Ethereal-users: Re: [Ethereal-users] (no subject)

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Fri, 30 Aug 2002 11:24:03 -0700
On Fri, Aug 30, 2002 at 03:25:14PM +0400, Eugene Korolev wrote:
> My application reads Netbios header and builds a full netbios packet from
> fragmented parts. However NBSS Continual packet is not included into the
> Netbios Session Messages packet. I attached a file dump for ethereal to the
> email. Please see frames 22,23,24. Netbios packet at the 22nd frame consists
> of the single part according to the lebgth indicated in its header,

Actually, when I run Ethereal on it, the header is displayed for frame
24, not frame 22.

That's because I have TCP desegmentation enabled.

The length in the header is 2920 bytes, which means that frame 22, which
has a total of 1514 bytes - which includes the Ethernet header (14
bytes), IP header (20 bytes), and the TCP header (20 bytes) - cannot
possibly be the entire NetBIOS Session Service session message packet.

And, in fact, it isn't; if you enable TCP desegmentation (as I did in my
Ethereal settings, and as I recommended you do in my previous message),
Ethereal shows frames 22 and 23 as "Desegmented TCP" and frame 24 as an
SMB Transaction Response (as it's the last frame of said response).