Ethereal-dev: Re: [Ethereal-dev] nfs : patch to snoop fhandle to filenames

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Dr. Uwe Girlich" <Uwe.Girlich@xxxxxxxxxxx>
Date: Mon, 14 Jan 2002 10:56:17 +0100
Hello!

On Sat, Jan 12, 2002 at 11:02:55AM +1100, Ronnie Sahlberg wrote:
> attached is a new patch for nfs name snooping, it fixes the bug where the '/'
> separating path components were sometimes missing.

> the patch snoops certain nfs and mount packets to track the fhandle to
> filename mapping.
"certain" is the important word here. It works fairly good (SYMLINK is
missing) with NFSv3 but I could not get it to work with nfsv2.pcap.gz from the
web-site. Mount version 1 is missing (that is easy to add) but somehow all the
NFSv2 LOOKUP replies don't result in a file name (packets 23+24). But there
is already a LOOKUP check in the dissect_fhandle() code. Really strange!

Bye, Uwe