One last question.
These transaction2 exchanges you have seen with the identical MID, >>are
these
really
different exchanges, as in separate commands?
[snip]
They have different transact2 subcommands. They really *ARE* separate
operations. Sorry, the SMB dissector will simply *HAVE* to deal with
it, period.
Weird. I have never seen an MS stack do that.
No worries. I will provide a simple patch that will make smb_info handle
this.
(though cases where Request_1, Response_1, Request_2, Response_2 with
identical CMD, MID,PID etc and where Response_1 and Request_2 are missing
from the capture will be "difficult" to handle correctly. )
I will try to test it before I submit the patch by just setting MID etc
to a constant value in one of my captures.
_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp
