Wireshark · Ethereal-users: Re: [Ethereal-users] (no subject)

[Guy Harris <gharris@xxxxxxxxx>]

On Fri, Aug 30, 2002 at 11:47:14AM +0400, Eugene Korolev wrote:
>         Thank you very much for your reply. But I develop my own application
> with NetBIOS low-level packets. I use Ethereal as a tool for analyze
> captured packets. My question is not about using Ethereal as user. I want to
> know technical details about how Ethereal detects NetBIOS Session Message
> packets are unreassambled?

It detects it by

	1) having a mechanism that catches attempts by a dissector to
	   fetch data past the end of a packet;

	2) in some cases, reporting that as an unreassembled packet;

	3) naively assuming that NetBIOS session messages fit entirely
	   within one frame. :-)

(I.e., there's no code specific to the NetBIOS dissector to detect
that.)