ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: [Wireshark-dev] This corrects an error with respect to SMB_INFO_QUERY_EAS_FROM_L

From: Richard Sharpe <realrichardsharpe@xxxxxxxxx>
Date: Sat, 6 Oct 2012 21:13:01 -0700
Hi folks,

Attached is a patch that corrects an error in the dissection of
SMB_INFO_QUERY_EAS_FROM_LIST.

According to MS-CIFS 2.2.8.1.3 it is not the same as
INFO_QUERY_EA_SIZE as there is an actual list of EAs there after the
EA Size field.

Attached is the patch formatted in the traditional style (without
handling truncated frames) and not yet dissecting the EAs.

Another problem is that I have never seen a capture with such SMBs. I
would have to write some code in Windows to generate some frames.

-- 
Regards,
Richard Sharpe
(何以解憂?唯有杜康。--曹操)

Attachment: packet-smb-list-eas.c.patch
Description: Binary data