From f8ec869e4171ad954b325c13129de4bd28276372 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stig=20Bj=C3=B8rlykke?= Date: Tue, 3 Aug 2010 11:22:08 +0000 Subject: Decode Browse Domain Announcement version and signature if signature matches 0xaa55. I don't know the historic reason for decoding this as "Mysterious Field", but newer of Network Monitor (3.4) does show this as version and signature. svn path=/trunk/; revision=33696 --- epan/dissectors/packet-smb-browse.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'epan/dissectors/packet-smb-browse.c') diff --git a/epan/dissectors/packet-smb-browse.c b/epan/dissectors/packet-smb-browse.c index ba965516d8..d893c0cdda 100644 --- a/epan/dissectors/packet-smb-browse.c +++ b/epan/dissectors/packet-smb-browse.c @@ -631,7 +631,7 @@ dissect_mailslot_browse(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tr offset = dissect_smb_server_type_flags( tvb, offset, pinfo, tree, NULL, TRUE); - if (cmd == BROWSE_DOMAIN_ANNOUNCEMENT) { + if (cmd == BROWSE_DOMAIN_ANNOUNCEMENT && tvb_get_letohs (tvb, offset + 2) != 0xAA55) { /* * Network Monitor claims this is a "Comment * Pointer". I don't believe it. -- cgit v1.2.3