Wireshark · Ethereal-users: [Ethereal-users] (no subject)

["Eugene Korolev" <korolev@xxxxxxxxxxx>]

Hi, All!

        I write an application that uses low-level NetBIOS packets. When I
send NetBIOS Session Message Packet Request (NBS request), I receive NetBIOS
Session Message Packet Response (NBS response). The NBS response consists of
several parts (the first response packet + NBS Continual Message Packets).
It seems that Ethereal detects all NBS packets correctly. What is a method
to detect the total amount of NBS Continual Message Packets or the total
size (in bytes) of these packets?

NetBIOS Session Service
    Message Type: Session message
    Flags: 0x00
    Length: 2920
SMB (Server Message Block Protocol)
    SMB Header
        Server Component: SMB
        Response to: 20
        Time from request: 0.452407000 seconds
        SMB Command: Transaction (0x25)
        Error Class: Success (0x00)
        Reserved: 00
        Error Code: No Error
        Flags: 0x98
        Flags2: 0x0003
        Reserved: 000000000000000000000000
        Tree ID: 36866
        Process ID: 1300
        User ID: 61441
        Multiplex ID: 0
    Transaction Response (0x25)
        Word Count (WCT): 10
        Total Parameter Count: 12
        Total Data Count: 6560
        Reserved: 0000
        Parameter Count: 12
        Parameter Offset: 56
        Parameter Displacement: 0
        Data Count: 2852
        Data Offset: 68
        Data Displacement: 0
        Setup Count: 0
        Reserved: 00
        Byte Count (BCC): 2865
        Padding: 00
SMB Pipe Protocol
Microsoft Windows Lanman Remote API Protocol
    Function Code: NetUserEnum2 (131)
    Status: Success (0)
    Convert: 58944
    Doubleword Param: 724647 (0x000B0EA7)
    Entry Count: 83
    Word Param: 83 (0x0053)
    Entries
.....................
[Unreassembled Packet: LANMAN]

 Eugene Korolev.