Wireshark-bugs: [Wireshark-bugs] [Bug 5891] Some SMB requests are not decoded when "Validate the
Date: Wed, 4 May 2011 15:14:58 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5891

Sake <[email protected]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |INVALID

--- Comment #4 from Sake <[email protected]> 2011-05-04 15:14:58 PDT ---
This is works-as-designed. When checksums are checked and a bad checksum is
found, Wireshark will not do reassembly (as it can't be sure of the correctness
of the data in the packet).

And your SMB PDU is segmented into two packets, so it needs reassembly.

As bad checksums are mostly caused by TCP checksum offloading to the NIC, the
default for Wireshark is to not check the TCP checksums and do reassembly
anyways.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.