aboutsummaryrefslogtreecommitdiffstats
path: root/packet-smb-pipe.h
diff options
context:
space:
mode:
authorRonnie Sahlberg <ronnie_sahlberg@ozemail.com.au>2002-03-16 04:39:29 +0000
committerRonnie Sahlberg <ronnie_sahlberg@ozemail.com.au>2002-03-16 04:39:29 +0000
commit17392c995b3584143c4cbc389c2bae09dc4cc968 (patch)
treeafddbd9bdbbdfd3178e993f64e8940f07c7f0000 /packet-smb-pipe.h
parent54fa1d944ae5a5d78512f2caf5a3086fd41cb1bc (diff)
A new type of DCERPC over SMB transport.
I have captures with w2k speaking DCERPC without using the normal Transaction named pipes SMBs. Instead DCERPC is just implemented ontop of ordinary read/write calls. The smb dissector now examines TreeConnectAndX and stores the conversation/tid/type-of-share in a table for later access. All SMB requests examine that hash table to find out if TID in the header refers to a normal share or an IPC$ share. Initial support in read/write SMB calls to detect if the operations are for an IPC share and thus it assumes it must be DCERPC commands in the payload. Desegmentation/Reassembly of these types of calls are not implemented yet. svn path=/trunk/; revision=4952
Diffstat (limited to 'packet-smb-pipe.h')
-rw-r--r--packet-smb-pipe.h5
1 files changed, 4 insertions, 1 deletions
diff --git a/packet-smb-pipe.h b/packet-smb-pipe.h
index 7084a5d7da..6f86f91c7e 100644
--- a/packet-smb-pipe.h
+++ b/packet-smb-pipe.h
@@ -2,7 +2,7 @@
* Declarations of routines for SMB named pipe packet dissection
* Copyright 1999, Richard Sharpe <rsharpe@ns.aus.com>
*
- * $Id: packet-smb-pipe.h,v 1.9 2001/11/19 11:41:51 guy Exp $
+ * $Id: packet-smb-pipe.h,v 1.10 2002/03/16 04:39:28 sahlberg Exp $
*
* Ethereal - Network traffic analyzer
* By Gerald Combs <gerald@ethereal.com>
@@ -30,5 +30,8 @@ extern gboolean
dissect_pipe_smb(tvbuff_t *sp_tvb, tvbuff_t *s_tvb, tvbuff_t *pd_tvb,
tvbuff_t *p_tvb, tvbuff_t *d_tvb, const char *pipe,
packet_info *pinfo, proto_tree *tree);
+gboolean
+dissect_pipe_dcerpc(tvbuff_t *d_tvb, packet_info *pinfo, proto_tree *parent_tree,
+ proto_tree *tree, guint32 fid);
#endif