Ethereal-dev: Re: [Ethereal-dev] a few things for dcerpc

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Mon, 19 Nov 2001 01:12:19 -0800
On Mon, Nov 19, 2001 at 06:55:28PM +1100, Ronnie Sahlberg wrote:
> I think of the case where we have
> TCP  -> NBSS -> SMB -> DCERPC
> TCP sets can_desegment, but this will be wrong when we hit the DCERPC layer.

The connection-oriented DCE RPC dissector should *NOT* be doing anything
whatsoever with "pinfo->can_desegment", "pinfo->desegment_offset", or
"pinfo->desegment_len" unless it has been *directly* called by the TCP
dissector.

It should not, for example, be doing so if called from the SMB
dissector.

(In addition, the DCE RPC dissector, when called from the TCP dissector,
should be prepared for more than one DCE RPC PDU to be present in the
TCP segment handed to it.

I don't know how DCE RPC treats record-oriented connection-oriented
transport protocols - does it treat them as byte streams, so that more
than one DCE RPC PDU can be present in a transport PDU, and so that a
DCE RPC PDU needn't start at the beginning of a transport PDU?)