Wireshark · Ethereal-dev: Re: [Ethereal-dev] DCE-RPC Return Code dissecting

[Jaime Fournier <jafour1@xxxxxxxxx>]

Here is the updated version of packet-dcerpc-dce122.c

--- "Chuck L. Peterson" <clp@xxxxxxxxxx> wrote:
> Here's some info on DCE-RPC error codes. I'm not
> familiar with
> ethereal or samba DCE, so it will be a while before
> I'm able to come
> up with source changes for this.
> 
> The defines below from rpcsts.h seem to be the
> DCE/RPC Endpoint Mapper
> error code values.
> 
> Talking to W2K, my packet gets back the error code
> 0x16c9a0d6, which
> is DCE-rpc-0214 using the decoding instructions
> below. I can find no
> lookup code for 0214 anywhere.
> 
> Here's a description of the error code encoding
> from:
>  
>
http://lost-contact.mit.edu/afs/net/project/afs32/transarc/public/hbalish/html/trouble.html
> 
> > The first hex digit is 1 for DCE, 2 for DFS, and 3
> for Encina The next
> > four hex digits are a quasi-base-40 encoding of
> the component name.
> > For example, in "rpc", "r" is the 18th letter of
> the alphabet, "p" is
> > the 16th letter, and "c" is the third. Do this
> calculation:
> >
> > (18 - 1) * 40 * 40 + (16 - 1) * 40 + (3 - 1) =
> 0x6c9a
> >
> > Finally, the last 3 hex digits are a translation
> of the terminal error
> > number. In "DCE-rpc-0022", decimal 0022 is hex
> 016. So, "DCE-rpc-0022"
> > is hex 0x16c9a016.
> 
> 0x16c9a0d6 is 382312662, defined as
> ept_s_not_registered below. That's
> definitely the correct error in my case.
> 
> #define rpc_s_mod 382312448
> #define rpc_s_op_rng_error 382312449
> #define rpc_s_cant_create_sock 382312450
> #define rpc_s_cant_bind_sock 382312451
> #define rpc_s_not_in_call 382312452
> #define rpc_s_no_port 382312453
> #define rpc_s_wrong_boot_time 382312454
> #define rpc_s_too_many_sockets 382312455
> #define rpc_s_illegal_register 382312456
> #define rpc_s_cant_recv 382312457
> #define rpc_s_bad_pkt 382312458
> #define rpc_s_unbound_handle 382312459
> #define rpc_s_addr_in_use 382312460
> #define rpc_s_in_args_too_big 382312461
> #define rpc_s_string_too_long 382312462
> #define rpc_s_too_many_objects 382312463
> #define rpc_s_binding_has_no_auth 382312464
> #define rpc_s_unknown_authn_service 382312465
> #define rpc_s_no_memory 382312466
> #define rpc_s_cant_nmalloc 382312467
> #define rpc_s_call_faulted 382312468
> #define rpc_s_call_failed 382312469
> #define rpc_s_comm_failure 382312470
> #define rpc_s_rpcd_comm_failure 382312471
> #define rpc_s_illegal_family_rebind 382312472
> #define rpc_s_invalid_handle 382312473
> #define rpc_s_coding_error 382312474
> #define rpc_s_object_not_found 382312475
> #define rpc_s_cthread_not_found 382312476
> #define rpc_s_invalid_binding 382312477
> #define rpc_s_already_registered 382312478
> #define rpc_s_endpoint_not_found 382312479
> #define rpc_s_invalid_rpc_protseq 382312480
> #define rpc_s_desc_not_registered 382312481
> #define rpc_s_already_listening 382312482
> #define rpc_s_no_protseqs 382312483
> #define rpc_s_no_protseqs_registered 382312484
> #define rpc_s_no_bindings 382312485
> #define rpc_s_max_descs_exceeded 382312486
> #define rpc_s_no_interfaces 382312487
> #define rpc_s_invalid_timeout 382312488
> #define rpc_s_cant_inq_socket 382312489
> #define rpc_s_invalid_naf_id 382312490
> #define rpc_s_inval_net_addr 382312491
> #define rpc_s_unknown_if 382312492
> #define rpc_s_unsupported_type 382312493
> #define rpc_s_invalid_call_opt 382312494
> #define rpc_s_no_fault 382312495
> #define rpc_s_cancel_timeout 382312496
> #define rpc_s_call_cancelled 382312497
> #define rpc_s_invalid_call_handle 382312498
> #define rpc_s_cannot_alloc_assoc 382312499
> #define rpc_s_cannot_connect 382312500
> #define rpc_s_connection_aborted 382312501
> #define rpc_s_connection_closed 382312502
> #define rpc_s_cannot_accept 382312503
> #define rpc_s_assoc_grp_not_found 382312504
> #define rpc_s_stub_interface_error 382312505
> #define rpc_s_invalid_object 382312506
> #define rpc_s_invalid_type 382312507
> #define rpc_s_invalid_if_opnum 382312508
> #define rpc_s_different_server_instance 382312509
> #define rpc_s_protocol_error 382312510
> #define rpc_s_cant_recvmsg 382312511
> #define rpc_s_invalid_string_binding 382312512
> #define rpc_s_connect_timed_out 382312513
> #define rpc_s_connect_rejected 382312514
