Wireshark · Ethereal-dev: Re: [Ethereal-dev] DCE-RPC Return Code dissecting

[Jaime Fournier <jafour1@xxxxxxxxx>]

Take a look at packet-dcerpc-dce122.c
I have an update for this to include many DFS specific
errors.
These apply to OSF DCE.
You might want to check them over, and see if they
correlate.

Let me know.

Thanks.
--- "Chuck L. Peterson" <clp@xxxxxxxxxx> wrote:
> Here's some info on DCE-RPC error codes. I'm not
> familiar with
> ethereal or samba DCE, so it will be a while before
> I'm able to come
> up with source changes for this.
> 
> The defines below from rpcsts.h seem to be the
> DCE/RPC Endpoint Mapper
> error code values.
> 
> Talking to W2K, my packet gets back the error code
> 0x16c9a0d6, which
> is DCE-rpc-0214 using the decoding instructions
> below. I can find no
> lookup code for 0214 anywhere.
> 
> Here's a description of the error code encoding
> from:
>  
>
http://lost-contact.mit.edu/afs/net/project/afs32/transarc/public/hbalish/html/trouble.html
> 
> > The first hex digit is 1 for DCE, 2 for DFS, and 3
> for Encina The next
> > four hex digits are a quasi-base-40 encoding of
> the component name.
> > For example, in "rpc", "r" is the 18th letter of
> the alphabet, "p" is
> > the 16th letter, and "c" is the third. Do this
> calculation:
> >
> > (18 - 1) * 40 * 40 + (16 - 1) * 40 + (3 - 1) =
> 0x6c9a
> >
> > Finally, the last 3 hex digits are a translation
> of the terminal error
> > number. In "DCE-rpc-0022", decimal 0022 is hex
> 016. So, "DCE-rpc-0022"
> > is hex 0x16c9a016.
> 
> 0x16c9a0d6 is 382312662, defined as
> ept_s_not_registered below. That's
> definitely the correct error in my case.
> 
> #define rpc_s_mod 382312448
> #define rpc_s_op_rng_error 382312449
> #define rpc_s_cant_create_sock 382312450
> #define rpc_s_cant_bind_sock 382312451
> #define rpc_s_not_in_call 382312452
> #define rpc_s_no_port 382312453
> #define rpc_s_wrong_boot_time 382312454
> #define rpc_s_too_many_sockets 382312455
> #define rpc_s_illegal_register 382312456
> #define rpc_s_cant_recv 382312457
> #define rpc_s_bad_pkt 382312458
> #define rpc_s_unbound_handle 382312459
> #define rpc_s_addr_in_use 382312460
> #define rpc_s_in_args_too_big 382312461
> #define rpc_s_string_too_long 382312462
> #define rpc_s_too_many_objects 382312463
> #define rpc_s_binding_has_no_auth 382312464
> #define rpc_s_unknown_authn_service 382312465
> #define rpc_s_no_memory 382312466
> #define rpc_s_cant_nmalloc 382312467
> #define rpc_s_call_faulted 382312468
> #define rpc_s_call_failed 382312469
> #define rpc_s_comm_failure 382312470
> #define rpc_s_rpcd_comm_failure 382312471
> #define rpc_s_illegal_family_rebind 382312472
> #define rpc_s_invalid_handle 382312473
> #define rpc_s_coding_error 382312474
> #define rpc_s_object_not_found 382312475
> #define rpc_s_cthread_not_found 382312476
> #define rpc_s_invalid_binding 382312477
> #define rpc_s_already_registered 382312478
> #define rpc_s_endpoint_not_found 382312479
> #define rpc_s_invalid_rpc_protseq 382312480
> #define rpc_s_desc_not_registered 382312481
> #define rpc_s_already_listening 382312482
> #define rpc_s_no_protseqs 382312483
> #define rpc_s_no_protseqs_registered 382312484
> #define rpc_s_no_bindings 382312485
> #define rpc_s_max_descs_exceeded 382312486
> #define rpc_s_no_interfaces 382312487
> #define rpc_s_invalid_timeout 382312488
> #define rpc_s_cant_inq_socket 382312489
> #define rpc_s_invalid_naf_id 382312490
> #define rpc_s_inval_net_addr 382312491
> #define rpc_s_unknown_if 382312492
> #define rpc_s_unsupported_type 382312493
> #define rpc_s_invalid_call_opt 382312494
> #define rpc_s_no_fault 382312495
> #define rpc_s_cancel_timeout 382312496
> #define rpc_s_call_cancelled 382312497
> #define rpc_s_invalid_call_handle 382312498
> #define rpc_s_cannot_alloc_assoc 382312499
> #define rpc_s_cannot_connect 382312500
> #define rpc_s_connection_aborted 382312501
> #define rpc_s_connection_closed 382312502
> #define rpc_s_cannot_accept 382312503
> #define rpc_s_assoc_grp_not_found 382312504
> #define rpc_s_stub_interface_error 382312505
> #define rpc_s_invalid_object 382312506
> #define rpc_s_invalid_type 382312507
> #define rpc_s_invalid_if_opnum 382312508
> #define rpc_s_different_server_instance 382312509
> #define rpc_s_protocol_error 382312510
> #define rpc_s_cant_recvmsg 382312511
