ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-bugs: [Wireshark-bugs] [Bug 5891] Some SMB requests are not decoded when "Validate the

Date: Wed, 4 May 2011 15:14:58 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5891

Sake <sake@xxxxxxxxxx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |INVALID

--- Comment #4 from Sake <sake@xxxxxxxxxx> 2011-05-04 15:14:58 PDT ---
This is works-as-designed. When checksums are checked and a bad checksum is
found, Wireshark will not do reassembly (as it can't be sure of the correctness
of the data in the packet).

And your SMB PDU is segmented into two packets, so it needs reassembly.

As bad checksums are mostly caused by TCP checksum offloading to the NIC, the
default for Wireshark is to not check the TCP checksums and do reassembly
anyways.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.