Wireshark · Ethereal-users: Re: [Ethereal-users] (no subject)

[Guy Harris <gharris@xxxxxxxxx>]

On Fri, Aug 30, 2002 at 02:25:46AM -0700, Guy Harris wrote:
> (I.e., there's no code specific to the NetBIOS dissector to detect
> that.)

...except that the "NetBIOS" dissector, in the sense of the NetBIOS
frame protocol dissector, isn't what's being used here; this
is NetBIOS-over-TCP.

The answer is similar in this case, except that 3) is

	3) not having TCP desegmentation enabled.

If you enable TCP desegmentation by selecting the "Preferences" item
from the "Edit" menu, opening the "Protocols" item on the left-hand side
of the dialog box, selecting "TCP", turning "Allow subdissector to
desegment TCP streams", and clicking "OK", the session message packets
should be reassembled for you by Ethereal.

If you want to do that in *your* application, you need to write code to
read the NetBIOS-over-TCP session service header (and don't assume that
you will get all of the data in the header in one read call; TCP doesn't
guarantee that), extract the message length from the header, and then
read that many bytes (again, don't assume you'll get all that data in
one read call).