I am confused about the nfs packets, please take a look at frame
137,138,139,140.
frame 137 was a NFS Lookup call, request
libuClibc-0.9.28.so(DH=0x0794a104), in frame 138,139,140 wireshark
print the FH as 0x0794a104(same with the DH).
I have tested the same pcap file in 0.99.5 on RHEL5, and it works
correctly(maybe not, at least it shows a different FH value to DH).
BTW: for the same frame 137:
DH value was 0x1bfc5524 in 0.99.5 on RHEL5
DH value was 0x0794a104 in 0.99.6.a on Windows.
both of the versions shows the 'dir/hash' value(copy bytes(hex offset)) :
0000 01 00 00 01 00 fd 00 00 e5 9a 62 00 e7 9a 62 00
0010 04 69 a6 91 00 00 00 00 00 00 00 00 00 00 00 00
Attachment:
test2.pcap
Description: Binary data
