]>
The Tcpdump Group git mirrors - tcpdump/blob - print-smb.c
2 * Copyright (C) Andrew Tridgell 1995-1999
4 * This software may be distributed either under the terms of the
5 * BSD-style license that accompanies tcpdump or the GNU GPL version 2
9 /* \summary: SMB/CIFS printer */
15 #include <netdissect-stdinc.h>
19 #include "netdissect.h"
23 static const char tstr
[] = "[|SMB]" ;
25 static int request
= 0 ;
26 static int unicodestr
= 0 ;
28 const u_char
* startbuf
= NULL
;
35 void (* fn
)( netdissect_options
*, const u_char
*, const u_char
*, const u_char
*, const u_char
*);
38 struct smbdescriptint
{
43 void (* fn
)( netdissect_options
*, const u_char
*, const u_char
*, int , int );
51 struct smbdescript descript
;
59 struct smbdescriptint descript
;
62 #define DEFDESCRIPT { NULL, NULL, NULL, NULL, NULL }
64 #define FLG_CHAIN (1 << 0)
66 static const struct smbfns
*
67 smbfind ( int id
, const struct smbfns
* list
)
71 for ( sindex
= 0 ; list
[ sindex
]. name
; sindex
++)
72 if ( list
[ sindex
]. id
== id
)
73 return (& list
[ sindex
]);
78 static const struct smbfnsint
*
79 smbfindint ( int id
, const struct smbfnsint
* list
)
83 for ( sindex
= 0 ; list
[ sindex
]. name
; sindex
++)
84 if ( list
[ sindex
]. id
== id
)
85 return (& list
[ sindex
]);
91 trans2_findfirst ( netdissect_options
* ndo
,
92 const u_char
* param
, const u_char
* data
, int pcnt
, int dcnt
)
97 fmt
= "Attribute=[A] \n SearchCount=[d] \n Flags=[w] \n Level=[dP4] \n File=[S] \n " ;
99 fmt
= "Handle=[w] \n Count=[d] \n EOS=[w] \n Eoffset=[d] \n LastNameOfs=[w] \n " ;
101 smb_fdata ( ndo
, param
, fmt
, param
+ pcnt
, unicodestr
);
103 ND_PRINT (( ndo
, "data: \n " ));
104 smb_print_data ( ndo
, data
, dcnt
);
109 trans2_qfsinfo ( netdissect_options
* ndo
,
110 const u_char
* param
, const u_char
* data
, int pcnt
, int dcnt
)
112 static int level
= 0 ;
117 level
= EXTRACT_LE_U_2 ( param
);
118 fmt
= "InfoLevel=[d] \n " ;
119 smb_fdata ( ndo
, param
, fmt
, param
+ pcnt
, unicodestr
);
123 fmt
= "idFileSystem=[W] \n SectorUnit=[D] \n Unit=[D] \n Avail=[D] \n SectorSize=[d] \n " ;
126 fmt
= "CreationTime=[T2]VolNameLength=[lb] \n VolumeLabel=[c] \n " ;
129 fmt
= "Capabilities=[W] \n MaxFileLen=[D] \n VolNameLen=[lD] \n Volume=[C] \n " ;
132 fmt
= "UnknownLevel \n " ;
135 smb_fdata ( ndo
, data
, fmt
, data
+ dcnt
, unicodestr
);
138 ND_PRINT (( ndo
, "data: \n " ));
139 smb_print_data ( ndo
, data
, dcnt
);
143 ND_PRINT (( ndo
, "%s" , tstr
));
146 static const struct smbfnsint trans2_fns
[] = {
147 { 0 , "TRANSACT2_OPEN" , 0 ,
148 { "Flags2=[w] \n Mode=[w] \n SearchAttrib=[A] \n Attrib=[A] \n Time=[T2] \n OFun=[w] \n Size=[D] \n Res=([w, w, w, w, w]) \n Path=[S]" ,
150 "Handle=[d] \n Attrib=[A] \n Time=[T2] \n Size=[D] \n Access=[w] \n Type=[w] \n State=[w] \n Action=[w] \n Inode=[W] \n OffErr=[d] \n |EALength=[d] \n " ,
152 { 1 , "TRANSACT2_FINDFIRST" , 0 ,
153 { NULL
, NULL
, NULL
, NULL
, trans2_findfirst
}},
154 { 2 , "TRANSACT2_FINDNEXT" , 0 , DEFDESCRIPT
},
155 { 3 , "TRANSACT2_QFSINFO" , 0 ,
156 { NULL
, NULL
, NULL
, NULL
, trans2_qfsinfo
}},
157 { 4 , "TRANSACT2_SETFSINFO" , 0 , DEFDESCRIPT
},
158 { 5 , "TRANSACT2_QPATHINFO" , 0 , DEFDESCRIPT
},
159 { 6 , "TRANSACT2_SETPATHINFO" , 0 , DEFDESCRIPT
},
160 { 7 , "TRANSACT2_QFILEINFO" , 0 , DEFDESCRIPT
},
161 { 8 , "TRANSACT2_SETFILEINFO" , 0 , DEFDESCRIPT
},
162 { 9 , "TRANSACT2_FSCTL" , 0 , DEFDESCRIPT
},
163 { 10 , "TRANSACT2_IOCTL" , 0 , DEFDESCRIPT
},
164 { 11 , "TRANSACT2_FINDNOTIFYFIRST" , 0 , DEFDESCRIPT
},
165 { 12 , "TRANSACT2_FINDNOTIFYNEXT" , 0 , DEFDESCRIPT
},
166 { 13 , "TRANSACT2_MKDIR" , 0 , DEFDESCRIPT
},
167 { - 1 , NULL
, 0 , DEFDESCRIPT
}
172 print_trans2 ( netdissect_options
* ndo
,
173 const u_char
* words
, const u_char
* dat
, const u_char
* buf
, const u_char
* maxbuf
)
176 static const struct smbfnsint
* fn
= & trans2_fns
[ 0 ];
177 const u_char
* data
, * param
;
178 const u_char
* w
