Wireshark-bugs: [Wireshark-bugs] [Bug 8164] SMB2: Command having variable buffer Structure Lengt
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Fri, 04 Jan 2013 16:28:32 +0000

Comment # 4 on bug 8164 from 
The current dissector code assumes that the least significant bit of the buffer
code contains a flag indicating whether there is a dynamic content of not (as
seen here: http://wiki.wireshark.org/SMB2/BufferCode).
This does not match Microsoft documentation found in
http://msdn.microsoft.com/en-us/library/cc246482.aspx that defines those two
bytes as structureSize field that just contain a size without any flag.
When looking at MS documentation, it looks like the assumption of a flag in the
LSB is correct (only messages with dynamic content have it set). For example a
Session Setup Response message has a 8 bytes long fixed length + a variable
size for the dynamic content.
On the other hand it could make sense to change the decoding to match MS
documentation and display the 2 bytes as a length.
I do not have a strong opinion. Can anyone one knowing / using SMB2 suggest
what is the preferred display?

You are receiving this mail because:
  • You are watching all bug changes.