> #define rpc_s_invalid_string_binding 382312512
> #define rpc_s_connect_timed_out 382312513
> #define rpc_s_connect_rejected 382312514
> #define rpc_s_network_unreachable 382312515
> #define rpc_s_connect_no_resources 382312516
> #define rpc_s_rem_network_shutdown 382312517
> #define rpc_s_too_many_rem_connects 382312518
> #define rpc_s_no_rem_endpoint 382312519
> #define rpc_s_rem_host_down 382312520
> #define rpc_s_host_unreachable 382312521
> #define rpc_s_access_control_info_inv 382312522
> #define rpc_s_loc_connect_aborted 382312523
> #define rpc_s_connect_closed_by_rem 382312524
> #define rpc_s_rem_host_crashed 382312525
> #define rpc_s_invalid_endpoint_format 382312526
> #define rpc_s_unknown_status_code 382312527
> #define rpc_s_unknown_mgr_type 382312528
> #define rpc_s_assoc_creation_failed 382312529
> #define rpc_s_assoc_grp_max_exceeded 382312530
> #define rpc_s_assoc_grp_alloc_failed 382312531
> #define rpc_s_sm_invalid_state 382312532
> #define rpc_s_assoc_req_rejected 382312533
> #define rpc_s_assoc_shutdown 382312534
> #define rpc_s_tsyntaxes_unsupported 382312535
> #define rpc_s_context_id_not_found 382312536
> #define rpc_s_cant_listen_sock 382312537
> #define rpc_s_no_addrs 382312538
> #define rpc_s_cant_getpeername 382312539
> #define rpc_s_cant_get_if_id 382312540
> #define rpc_s_protseq_not_supported 382312541
> #define rpc_s_call_orphaned 382312542
> #define rpc_s_who_are_you_failed 382312543
> #define rpc_s_unknown_reject 382312544
> #define rpc_s_type_already_registered 382312545
> #define rpc_s_stop_listening_disabled 382312546
> #define rpc_s_invalid_arg 382312547
> #define rpc_s_not_supported 382312548
> #define rpc_s_wrong_kind_of_binding 382312549
> #define rpc_s_authn_authz_mismatch 382312550
> #define rpc_s_call_queued 382312551
> #define rpc_s_cannot_set_nodelay 382312552
> #define rpc_s_not_rpc_tower 382312553
> #define rpc_s_invalid_rpc_protid 382312554
> #define rpc_s_invalid_rpc_floor 382312555
> #define rpc_s_call_timeout 382312556
> #define rpc_s_mgmt_op_disallowed 382312557
> #define rpc_s_manager_not_entered 382312558
> #define rpc_s_calls_too_large_for_wk_ep 382312559
> #define rpc_s_server_too_busy 382312560
> #define rpc_s_prot_version_mismatch 382312561
> #define rpc_s_rpc_prot_version_mismatch 382312562
> #define rpc_s_ss_no_import_cursor 382312563
> #define rpc_s_fault_addr_error 382312564
> #define rpc_s_fault_context_mismatch 382312565
> #define rpc_s_fault_fp_div_by_zero 382312566
> #define rpc_s_fault_fp_error 382312567
> #define rpc_s_fault_fp_overflow 382312568
> #define rpc_s_fault_fp_underflow 382312569
> #define rpc_s_fault_ill_inst 382312570
> #define rpc_s_fault_int_div_by_zero 382312571
> #define rpc_s_fault_int_overflow 382312572
> #define rpc_s_fault_invalid_bound 382312573
> #define rpc_s_fault_invalid_tag 382312574
> #define rpc_s_fault_pipe_closed 382312575
> #define rpc_s_fault_pipe_comm_error 382312576
> #define rpc_s_fault_pipe_discipline 382312577
> #define rpc_s_fault_pipe_empty 382312578
> #define rpc_s_fault_pipe_memory 382312579
> #define rpc_s_fault_pipe_order 382312580
> #define rpc_s_fault_remote_comm_failure 382312581
> #define rpc_s_fault_remote_no_memory 382312582
> #define rpc_s_fault_unspec 382312583
> #define uuid_s_bad_version 382312584
> #define uuid_s_socket_failure 382312585
> #define uuid_s_getconf_failure 382312586
> #define uuid_s_no_address 382312587
> #define uuid_s_overrun 382312588
> #define uuid_s_internal_error 382312589
> #define uuid_s_coding_error 382312590
> #define uuid_s_invalid_string_uuid 382312591
> #define uuid_s_no_memory 382312592
> #define rpc_s_no_more_entries 382312593
> #define rpc_s_unknown_ns_error 382312594
> #define rpc_s_name_service_unavailable 382312595
> #define rpc_s_incomplete_name 382312596
> #define rpc_s_group_not_found 382312597
> #define rpc_s_invalid_name_syntax 382312598
> #define rpc_s_no_more_members 382312599
> #define rpc_s_no_more_interfaces 382312600
> #define rpc_s_invalid_name_service 382312601
> #define rpc_s_no_name_mapping 382312602
> #define rpc_s_profile_not_found 382312603
> #define rpc_s_not_found 382312604
> #define rpc_s_no_updates 382312605
> 
=== message truncated ===


=====
Jaime Fournier

__________________________________________________
Do you Yahoo!?
New DSL Internet Access from SBC & Yahoo!
http://sbc.yahoo.com