= words
+ 1 ;
179 const char * f1
= NULL
, * f2
= NULL
;
184 ND_TCHECK_2 ( w
+ ( 14 * 2 ));
185 pcnt
= EXTRACT_LE_U_2 ( w
+ 9 * 2 );
186 param
= buf
+ EXTRACT_LE_U_2 ( w
+ 10 * 2 );
187 dcnt
= EXTRACT_LE_U_2 ( w
+ 11 * 2 );
188 data
= buf
+ EXTRACT_LE_U_2 ( w
+ 12 * 2 );
189 fn
= smbfindint ( EXTRACT_LE_U_2 ( w
+ 14 * 2 ), trans2_fns
);
191 if ( EXTRACT_U_1 ( words
) == 0 ) {
192 ND_PRINT (( ndo
, "%s \n " , fn
-> name
));
193 ND_PRINT (( ndo
, "Trans2Interim \n " ));
196 ND_TCHECK_2 ( w
+ ( 7 * 2 ));
197 pcnt
= EXTRACT_LE_U_2 ( w
+ 3 * 2 );
198 param
= buf
+ EXTRACT_LE_U_2 ( w
+ 4 * 2 );
199 dcnt
= EXTRACT_LE_U_2 ( w
+ 6 * 2 );
200 data
= buf
+ EXTRACT_LE_U_2 ( w
+ 7 * 2 );
203 ND_PRINT (( ndo
, "%s param_length=%d data_length=%d \n " , fn
-> name
, pcnt
, dcnt
));
206 if ( EXTRACT_U_1 ( words
) == 8 ) {
207 smb_fdata ( ndo
, words
+ 1 ,
208 "Trans2Secondary \n TotParam=[d] \n TotData=[d] \n ParamCnt=[d] \n ParamOff=[d] \n ParamDisp=[d] \n DataCnt=[d] \n DataOff=[d] \n DataDisp=[d] \n Handle=[d] \n " ,
212 smb_fdata ( ndo
, words
+ 1 ,
213 "TotParam=[d] \n TotData=[d] \n MaxParam=[d] \n MaxData=[d] \n MaxSetup=[b][P1] \n Flags=[w] \n TimeOut=[D] \n Res1=[w] \n ParamCnt=[d] \n ParamOff=[d] \n DataCnt=[d] \n DataOff=[d] \n SetupCnt=[b][P1] \n " ,
214 words
+ 1 + 14 * 2 , unicodestr
);
216 f1
= fn
-> descript
. req_f1
;
217 f2
= fn
-> descript
. req_f2
;
219 smb_fdata ( ndo
, words
+ 1 ,
220 "TotParam=[d] \n TotData=[d] \n Res1=[w] \n ParamCnt=[d] \n ParamOff=[d] \n ParamDisp[d] \n DataCnt=[d] \n DataOff=[d] \n DataDisp=[d] \n SetupCnt=[b][P1] \n " ,
221 words
+ 1 + 10 * 2 , unicodestr
);
222 f1
= fn
-> descript
. rep_f1
;
223 f2
= fn
-> descript
. rep_f2
;
227 bcc
= EXTRACT_LE_U_2 ( dat
);
228 ND_PRINT (( ndo
, "smb_bcc=%u \n " , bcc
));
230 (* fn
-> descript
. fn
)( ndo
, param
, data
, pcnt
, dcnt
);
232 smb_fdata ( ndo
, param
, f1
? f1
: "Parameters= \n " , param
+ pcnt
, unicodestr
);
233 smb_fdata ( ndo
, data
, f2
? f2
: "Data= \n " , data
+ dcnt
, unicodestr
);
237 ND_PRINT (( ndo
, "%s" , tstr
));
241 print_browse ( netdissect_options
* ndo
,
242 const u_char
* param
, int paramlen
, const u_char
* data
, int datalen
)
244 const u_char
* maxbuf
= data
+ datalen
;
248 command
= EXTRACT_U_1 ( data
);
250 smb_fdata ( ndo
, param
, "BROWSE PACKET \n |Param " , param
+ paramlen
, unicodestr
);
254 data
= smb_fdata ( ndo
, data
,
255 "BROWSE PACKET: \n Type=[B] (LocalMasterAnnouncement) \n UpdateCount=[w] \n Res1=[B] \n AnnounceInterval=[d] \n Name=[n2] \n MajorVersion=[B] \n MinorVersion=[B] \n ServerType=[W] \n ElectionVersion=[w] \n BrowserConstant=[w] \n " ,
260 data
= smb_fdata ( ndo
, data
,
261 "BROWSE PACKET: \n Type=[B] (HostAnnouncement) \n UpdateCount=[w] \n Res1=[B] \n AnnounceInterval=[d] \n Name=[n2] \n MajorVersion=[B] \n MinorVersion=[B] \n ServerType=[W] \n ElectionVersion=[w] \n BrowserConstant=[w] \n " ,
266 data
= smb_fdata ( ndo
, data
,
267 "BROWSE PACKET: \n Type=[B] (AnnouncementRequest) \n Flags=[B] \n ReplySystemName=[S] \n " ,
272 data
= smb_fdata ( ndo
, data
,
273 "BROWSE PACKET: \n Type=[B] (WorkgroupAnnouncement) \n UpdateCount=[w] \n Res1=[B] \n AnnounceInterval=[d] \n Name=[n2] \n MajorVersion=[B] \n MinorVersion=[B] \n ServerType=[W] \n CommentPointer=[W] \n ServerName=[S] \n " ,
278 data
= smb_fdata ( ndo
, data
,
279 "BROWSE PACKET: \n Type=[B] (ElectionFrame) \n ElectionVersion=[B] \n OSSummary=[W] \n Uptime=[(W, W)] \n ServerName=[S] \n " ,
284 data
= smb_fdata ( ndo
, data
,
285 "BROWSE PACKET: \n Type=[B] (BecomeBackupBrowser) \n Name=[S] \n " ,
290 data
= smb_fdata ( ndo
, data
,
291 "BROWSE PACKET: \n Type=[B] (GetBackupList) \n ListCount?=[B] \n Token=[W] \n " ,
296 data
= smb_fdata ( ndo
, data
,
297 "BROWSE PACKET: \n Type=[B] (BackupListResponse) \n ServerCount?=[B] \n Token=[W] \n *Name=[S] \n " ,
302 data
= smb_fdata ( ndo
, data
,
303 "BROWSE PACKET: \n Type=[B] (MasterAnnouncement) \n MasterName=[S] \n " ,
