Wireshark · Ethereal-dev: Re: [Ethereal-dev] SMB NetServerEnum2 RAP response incorrect bytes

[Guy Harris <gharris@xxxxxxxxx>]

On Tue, Jul 06, 2004 at 06:22:55AM +0200, Aaron Carlson wrote:
> Ethereal (v 0.10.3 and 0.10.4) is highlighting the incorrect bytes for the
> 'Server Type' field within the Server_Info_1 structures in the
> NetServerEnum2 RAP response.  I just checked and it is also highlighting
> incorrect bytes for browser protocol decodes (host/master announcements).
> 
> In the "Packet Details" pane the 'Server Type' field shows the correct
> values, but in the "Packet Bytes" pane the bytes for the 'Server Comment'
> field are highlighted.  The 'Server Comment' field is a pointer, and the
> actual 4-byte pointer value is highlighted, not the string it points to).

What makes the pointer value any more intrinsically "incorrect" than the
string it points to?

If thee's a "correct" answer, it's "highlight the pointer *and* the
bytes", but we don't currently have any mechanism for specifying that a
field consists of two discontiguous regions of the packet.  I've thought
on occastion that it'd be useful to have such a mechanism for purposes
such as this.