diff options
| author | Ronnie Sahlberg <ronnie_sahlberg@ozemail.com.au> | 2003-06-15 00:35:49 +0000 |
|---|---|---|
| committer | Ronnie Sahlberg <ronnie_sahlberg@ozemail.com.au> | 2003-06-15 00:35:49 +0000 |
| commit | fc70d21834953c5e52c5d4fdfc2b1b4db953981a (patch) | |
| tree | a6224aa55ad24f9553813a867d425e5e5df3fbfa | |
| parent | 6204eee840f7ae9fb5fea35954715b05a4a2041d (diff) | |
The MID field in the SMB header is in reality only ~10 bits in size
so it is pretty common for MID values to be reused even in
moderately sized captures.
The test to compare that the command type between the request
and reply is not sufficient for when most of the commands between the client
and the server are the same (e.g. streaming Read/Write)
Change the matching so that ONLY the first "response" we see for a certain
open MID will be matched to the original request.
I.e. Prevent
Read Request
Read Reply
[missing from capture] Read Request
Read Reply
From incorrectly matching the second reply (if it has a reused MID) with the
first request.
This makes the response time statistics a bit more reliable as well.
svn path=/trunk/; revision=7888
| -rw-r--r-- | packet-smb.c | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/packet-smb.c b/packet-smb.c index 0f45ce79fd..89af6a0d38 100644 --- a/packet-smb.c +++ b/packet-smb.c @@ -3,7 +3,7 @@ * Copyright 1999, Richard Sharpe <rsharpe@ns.aus.com> * 2001 Rewrite by Ronnie Sahlberg and Guy Harris * - * $Id: packet-smb.c,v 1.353 2003/06/12 08:33:30 guy Exp $ + * $Id: packet-smb.c,v 1.354 2003/06/15 00:35:49 sahlberg Exp $ * * Ethereal - Network traffic analyzer * By Gerald Combs <gerald@ethereal.com> @@ -16081,13 +16081,13 @@ dissect_smb(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree) new_key->pid_mid = pid_mid; g_hash_table_insert(si->ct->matched, new_key, sip); } else { - /* we have already seen another response to this one, but - register it anyway so we see which request it matches + /* We have already seen another response to this MID. + Since the MID in reality is only something like 10 bits + this probably means that we just have a MID that is being + reused due to the small MID space and that this is a new + command we did not see the original request for. */ - new_key = g_mem_chunk_alloc(smb_saved_info_key_chunk); - new_key->frame = pinfo->fd->num; - new_key->pid_mid = pid_mid; - g_hash_table_insert(si->ct->matched, new_key, sip); + sip=NULL; } } } |