308 data
= smb_fdata ( ndo
, data
,
309 "BROWSE PACKET: \n Type=[B] (ResetBrowser) \n Options=[B] \n " , maxbuf
, unicodestr
);
313 data
= smb_fdata ( ndo
, data
, "Unknown Browser Frame " , maxbuf
, unicodestr
);
318 ND_PRINT (( ndo
, "%s" , tstr
));
323 print_ipc ( netdissect_options
* ndo
,
324 const u_char
* param
, int paramlen
, const u_char
* data
, int datalen
)
327 smb_fdata ( ndo
, param
, "Command=[w] \n Str1=[S] \n Str2=[S] \n " , param
+ paramlen
,
330 smb_fdata ( ndo
, data
, "IPC " , data
+ datalen
, unicodestr
);
335 print_trans ( netdissect_options
* ndo
,
336 const u_char
* words
, const u_char
* data1
, const u_char
* buf
, const u_char
* maxbuf
)
339 const char * f1
, * f2
, * f3
, * f4
;
340 const u_char
* data
, * param
;
341 const u_char
* w
= words
+ 1 ;
342 int datalen
, paramlen
;
345 ND_TCHECK_2 ( w
+ ( 12 * 2 ));
346 paramlen
= EXTRACT_LE_U_2 ( w
+ 9 * 2 );
347 param
= buf
+ EXTRACT_LE_U_2 ( w
+ 10 * 2 );
348 datalen
= EXTRACT_LE_U_2 ( w
+ 11 * 2 );
349 data
= buf
+ EXTRACT_LE_U_2 ( w
+ 12 * 2 );
350 f1
= "TotParamCnt=[d] \n TotDataCnt=[d] \n MaxParmCnt=[d] \n MaxDataCnt=[d] \n MaxSCnt=[d] \n TransFlags=[w] \n Res1=[w] \n Res2=[w] \n Res3=[w] \n ParamCnt=[d] \n ParamOff=[d] \n DataCnt=[d] \n DataOff=[d] \n SUCnt=[d] \n " ;
355 ND_TCHECK_2 ( w
+ ( 7 * 2 ));
356 paramlen
= EXTRACT_LE_U_2 ( w
+ 3 * 2 );
357 param
= buf
+ EXTRACT_LE_U_2 ( w
+ 4 * 2 );
358 datalen
= EXTRACT_LE_U_2 ( w
+ 6 * 2 );
359 data
= buf
+ EXTRACT_LE_U_2 ( w
+ 7 * 2 );
360 f1
= "TotParamCnt=[d] \n TotDataCnt=[d] \n Res1=[d] \n ParamCnt=[d] \n ParamOff=[d] \n Res2=[d] \n DataCnt=[d] \n DataOff=[d] \n Res3=[d] \n Lsetup=[d] \n " ;
366 smb_fdata ( ndo
, words
+ 1 , f1
, min ( words
+ 1 + 2 * words
[ 0 ], maxbuf
),
370 bcc
= EXTRACT_LE_U_2 ( data1
);
371 ND_PRINT (( ndo
, "smb_bcc=%u \n " , bcc
));
373 smb_fdata ( ndo
, data1
+ 2 , f2
, maxbuf
- ( paramlen
+ datalen
), unicodestr
);
375 if ( strcmp (( const char *)( data1
+ 2 ), " \\ MAILSLOT \\ BROWSE" ) == 0 ) {
376 print_browse ( ndo
, param
, paramlen
, data
, datalen
);
380 if ( strcmp (( const char *)( data1
+ 2 ), " \\ PIPE \\ LANMAN" ) == 0 ) {
381 print_ipc ( ndo
, param
, paramlen
, data
, datalen
);
386 smb_fdata ( ndo
, param
, f3
, min ( param
+ paramlen
, maxbuf
), unicodestr
);
388 smb_fdata ( ndo
, data
, f4
, min ( data
+ datalen
, maxbuf
), unicodestr
);
392 ND_PRINT (( ndo
, "%s" , tstr
));
397 print_negprot ( netdissect_options
* ndo
,
398 const u_char
* words
, const u_char
* data
, const u_char
* buf _U_
, const u_char
* maxbuf
)
401 const char * f1
= NULL
, * f2
= NULL
;
404 wct
= EXTRACT_U_1 ( words
);
406 f2
= "*|Dialect=[Y] \n " ;
409 f1
= "Core Protocol \n DialectIndex=[d]" ;
411 f1
= "NT1 Protocol \n DialectIndex=[d] \n SecMode=[B] \n MaxMux=[d] \n NumVcs=[d] \n MaxBuffer=[D] \n RawSize=[D] \n SessionKey=[W] \n Capabilities=[W] \n ServerTime=[T3]TimeZone=[d] \n CryptKey=" ;
413 f1
= "Coreplus/Lanman1/Lanman2 Protocol \n DialectIndex=[d] \n SecMode=[w] \n MaxXMit=[d] \n MaxMux=[d] \n MaxVcs=[d] \n BlkMode=[w] \n SessionKey=[W] \n ServerTime=[T1]TimeZone=[d] \n Res=[W] \n CryptKey=" ;
417 smb_fdata ( ndo
, words
+ 1 , f1
, min ( words
+ 1 + wct
* 2 , maxbuf
),
420 smb_print_data ( ndo
, words
+ 1 , min ( wct
* 2 , PTR_DIFF ( maxbuf
, words
+ 1 )));
423 bcc
= EXTRACT_LE_U_2 ( data
);
424 ND_PRINT (( ndo
, "smb_bcc=%u \n " , bcc
));
427 smb_fdata ( ndo
, data
+ 2 , f2
, min ( data
+ 2 + EXTRACT_LE_U_2 ( data
),
428 maxbuf
), unicodestr
);
430 smb_print_data ( ndo
, data
+ 2 ,
431 min ( EXTRACT_LE_U_2 ( data
), PTR_DIFF ( maxbuf
, data
+ 2 )));
435 ND_PRINT (( ndo
, "%s" , tstr
));
439 print_sesssetup ( netdissect_options
* ndo
,
440 const u_char
* words
, const u_char
* data
, const u_char
* buf _U_
, const u_char
* maxbuf
)
443 const char * f1
= NULL
, * f2
= NULL
;
446 wct
= EXTRACT_U_1 ( words
);
449 f1
