> I believe I understand what you're saying, but I'm not seeing how it
> would work. If a dissector is heuristic,
But the conversation dissector to be called by NBSS *wouldn't* be
heuristic.
> then if it doesn't recognize
> a frame (including, e.g., a nbss continuation frame) it isn't supposed
> to dissect it. So what's been gained?
What's been gained is that continuation frames are, at least, reported
as SMB continuations, rather than just TCP, because the conversation has
an indication that the NBSS dissector should call a *non*-heuristic SMB
dissector for all packets, and the SMB dissector sees that there's no
SMB header and reports it as a continuation.
> Maybe what we want is really just another flavor of defragmentation?
> That is really what these NBSS continuation messages are, right? The
> remains of a single NBSS message that didn't fit into a single TCP
> packet?
Right. The current CVS version of Ethereal has that. Enable the "Allow
subdissector to desegment TCP streams" preference for TCP, and, unless
you've explicitly disabled the "Desegment all NBSS packets spanning
multiple TCP segments" preference for NBSS, it'll attempt to reassemble
multi-segment NBSS packets.
