Wireshark · Ethereal-dev: [Ethereal-dev] UNICODE and EMC Filers ...

[Richard Sharpe <rsharpe@xxxxxxxxxxxxxxxxx>]

Hi,

I have seen an SMB/CIFS capture from an EMC filer with some interesting 
characteristics. The EMC CIFS guy here at Connectathon says that it is a 
configuration issue.

However. What we are seeing is in a NegProt response. LanMan2.1 or better, 
type 17. The Domain and Server name are clearly in UniCode. 

Flags2 says UNICODE is in use, while Capabilities says it is not! Clearly 
one confused filer :-)

I think we should change dissect_negprot_reply to look at the flags2 field 
rather than the capabilities field, or in addition to the capabilities 
field.

However, it might be that there are other equally confused filers out 
there that get it the other way around.
 
Regards
-----
Richard Sharpe, rsharpe[at]ns.aus.com, rsharpe[at]samba.org, 
sharpe[at]ethereal.com, http://www.richardsharpe.com