= "Com2=[w] \n Off2=[d] \n BufSize=[d] \n MpxMax=[d] \n VcNum=[d] \n SessionKey=[W] \n PassLen=[d] \n CryptLen=[d] \n CryptOff=[d] \n Pass&Name= \n " ;
451 f1
= "Com2=[B] \n Res1=[B] \n Off2=[d] \n MaxBuffer=[d] \n MaxMpx=[d] \n VcNumber=[d] \n SessionKey=[W] \n CaseInsensitivePasswordLength=[d] \n CaseSensitivePasswordLength=[d] \n Res=[W] \n Capabilities=[W] \n Pass1&Pass2&Account&Domain&OS&LanMan= \n " ;
454 f1
= "Com2=[w] \n Off2=[d] \n Action=[w] \n " ;
455 } else if ( wct
== 13 ) {
456 f1
= "Com2=[B] \n Res=[B] \n Off2=[d] \n Action=[w] \n " ;
457 f2
= "NativeOS=[S] \n NativeLanMan=[S] \n PrimaryDomain=[S] \n " ;
462 smb_fdata ( ndo
, words
+ 1 , f1
, min ( words
+ 1 + wct
* 2 , maxbuf
),
465 smb_print_data ( ndo
, words
+ 1 , min ( wct
* 2 , PTR_DIFF ( maxbuf
, words
+ 1 )));
468 bcc
= EXTRACT_LE_U_2 ( data
);
469 ND_PRINT (( ndo
, "smb_bcc=%u \n " , bcc
));
472 smb_fdata ( ndo
, data
+ 2 , f2
, min ( data
+ 2 + EXTRACT_LE_U_2 ( data
),
473 maxbuf
), unicodestr
);
475 smb_print_data ( ndo
, data
+ 2 ,
476 min ( EXTRACT_LE_U_2 ( data
), PTR_DIFF ( maxbuf
, data
+ 2 )));
480 ND_PRINT (( ndo
, "%s" , tstr
));
484 print_lockingandx ( netdissect_options
* ndo
,
485 const u_char
* words
, const u_char
* data
, const u_char
* buf _U_
, const u_char
* maxbuf
)
488 const u_char
* maxwords
;
489 const char * f1
= NULL
, * f2
= NULL
;
492 wct
= EXTRACT_U_1 ( words
);
494 f1
= "Com2=[w] \n Off2=[d] \n Handle=[d] \n LockType=[w] \n TimeOut=[D] \n UnlockCount=[d] \n LockCount=[d] \n " ;
495 ND_TCHECK_1 ( words
+ 7 );
496 if ( EXTRACT_U_1 ( words
+ 7 ) & 0x10 )
497 f2
= "*Process=[d] \n [P2]Offset=[M] \n Length=[M] \n " ;
499 f2
= "*Process=[d] \n Offset=[D] \n Length=[D] \n " ;
501 f1
= "Com2=[w] \n Off2=[d] \n " ;
504 maxwords
= min ( words
+ 1 + wct
* 2 , maxbuf
);
506 smb_fdata ( ndo
, words
+ 1 , f1
, maxwords
, unicodestr
);
509 bcc
= EXTRACT_LE_U_2 ( data
);
510 ND_PRINT (( ndo
, "smb_bcc=%u \n " , bcc
));
513 smb_fdata ( ndo
, data
+ 2 , f2
, min ( data
+ 2 + EXTRACT_LE_U_2 ( data
),
514 maxbuf
), unicodestr
);
516 smb_print_data ( ndo
, data
+ 2 ,
517 min ( EXTRACT_LE_U_2 ( data
), PTR_DIFF ( maxbuf
, data
+ 2 )));
521 ND_PRINT (( ndo
, "%s" , tstr
));
525 static const struct smbfns smb_fns
[] = {
526 { - 1 , "SMBunknown" , 0 , DEFDESCRIPT
},
528 { SMBtcon
, "SMBtcon" , 0 ,
529 { NULL
, "Path=[Z] \n Password=[Z] \n Device=[Z] \n " ,
530 "MaxXmit=[d] \n TreeId=[d] \n " , NULL
,
533 { SMBtdis
, "SMBtdis" , 0 , DEFDESCRIPT
},
534 { SMBexit
, "SMBexit" , 0 , DEFDESCRIPT
},
535 { SMBioctl
, "SMBioctl" , 0 , DEFDESCRIPT
},
537 { SMBecho
, "SMBecho" , 0 ,
538 { "ReverbCount=[d] \n " , NULL
,
539 "SequenceNum=[d] \n " , NULL
,
542 { SMBulogoffX
, "SMBulogoffX" , FLG_CHAIN
, DEFDESCRIPT
},
544 { SMBgetatr
, "SMBgetatr" , 0 ,
545 { NULL
, "Path=[Z] \n " ,
546 "Attribute=[A] \n Time=[T2]Size=[D] \n Res=([w,w,w,w,w]) \n " , NULL
,
549 { SMBsetatr
, "SMBsetatr" , 0 ,
550 { "Attribute=[A] \n Time=[T2]Res=([w,w,w,w,w]) \n " , "Path=[Z] \n " ,
551 NULL
, NULL
, NULL
} },
553 { SMBchkpth
, "SMBchkpth" , 0 ,
554 { NULL
, "Path=[Z] \n " , NULL
, NULL
, NULL
} },
556 { SMBsearch
, "SMBsearch" , 0 ,
557 { "Count=[d] \n Attrib=[A] \n " ,
558 "Path=[Z] \n BlkType=[B] \n BlkLen=[d] \n |Res1=[B] \n Mask=[s11] \n Srv1=[B] \n DirIndex=[d] \n Srv2=[w] \n Res2=[W] \n " ,
560 "BlkType=[B] \n BlkLen=[d] \n * \n Res1=[B] \n Mask=[s11] \n Srv1=[B] \n DirIndex=[d] \n Srv2=[w] \n Res2=[W] \n Attrib=[a] \n Time=[T1]Size=[D] \n Name=[s13] \n " ,
563 { SMBopen
, "SMBopen" , 0 ,
564 { "Mode=[w] \n Attribute=[A] \n " , "Path=[Z] \n " ,
565 "Handle=[d] \n OAttrib=[A] \n Time=[T2]Size=[D] \n Access=[w] \n " ,
568 { SMBcreate
, "SMBcreate" , 0 ,
569 { "Attrib=[A] \n Time=[T2]" , "Path=[Z] \n " , "Handle=[d] \n " , NULL
, NULL
} },
571 { SMBmknew
, "SMBmknew" , 0 ,
572 { "Attrib=[A] \n Time=[T2]" , "Path=[Z] \n " , "Handle=[d] \n " , NULL
, NULL
} },
574 { SMBunlink
, "SMBunlink" , 0 ,
575 { "Attrib=[A] \n " , "Path=[Z] \n " , NULL
