Re: [Ethereal-users] Decode as ... SMB

[Guy Harris <guy@xxxxxxxxxxxx>]

j.kuan@xxxxxxxxxxxx wrote:

> I am using ethereal 0.10.13. When I right click on a capture packet
> (in the packet list window) and select 'Decode as ...', I cannot find
> the option SMB (or CIFS). Is there any reason why?

Because those options only apply to TCP and UDP, and SMB doesn't run 
directly over TCP, it either runs atop the NetBIOS Session Service or 
atop the SMB-over-TCP layer.

> I am sure the packet is in SMB format as it contains 0xFF"SMB".

What protocol is SMB running atop?  There are heuristic tests for SMB in 
NetBIOS-over-TCP and NetBEUI.

If it's running over NetBIOS-over-TCP's Session Service, or atop the 
SMB-over-TCP layer, is the 0xFF"SMB" at the beginning of the TCP segment?