Wireshark · Ethereal-users: Re: [Ethereal-users] How to capture the NetBIOS data over 802.2 network

["Martin Regner" <martin.regner@xxxxxxxxx>]

Bassam A. Al-Khaffaf wrote:

<I am developing a special gateway project (Linux box based).

<During my developing I got stuck on how to capture the data of the

<NetBIOS frame (NetBEUI). In fact I tried to use the tcpdump, but the

<problem here that tcpdump captures only the headers and not the

<payload (the data), so I wonder if there any program that able to

<capture the 16 byte source name field (Name to add) when the

<NetBIOS frame (NB) command is  “ADD_NAME_QUERY (0x01)”

 

By default tcpdump uses a snapshot length of 68 bytes, I think.

 

You can set another snapshot len with the -s option.

 

With the recent versions it is possible to use 0 as snapshot length (-s 0) to capture

the complete packets, but you can try with e.g. "-s 65635" if that is not working.