, NULL
, NULL
} },
577 { SMBread
, "SMBread" , 0 ,
578 { "Handle=[d] \n ByteCount=[d] \n Offset=[D] \n CountLeft=[d] \n " , NULL
,
579 "Count=[d] \n Res=([w,w,w,w]) \n " , NULL
, NULL
} },
581 { SMBwrite
, "SMBwrite" , 0 ,
582 { "Handle=[d] \n ByteCount=[d] \n Offset=[D] \n CountLeft=[d] \n " , NULL
,
583 "Count=[d] \n " , NULL
, NULL
} },
585 { SMBclose
, "SMBclose" , 0 ,
586 { "Handle=[d] \n Time=[T2]" , NULL
, NULL
, NULL
, NULL
} },
588 { SMBmkdir
, "SMBmkdir" , 0 ,
589 { NULL
, "Path=[Z] \n " , NULL
, NULL
, NULL
} },
591 { SMBrmdir
, "SMBrmdir" , 0 ,
592 { NULL
, "Path=[Z] \n " , NULL
, NULL
, NULL
} },
594 { SMBdskattr
, "SMBdskattr" , 0 ,
596 "TotalUnits=[d] \n BlocksPerUnit=[d] \n BlockSize=[d] \n FreeUnits=[d] \n Media=[w] \n " ,
600 { "Attrib=[A] \n " , "OldPath=[Z] \n NewPath=[Z] \n " , NULL
, NULL
, NULL
} },
603 * this is a Pathworks specific call, allowing the
604 * changing of the root path
606 { pSETDIR
, "SMBsetdir" , 0 , { NULL
, "Path=[Z] \n " , NULL
, NULL
, NULL
} },
608 { SMBlseek
, "SMBlseek" , 0 ,
609 { "Handle=[d] \n Mode=[w] \n Offset=[D] \n " , "Offset=[D] \n " , NULL
, NULL
, NULL
} },
611 { SMBflush
, "SMBflush" , 0 , { "Handle=[d] \n " , NULL
, NULL
, NULL
, NULL
} },
613 { SMBsplopen
, "SMBsplopen" , 0 ,
614 { "SetupLen=[d] \n Mode=[w] \n " , "Ident=[Z] \n " , "Handle=[d] \n " ,
617 { SMBsplclose
, "SMBsplclose" , 0 ,
618 { "Handle=[d] \n " , NULL
, NULL
, NULL
, NULL
} },
620 { SMBsplretq
, "SMBsplretq" , 0 ,
621 { "MaxCount=[d] \n StartIndex=[d] \n " , NULL
,
622 "Count=[d] \n Index=[d] \n " ,
623 "*Time=[T2]Status=[B] \n JobID=[d] \n Size=[D] \n Res=[B]Name=[s16] \n " ,
626 { SMBsplwr
, "SMBsplwr" , 0 ,
627 { "Handle=[d] \n " , NULL
, NULL
, NULL
, NULL
} },
629 { SMBlock
, "SMBlock" , 0 ,
630 { "Handle=[d] \n Count=[D] \n Offset=[D] \n " , NULL
, NULL
, NULL
, NULL
} },
632 { SMBunlock
, "SMBunlock" , 0 ,
633 { "Handle=[d] \n Count=[D] \n Offset=[D] \n " , NULL
, NULL
, NULL
, NULL
} },
635 /* CORE+ PROTOCOL FOLLOWS */
637 { SMBreadbraw
, "SMBreadbraw" , 0 ,
638 { "Handle=[d] \n Offset=[D] \n MaxCount=[d] \n MinCount=[d] \n TimeOut=[D] \n Res=[d] \n " ,
639 NULL
, NULL
, NULL
, NULL
} },
641 { SMBwritebraw
, "SMBwritebraw" , 0 ,
642 { "Handle=[d] \n TotalCount=[d] \n Res=[w] \n Offset=[D] \n TimeOut=[D] \n WMode=[w] \n Res2=[W] \n |DataSize=[d] \n DataOff=[d] \n " ,
643 NULL
, "WriteRawAck" , NULL
, NULL
} },
645 { SMBwritec
, "SMBwritec" , 0 ,
646 { NULL
, NULL
, "Count=[d] \n " , NULL
, NULL
} },
648 { SMBwriteclose
, "SMBwriteclose" , 0 ,
649 { "Handle=[d] \n Count=[d] \n Offset=[D] \n Time=[T2]Res=([w,w,w,w,w,w])" ,
650 NULL
, "Count=[d] \n " , NULL
, NULL
} },
652 { SMBlockread
, "SMBlockread" , 0 ,
653 { "Handle=[d] \n ByteCount=[d] \n Offset=[D] \n CountLeft=[d] \n " , NULL
,
654 "Count=[d] \n Res=([w,w,w,w]) \n " , NULL
, NULL
} },
656 { SMBwriteunlock
, "SMBwriteunlock" , 0 ,
657 { "Handle=[d] \n ByteCount=[d] \n Offset=[D] \n CountLeft=[d] \n " , NULL
,
658 "Count=[d] \n " , NULL
, NULL
} },
660 { SMBreadBmpx
, "SMBreadBmpx" , 0 ,
661 { "Handle=[d] \n Offset=[D] \n MaxCount=[d] \n MinCount=[d] \n TimeOut=[D] \n Res=[w] \n " ,
663 "Offset=[D] \n TotCount=[d] \n Remaining=[d] \n Res=([w,w]) \n DataSize=[d] \n DataOff=[d] \n " ,
666 { SMBwriteBmpx
, "SMBwriteBmpx" , 0 ,
667 { "Handle=[d] \n TotCount=[d] \n Res=[w] \n Offset=[D] \n TimeOut=[D] \n WMode=[w] \n Res2=[W] \n DataSize=[d] \n DataOff=[d] \n " , NULL
,
668 "Remaining=[d] \n " , NULL
, NULL
} },
670 { SMBwriteBs
, "SMBwriteBs" , 0 ,
671 { "Handle=[d] \n TotCount=[d] \n Offset=[D] \n Res=[W] \n DataSize=[d] \n DataOff=[d] \n " ,
672 NULL
, "Count=[d] \n " , NULL
, NULL
} },
674 { SMBsetattrE
, "SMBsetattrE" , 0 ,
675 { "Handle=[d] \n CreationTime=[T2]AccessTime=[T2]ModifyTime=[T2]" , NULL
,
676 NULL
, NULL
, NULL
} },
678 { SMBgetattrE
, "SMBgetattrE" , 0 ,
679 { "Handle=[d] \n " , NULL
,
680 "CreationTime=[T2]AccessTime=[T2]ModifyTime=[T2]Size=[D] \n AllocSize=[D] \n Attribute=[A] \n " ,
