diff options
| author | Stig Bjørlykke <stig@bjorlykke.org> | 2010-08-03 11:22:08 +0000 |
|---|---|---|
| committer | Stig Bjørlykke <stig@bjorlykke.org> | 2010-08-03 11:22:08 +0000 |
| commit | f8ec869e4171ad954b325c13129de4bd28276372 (patch) | |
| tree | 86e486f27d48694a54480d73125bd30dcfd3b429 /epan/dissectors/packet-smb-browse.c | |
| parent | ea7db263739648ecbccb1ab7862d48f23b7bcc42 (diff) | |
Decode Browse Domain Announcement version and signature if signature
matches 0xaa55.
I don't know the historic reason for decoding this as "Mysterious Field",
but newer of Network Monitor (3.4) does show this as version and signature.
svn path=/trunk/; revision=33696
Diffstat (limited to 'epan/dissectors/packet-smb-browse.c')
| -rw-r--r-- | epan/dissectors/packet-smb-browse.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/epan/dissectors/packet-smb-browse.c b/epan/dissectors/packet-smb-browse.c index ba965516d8..d893c0cdda 100644 --- a/epan/dissectors/packet-smb-browse.c +++ b/epan/dissectors/packet-smb-browse.c @@ -631,7 +631,7 @@ dissect_mailslot_browse(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tr offset = dissect_smb_server_type_flags( tvb, offset, pinfo, tree, NULL, TRUE); - if (cmd == BROWSE_DOMAIN_ANNOUNCEMENT) { + if (cmd == BROWSE_DOMAIN_ANNOUNCEMENT && tvb_get_letohs (tvb, offset + 2) != 0xAA55) { /* * Network Monitor claims this is a "Comment * Pointer". I don't believe it. |