Wireshark · Ethereal-dev: Re: [Ethereal-dev] Re: Info on MS CLDAP wanted ...

["Guy Harris" <gharris@xxxxxxxxx>]

ronnie sahlberg wrote:
> In particular, the ntVer as part of the filter for the netlogon rpc is
> not a string

At least as I read RFC 2251, AttributeValues in LDAP filters aren't
necessarily text strings; the type is OCTET STRING.  As I remember, I've
seen what appear to be GUIDs as LDAP attributes, and they're represented
in binary, not text.

RFC 2252 has a language for describing the syntax of attributes, and
OpenLDAP has a bunch of files describing attribute syntaxes.  Should the
LDAP dissector read files of that sort and use them to figure out how to
display attribute values?  It says they should, wherever possible, be
text, but says it shouldn't be assumed that they are:

   The encoding rules defined for a given attribute syntax must produce
   octet strings.  To the greatest extent possible, encoded octet
   strings should be usable in their native encoded form for display
   purposes. In particular, encoding rules for attribute syntaxes
   defining non-binary values should produce strings that can be
   displayed with little or no translation by clients implementing LDAP.
   There are a few cases (e.g. audio) however, when it is not sensible
   to produce a printable representation, and clients MUST NOT assume
   that an unrecognized syntax is a string representation.

(If we're *really* ambitious, we could perhaps register the values of
particular attributes, as read from those files, as named fields.)