683 { SMBtranss
, "SMBtranss" , 0 , DEFDESCRIPT
},
684 { SMBioctls
, "SMBioctls" , 0 , DEFDESCRIPT
},
686 { SMBcopy
, "SMBcopy" , 0 ,
687 { "TreeID2=[d] \n OFun=[w] \n Flags=[w] \n " , "Path=[S] \n NewPath=[S] \n " ,
688 "CopyCount=[d] \n " , "|ErrStr=[S] \n " , NULL
} },
690 { SMBmove
, "SMBmove" , 0 ,
691 { "TreeID2=[d] \n OFun=[w] \n Flags=[w] \n " , "Path=[S] \n NewPath=[S] \n " ,
692 "MoveCount=[d] \n " , "|ErrStr=[S] \n " , NULL
} },
694 { SMBopenX
, "SMBopenX" , FLG_CHAIN
,
695 { "Com2=[w] \n Off2=[d] \n Flags=[w] \n Mode=[w] \n SearchAttrib=[A] \n Attrib=[A] \n Time=[T2]OFun=[w] \n Size=[D] \n TimeOut=[D] \n Res=[W] \n " ,
697 "Com2=[w] \n Off2=[d] \n Handle=[d] \n Attrib=[A] \n Time=[T2]Size=[D] \n Access=[w] \n Type=[w] \n State=[w] \n Action=[w] \n FileID=[W] \n Res=[w] \n " ,
700 { SMBreadX
, "SMBreadX" , FLG_CHAIN
,
701 { "Com2=[w] \n Off2=[d] \n Handle=[d] \n Offset=[D] \n MaxCount=[d] \n MinCount=[d] \n TimeOut=[D] \n CountLeft=[d] \n " ,
703 "Com2=[w] \n Off2=[d] \n Remaining=[d] \n Res=[W] \n DataSize=[d] \n DataOff=[d] \n Res=([w,w,w,w]) \n " ,
706 { SMBwriteX
, "SMBwriteX" , FLG_CHAIN
,
707 { "Com2=[w] \n Off2=[d] \n Handle=[d] \n Offset=[D] \n TimeOut=[D] \n WMode=[w] \n CountLeft=[d] \n Res=[w] \n DataSize=[d] \n DataOff=[d] \n " ,
709 "Com2=[w] \n Off2=[d] \n Count=[d] \n Remaining=[d] \n Res=[W] \n " ,
712 { SMBffirst
, "SMBffirst" , 0 ,
713 { "Count=[d] \n Attrib=[A] \n " ,
714 "Path=[Z] \n BlkType=[B] \n BlkLen=[d] \n |Res1=[B] \n Mask=[s11] \n Srv1=[B] \n DirIndex=[d] \n Srv2=[w] \n " ,
716 "BlkType=[B] \n BlkLen=[d] \n * \n Res1=[B] \n Mask=[s11] \n Srv1=[B] \n DirIndex=[d] \n Srv2=[w] \n Res2=[W] \n Attrib=[a] \n Time=[T1]Size=[D] \n Name=[s13] \n " ,
719 { SMBfunique
, "SMBfunique" , 0 ,
720 { "Count=[d] \n Attrib=[A] \n " ,
721 "Path=[Z] \n BlkType=[B] \n BlkLen=[d] \n |Res1=[B] \n Mask=[s11] \n Srv1=[B] \n DirIndex=[d] \n Srv2=[w] \n " ,
723 "BlkType=[B] \n BlkLen=[d] \n * \n Res1=[B] \n Mask=[s11] \n Srv1=[B] \n DirIndex=[d] \n Srv2=[w] \n Res2=[W] \n Attrib=[a] \n Time=[T1]Size=[D] \n Name=[s13] \n " ,
726 { SMBfclose
, "SMBfclose" , 0 ,
727 { "Count=[d] \n Attrib=[A] \n " ,
728 "Path=[Z] \n BlkType=[B] \n BlkLen=[d] \n |Res1=[B] \n Mask=[s11] \n Srv1=[B] \n DirIndex=[d] \n Srv2=[w] \n " ,
730 "BlkType=[B] \n BlkLen=[d] \n * \n Res1=[B] \n Mask=[s11] \n Srv1=[B] \n DirIndex=[d] \n Srv2=[w] \n Res2=[W] \n Attrib=[a] \n Time=[T1]Size=[D] \n Name=[s13] \n " ,
733 { SMBfindnclose
, "SMBfindnclose" , 0 ,
734 { "Handle=[d] \n " , NULL
, NULL
, NULL
, NULL
} },
736 { SMBfindclose
, "SMBfindclose" , 0 ,
737 { "Handle=[d] \n " , NULL
, NULL
, NULL
, NULL
} },
739 { SMBsends
, "SMBsends" , 0 ,
740 { NULL
, "Source=[Z] \n Dest=[Z] \n " , NULL
, NULL
, NULL
} },
742 { SMBsendstrt
, "SMBsendstrt" , 0 ,
743 { NULL
, "Source=[Z] \n Dest=[Z] \n " , "GroupID=[d] \n " , NULL
, NULL
} },
745 { SMBsendend
, "SMBsendend" , 0 ,
746 { "GroupID=[d] \n " , NULL
, NULL
, NULL
, NULL
} },
748 { SMBsendtxt
, "SMBsendtxt" , 0 ,
749 { "GroupID=[d] \n " , NULL
, NULL
, NULL
, NULL
} },
751 { SMBsendb
, "SMBsendb" , 0 ,
752 { NULL
, "Source=[Z] \n Dest=[Z] \n " , NULL
, NULL
, NULL
} },
754 { SMBfwdname
, "SMBfwdname" , 0 , DEFDESCRIPT
},
755 { SMBcancelf
, "SMBcancelf" , 0 , DEFDESCRIPT
},
756 { SMBgetmac
, "SMBgetmac" , 0 , DEFDESCRIPT
},
758 { SMBnegprot
, "SMBnegprot" , 0 ,
759 { NULL
, NULL
, NULL
, NULL
, print_negprot
} },
761 { SMBsesssetupX
, "SMBsesssetupX" , FLG_CHAIN
,
762 { NULL
, NULL
, NULL
, NULL
, print_sesssetup
} },
764 { SMBtconX
, "SMBtconX" , FLG_CHAIN
,
765 { "Com2=[w] \n Off2=[d] \n Flags=[w] \n PassLen=[d] \n Passwd&Path&Device= \n " ,
766 NULL
, "Com2=[w] \n Off2=[d] \n " , "ServiceType=[R] \n " , NULL
} },
768 { SMBlockingX
, "SMBlockingX" , FLG_CHAIN
,
769 { NULL
, NULL
, NULL
, NULL
, print_lockingandx
} },
771 { SMBtrans2
, "SMBtrans2" , 0 , { NULL
, NULL
, NULL
