It happens quite frequently that you have multiple NBSS messages in one TCP
segment.
Really.
On station is sending two or more _SMALL_ NBSS messages after each others on
the same TCP session,
all these NBSS messages have the PSH flag set so they are delivered one by
one in their
own unique _SMALL_ TCP segment.
Assume the first small TCP segment is lost by the network.
TCP retransmission kicks in and retransmits (up to) a full segment which
contains the lost segment
as well as as much as can fit from the later segments transmitted.
TCP collapsing small segments to retransmit a full sized segment happens
everytime we have TCP
retranmsissions.
For ONC-RPC it means we can get one TCP segment containing a HUGE number of
GETATTR or
other tiny commands.
----- Original Message -----
From: "Richard Sharpe"
Sent: Tuesday, July 23, 2002 7:31 AM
Subject: Re: [Ethereal-dev] COL_INFO for andX commands
> On Mon, 22 Jul 2002, Guy Harris wrote:
>
> > On Tue, Jul 23, 2002 at 05:54:30AM +1000, Ronnie Sahlberg wrote:
> > > The same problem also exists in the ONC-RPC dissector.
> >
> > There's no "andX" in ONC RPC (although there are COMPOUND operations in
> > NFSv4); are you referring to having multiple ONC RPC requests or
> > responses in a single TCP segment? If so, that exists for NBSS as well,
> > so if you're concerned about that, there are *two* layers where it can
> > happen for CIFS.
>
> Hmmm, because SMB is a request/response protocol, I cannot think of a case
> where you are going to have two NBSS messages in a TCP segment in
> practice?
>
