed Cascade Pilot: Take Wireshark to the Next Level - Advanced Triggers and Alerts; Web and VoIP Analytics; Long-Term Trending and Forensics; Deep Packet Analysis with Wireshark

Riverbed Cascade Pilot Personal Edition: Take Wireshark to the Next Level - Advanced Triggers and Alerts; Web and VoIP Analytics; Long-Term Trending and Forensics; Deep Packet Analysis with Wireshark

Riverbed AirPcap: Complete Visibility of Your Wireless Networks; Multi-Channel, Aggregated Analysis; Portable and Versatile; Easy to Setup and Easy to Use; Ready to Power Your Application

$Riverbed TurboCap: Full-Speed GbE Capture; Port Aggregation; Pass-thru Mode; Aggregating Tap; Full-Speed GbE Injection; Exported Interfaces; TurboCap API Developer\'s Pack$