Ethereal-users: RE: [ethereal-users] Bad NETBIOS Packets

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Guy Scharf" <guy@xxxxxxxxx>
Date: Mon, 23 Aug 1999 08:09:50 -0700
Jeff,

> I suspect that if you check the first bad packet the LLC Control
> field func
> value will be SABME. If this is true the packet are caused by the two
> network stations creating a connection at the LLC level (Data Link
> Switching).  The packets are seen as NETBIOS by the LLC dissector because
> the DSAP is 0xf0.  The dissect_netbios code could be improved to check the
> LLC control field value and ignore packets that should not be
> passed to it.

That is correct -- the LLC control field func value is SABME.

Guy