Hi, All!
I write an application that uses low-level NetBIOS packets. When I
send NetBIOS Session Message Packet Request (NBS request), I receive NetBIOS
Session Message Packet Response (NBS response). The NBS response consists of
several parts (the first response packet + NBS Continual Message Packets).
It seems that Ethereal detects all NBS packets correctly. What is a method
to detect the total amount of NBS Continual Message Packets or the total
size (in bytes) of these packets?
NetBIOS Session Service
Message Type: Session message
Flags: 0x00
Length: 2920
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response to: 20
Time from request: 0.452407000 seconds
SMB Command: Transaction (0x25)
Error Class: Success (0x00)
Reserved: 00
Error Code: No Error
Flags: 0x98
Flags2: 0x0003
Reserved: 000000000000000000000000
Tree ID: 36866
Process ID: 1300
User ID: 61441
Multiplex ID: 0
Transaction Response (0x25)
Word Count (WCT): 10
Total Parameter Count: 12
Total Data Count: 6560
Reserved: 0000
Parameter Count: 12
Parameter Offset: 56
Parameter Displacement: 0
Data Count: 2852
Data Offset: 68
Data Displacement: 0
Setup Count: 0
Reserved: 00
Byte Count (BCC): 2865
Padding: 00
SMB Pipe Protocol
Microsoft Windows Lanman Remote API Protocol
Function Code: NetUserEnum2 (131)
Status: Success (0)
Convert: 58944
Doubleword Param: 724647 (0x000B0EA7)
Entry Count: 83
Word Param: 83 (0x0053)
Entries
.....................
[Unreassembled Packet: LANMAN]
Eugene Korolev.
