Ethereal-dev: Re: [Ethereal-dev] some dcerpc and nbss updates

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Wed, 26 Sep 2001 13:43:50 -0700 (PDT)
> 2.  modifies packet-nbns.c to use pass off netbios session packets to
> heuristic dissectors, and packet-dcerpc.c registers itself there.
> Most of the time, the layer directly above netbios session is SMB.
> However, it's possible to do DCE/RPC directly on the netbios session
> layer, with the ncacn_nb_tcp protseq.

Will it always be the case that a given NetBIOS session will be SMB, or
raw DCE RPC, or...?  Or do you need to do heuristic checks on every
packet?

If you will always get the same type of traffic on a session, then we
could expand the "conversation dissector" notion to allow multiple
conversation dissectors, keyed by the calling protocol, and have the
NBSS dissector call the appropriate conversation dissector if it's set,
and do the heuristics *and* associate the matching dissector with the
conversation (or have the called dissector do that) if it's not set.

That way, the SMB dissector would report anything that doesn't being
with 0xFF 'S' 'M' 'B' as a continuation, and other heuristic dissectors
would do the same.

(We do something similar for ONC RPC in the current CVS code.)