, NULL
, print_trans2
} },
773 { SMBtranss2
, "SMBtranss2" , 0 , DEFDESCRIPT
},
774 { SMBctemp
, "SMBctemp" , 0 , DEFDESCRIPT
},
775 { SMBreadBs
, "SMBreadBs" , 0 , DEFDESCRIPT
},
776 { SMBtrans
, "SMBtrans" , 0 , { NULL
, NULL
, NULL
, NULL
, print_trans
} },
778 { SMBnttrans
, "SMBnttrans" , 0 , DEFDESCRIPT
},
779 { SMBnttranss
, "SMBnttranss" , 0 , DEFDESCRIPT
},
781 { SMBntcreateX
, "SMBntcreateX" , FLG_CHAIN
,
782 { "Com2=[w] \n Off2=[d] \n Res=[b] \n NameLen=[ld] \n Flags=[W] \n RootDirectoryFid=[D] \n AccessMask=[W] \n AllocationSize=[L] \n ExtFileAttributes=[W] \n ShareAccess=[W] \n CreateDisposition=[W] \n CreateOptions=[W] \n ImpersonationLevel=[W] \n SecurityFlags=[b] \n " ,
784 "Com2=[w] \n Off2=[d] \n OplockLevel=[b] \n Fid=[d] \n CreateAction=[W] \n CreateTime=[T3]LastAccessTime=[T3]LastWriteTime=[T3]ChangeTime=[T3]ExtFileAttributes=[W] \n AllocationSize=[L] \n EndOfFile=[L] \n FileType=[w] \n DeviceState=[w] \n Directory=[b] \n " ,
787 { SMBntcancel
, "SMBntcancel" , 0 , DEFDESCRIPT
},
789 { - 1 , NULL
, 0 , DEFDESCRIPT
}
794 * print a SMB message
797 print_smb ( netdissect_options
* ndo
,
798 const u_char
* buf
, const u_char
* maxbuf
)
804 const u_char
* words
, * maxwords
, * data
;
805 const struct smbfns
* fn
;
806 const char * fmt_smbheader
=
807 "[P4]SMB Command = [B] \n Error class = [BP1] \n Error code = [d] \n Flags1 = [B] \n Flags2 = [B][P13] \n Tree ID = [d] \n Proc ID = [d] \n UID = [d] \n MID = [d] \n Word Count = [b] \n " ;
810 ND_TCHECK_1 ( buf
+ 9 );
811 request
= ( buf
[ 9 ] & 0x80 ) ? 0 : 1 ;
814 command
= EXTRACT_U_1 ( buf
+ 4 );
816 fn
= smbfind ( command
, smb_fns
);
818 if ( ndo
-> ndo_vflag
> 1 )
819 ND_PRINT (( ndo
, " \n " ));
821 ND_PRINT (( ndo
, "SMB PACKET: %s (%s) \n " , fn
-> name
, request
? "REQUEST" : "REPLY" ));
823 if ( ndo
-> ndo_vflag
< 2 )
826 ND_TCHECK_2 ( buf
+ 10 );
827 flags2
= EXTRACT_LE_U_2 ( buf
+ 10 );
828 unicodestr
= flags2
& 0x8000 ;
829 nterrcodes
= flags2
& 0x4000 ;
831 /* print out the header */
832 smb_fdata ( ndo
, buf
, fmt_smbheader
, buf
+ 33 , unicodestr
);
835 nterror
= EXTRACT_LE_U_4 ( buf
+ 5 );
837 ND_PRINT (( ndo
, "NTError = %s \n " , nt_errstr ( nterror
)));
839 if ( EXTRACT_U_1 ( buf
+ 5 ))
840 ND_PRINT (( ndo
, "SMBError = %s \n " , smb_errstr ( EXTRACT_U_1 ( buf
+ 5 ),
841 EXTRACT_LE_U_2 ( buf
+ 7 ))));
852 words
= buf
+ smboffset
;
854 wct
= EXTRACT_U_1 ( words
);
855 data
= words
+ 1 + wct
* 2 ;
856 maxwords
= min ( data
, maxbuf
);
859 f1
= fn
-> descript
. req_f1
;
860 f2
= fn
-> descript
. req_f2
;
862 f1
= fn
-> descript
. rep_f1
;
863 f2
= fn
-> descript
. rep_f2
;
867 (* fn
-> descript
. fn
)( ndo
, words
, data
, buf
, maxbuf
);
871 smb_fdata ( ndo
, words
+ 1 , f1
, words
+ 1 + wct
* 2 , unicodestr
);
876 for ( i
= 0 ; & words
[ 1 + 2 * i
] < maxwords
; i
++) {
877 ND_TCHECK_2 ( words
+ ( 1 + 2 * i
));
878 v
= EXTRACT_LE_U_2 ( words
+ 1 + 2 * i
);
879 ND_PRINT (( ndo
, "smb_vwv[%d]=%d (0x%X) \n " , i
, v
, v
));
885 bcc
= EXTRACT_LE_U_2 ( data
);
886 ND_PRINT (( ndo
, "smb_bcc=%u \n " , bcc
));
889 smb_fdata ( ndo
, data
+ 2 , f2
, data
+ 2 + bcc
, unicodestr
);
892 ND_PRINT (( ndo
, "smb_buf[]= \n " ));
893 smb_print_data ( ndo
, data
+ 2 , min ( bcc
, PTR_DIFF ( maxbuf
, data
+ 2 )));
898 if (( fn
-> flags
& FLG_CHAIN
) == 0 )
902 ND_TCHECK_1 ( words
+ 1 );
903 command
= EXTRACT_U_1 ( words
+ 1 );
906 ND_TCHECK_2 ( words
+ 3 );
907 newsmboffset
= EXTRACT_LE_U_2 ( words
+ 3 );
909 fn
= smbfind ( command
, smb_fns
);
911 ND_PRINT (( ndo
, " \n SMB PACKET: %s (%s) (CHAINED) \n " ,
912 fn
-> name
, request
? "REQUEST" : "REPLY" ));
913 if ( newsmboffset
<= smboffset
) {
914 ND_PRINT (( ndo
, "Bad andX offset: %u <= %u \n " , newsmboffset
, smboffset
));
917 smboffset
= newsmboffset
;
920 ND_PRINT (( ndo
, " \n " ));
923 ND_PRINT (( ndo
, "%s" , tstr
));
928 * print a NBT packet received across tcp on port 139
931 nbt_tcp_print ( netdissect_options
