Re: [Ethereal-dev] Reassembly of security blob in SMB dissector

[Guy Harris <guy@xxxxxxxxxx>]

On Mon, Feb 03, 2003 at 11:51:28AM +0100, Jean-Baptiste Marchand wrote:
> Because of the token size, the SessionSetupAndX request is carried over
> two NBSS messages.

No, it's entirely inside one NBSS message.

However, the NBSS message is carried inside two TCP segments, so you
have to enable TCP reassembly; it's the "Allow subdissector to desegment
TCP streams" option for the TCP protocol.

> Looking at the SMB dissector options, it seems that fragmentation
> reassembly is currently possible for DCE/RPC PDU (carried over SMB
> named pipes) and SMB Transact payload command. Does security blob
> reassembly would fit in the same category?

No, it wouldn't, because security blobs don't have their own form of
fragmentation - they're not fragmented over SMB messages, and SMB
messages aren't fragmented over NBSS messages, so the stuff that already
exists to reassemble NBSS messages is sufficient.