> #define rpc_s_network_unreachable 382312515
> #define rpc_s_connect_no_resources 382312516
> #define rpc_s_rem_network_shutdown 382312517
> #define rpc_s_too_many_rem_connects 382312518
> #define rpc_s_no_rem_endpoint 382312519
> #define rpc_s_rem_host_down 382312520
> #define rpc_s_host_unreachable 382312521
> #define rpc_s_access_control_info_inv 382312522
> #define rpc_s_loc_connect_aborted 382312523
> #define rpc_s_connect_closed_by_rem 382312524
> #define rpc_s_rem_host_crashed 382312525
> #define rpc_s_invalid_endpoint_format 382312526
> #define rpc_s_unknown_status_code 382312527
> #define rpc_s_unknown_mgr_type 382312528
> #define rpc_s_assoc_creation_failed 382312529
> #define rpc_s_assoc_grp_max_exceeded 382312530
> #define rpc_s_assoc_grp_alloc_failed 382312531
> #define rpc_s_sm_invalid_state 382312532
> #define rpc_s_assoc_req_rejected 382312533
> #define rpc_s_assoc_shutdown 382312534
> #define rpc_s_tsyntaxes_unsupported 382312535
> #define rpc_s_context_id_not_found 382312536
> #define rpc_s_cant_listen_sock 382312537
> #define rpc_s_no_addrs 382312538
> #define rpc_s_cant_getpeername 382312539
> #define rpc_s_cant_get_if_id 382312540
> #define rpc_s_protseq_not_supported 382312541
> #define rpc_s_call_orphaned 382312542
> #define rpc_s_who_are_you_failed 382312543
> #define rpc_s_unknown_reject 382312544
> #define rpc_s_type_already_registered 382312545
> #define rpc_s_stop_listening_disabled 382312546
> #define rpc_s_invalid_arg 382312547
> #define rpc_s_not_supported 382312548
> #define rpc_s_wrong_kind_of_binding 382312549
> #define rpc_s_authn_authz_mismatch 382312550
> #define rpc_s_call_queued 382312551
> #define rpc_s_cannot_set_nodelay 382312552
> #define rpc_s_not_rpc_tower 382312553
> #define rpc_s_invalid_rpc_protid 382312554
> #define rpc_s_invalid_rpc_floor 382312555
> #define rpc_s_call_timeout 382312556
> #define rpc_s_mgmt_op_disallowed 382312557
> #define rpc_s_manager_not_entered 382312558
> #define rpc_s_calls_too_large_for_wk_ep 382312559
> #define rpc_s_server_too_busy 382312560
> #define rpc_s_prot_version_mismatch 382312561
> #define rpc_s_rpc_prot_version_mismatch 382312562
> #define rpc_s_ss_no_import_cursor 382312563
> #define rpc_s_fault_addr_error 382312564
> #define rpc_s_fault_context_mismatch 382312565
> #define rpc_s_fault_fp_div_by_zero 382312566
> #define rpc_s_fault_fp_error 382312567
> #define rpc_s_fault_fp_overflow 382312568
> #define rpc_s_fault_fp_underflow 382312569
> #define rpc_s_fault_ill_inst 382312570
> #define rpc_s_fault_int_div_by_zero 382312571
> #define rpc_s_fault_int_overflow 382312572
> #define rpc_s_fault_invalid_bound 382312573
> #define rpc_s_fault_invalid_tag 382312574
> #define rpc_s_fault_pipe_closed 382312575
> #define rpc_s_fault_pipe_comm_error 382312576
> #define rpc_s_fault_pipe_discipline 382312577
> #define rpc_s_fault_pipe_empty 382312578
> #define rpc_s_fault_pipe_memory 382312579
> #define rpc_s_fault_pipe_order 382312580
> #define rpc_s_fault_remote_comm_failure 382312581
> #define rpc_s_fault_remote_no_memory 382312582
> #define rpc_s_fault_unspec 382312583
> #define uuid_s_bad_version 382312584
> #define uuid_s_socket_failure 382312585
> #define uuid_s_getconf_failure 382312586
> #define uuid_s_no_address 382312587
> #define uuid_s_overrun 382312588
> #define uuid_s_internal_error 382312589
> #define uuid_s_coding_error 382312590
> #define uuid_s_invalid_string_uuid 382312591
> #define uuid_s_no_memory 382312592
> #define rpc_s_no_more_entries 382312593
> #define rpc_s_unknown_ns_error 382312594
> #define rpc_s_name_service_unavailable 382312595
> #define rpc_s_incomplete_name 382312596
> #define rpc_s_group_not_found 382312597
> #define rpc_s_invalid_name_syntax 382312598
> #define rpc_s_no_more_members 382312599
> #define rpc_s_no_more_interfaces 382312600
> #define rpc_s_invalid_name_service 382312601
> #define rpc_s_no_name_mapping 382312602
> #define rpc_s_profile_not_found 382312603
> #define rpc_s_not_found 382312604
> #define rpc_s_no_updates 382312605
> 
=== message truncated ===



=====
Jaime Fournier

__________________________________________________
Do you Yahoo!?
New DSL Internet Access from SBC & Yahoo!
http://sbc.yahoo.com

Attachment: packet-dcerpc-dce122.c.gz
Description: packet-dcerpc-dce122.c.gz