Re: Decode as ... SMB

Guy Harris <[email protected]>
Newsgroups gmane.network.ethereal.user
Message-ID <[email protected]> 
[email protected] wrote:

> I am using ethereal 0.10.13. When I right click on a capture packet
> (in the packet list window) and select 'Decode as ...', I cannot find
> the option SMB (or CIFS). Is there any reason why?

Because those options only apply to TCP and UDP, and SMB doesn't run 
directly over TCP, it either runs atop the NetBIOS Session Service or 
atop the SMB-over-TCP layer.

> I am sure the packet is in SMB format as it contains 0xFF"SMB".

What protocol is SMB running atop?  There are heuristic tests for SMB in 
NetBIOS-over-TCP and NetBEUI.

If it's running over NetBIOS-over-TCP's Session Service, or atop the 
SMB-over-TCP layer, is the 0xFF"SMB" at the beginning of the TCP segment?
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.