* ndo
,
932 const u_char
* data
, int length
)
937 const u_char
* maxbuf
;
941 if ( ndo
-> ndo_snapend
< data
)
943 caplen
= ndo
-> ndo_snapend
- data
;
946 maxbuf
= data
+ caplen
;
947 type
= EXTRACT_U_1 ( data
);
948 nbt_len
= EXTRACT_BE_U_2 ( data
+ 2 );
954 if ( ndo
-> ndo_vflag
< 2 ) {
955 ND_PRINT (( ndo
, " NBT Session Packet: " ));
958 ND_PRINT (( ndo
, "Session Message" ));
962 ND_PRINT (( ndo
, "Session Request" ));
966 ND_PRINT (( ndo
, "Session Granted" ));
979 ecode
= EXTRACT_U_1 ( data
+ 4 );
981 ND_PRINT (( ndo
, "Session Reject, " ));
984 ND_PRINT (( ndo
, "Not listening on called name" ));
987 ND_PRINT (( ndo
, "Not listening for calling name" ));
990 ND_PRINT (( ndo
, "Called name not present" ));
993 ND_PRINT (( ndo
, "Called name present, but insufficient resources" ));
996 ND_PRINT (( ndo
, "Unspecified error 0x%X" , ecode
));
1003 ND_PRINT (( ndo
, "Session Keepalive" ));
1007 data
= smb_fdata ( ndo
, data
, "Unknown packet type [rB]" , maxbuf
, 0 );
1011 ND_PRINT (( ndo
, " \n >>> NBT Session Packet \n " ));
1014 data
= smb_fdata ( ndo
, data
, "[P1]NBT Session Message \n Flags=[B] \n Length=[rd] \n " ,
1018 if ( nbt_len
>= 4 && caplen
>= 4 && memcmp ( data
, " \377 SMB" , 4 ) == 0 ) {
1019 if (( int ) nbt_len
> caplen
) {
1020 if (( int ) nbt_len
> length
)
1021 ND_PRINT (( ndo
, "WARNING: Packet is continued in later TCP segments \n " ));
1023 ND_PRINT (( ndo
, "WARNING: Short packet. Try increasing the snap length by %d \n " ,
1026 print_smb ( ndo
, data
, maxbuf
> data
+ nbt_len
? data
+ nbt_len
: maxbuf
);
1028 ND_PRINT (( ndo
, "Session packet:(raw data or continuation?) \n " ));
1032 data
= smb_fdata ( ndo
, data
,
1033 "[P1]NBT Session Request \n Flags=[B] \n Length=[rd] \n Destination=[n1] \n Source=[n1] \n " ,
1038 data
= smb_fdata ( ndo
, data
, "[P1]NBT Session Granted \n Flags=[B] \n Length=[rd] \n " , maxbuf
, 0 );
1043 const u_char
* origdata
;
1047 data
= smb_fdata ( ndo
, data
, "[P1]NBT SessionReject \n Flags=[B] \n Length=[rd] \n Reason=[B] \n " ,
1051 if ( nbt_len
>= 1 && caplen
>= 1 ) {
1052 ecode
= EXTRACT_U_1 ( origdata
+ 4 );
1055 ND_PRINT (( ndo
, "Not listening on called name \n " ));
1058 ND_PRINT (( ndo
, "Not listening for calling name \n " ));
1061 ND_PRINT (( ndo
, "Called name not present \n " ));
1064 ND_PRINT (( ndo
, "Called name present, but insufficient resources \n " ));
1067 ND_PRINT (( ndo
, "Unspecified error 0x%X \n " , ecode
));
1075 data
= smb_fdata ( ndo
, data
, "[P1]NBT Session Keepalive \n Flags=[B] \n Length=[rd] \n " , maxbuf
, 0 );
1079 data
= smb_fdata ( ndo
, data
, "NBT - Unknown packet type \n Type=[B] \n " , maxbuf
, 0 );
1082 ND_PRINT (( ndo
, " \n " ));
1086 ND_PRINT (( ndo
, "%s" , tstr
));
1089 static const struct tok opcode_str
[] = {
1091 { 5 , "REGISTRATION" },
1094 { 8 , "REFRESH(8)" },
1096 { 15 , "MULTIHOMED REGISTRATION" },
1101 * print a NBT packet received across udp on port 137
1104 nbt_udp137_print ( netdissect_options
* ndo
,
1105 const u_char
* data
, int length
)
1107 const u_char
* maxbuf
= data
+ length
;
1108 int name_trn_id
, response
, opcode
, nm_flags
, rcode
;
1109 int qdcount
, ancount
, nscount
, arcount
;
1113 ND_TCHECK_2 ( data
+ 10 );
1114 name_trn_id
= EXTRACT_BE_U_2 ( data
);
1115 response
= ( data
[ 2 ] >> 7 );
1116 opcode
= ( data
[ 2 ] >> 3 ) & 0xF ;
1117 nm_flags
= (( data
[ 2 ] & 0x7 ) << 4 ) + ( data
[ 3 ] >> 4 );
1118 rcode
= data
[ 3 ] & 0xF ;
1119 qdcount
= EXTRACT_BE_U_2 ( data
+ 4 );
1120 ancount
= EXTRACT_BE_U_2 ( data
+ 6 );
1121 nscount
= EXTRACT_BE_U_2 ( data
+ 8 );
1122 arcount
= EXTRACT_BE_U_2 ( data
+ 10 );
1128 if ( ndo
-> ndo_vflag
> 1 )
1129 ND_PRINT (( ndo
, " \n >>> " ));
1131 ND_PRINT (( ndo
, "NBT UDP PACKET(137): %s" , tok2str ( opcode_str
, "OPUNKNOWN" , opcode
)));
1133 ND_PRINT (( ndo
, "; %s" , rcode
? "NEGATIVE" : "POSITIVE" ));
1135 ND_PRINT (( ndo
, "; %s; %s" , response
? "RESPONSE" : "REQUEST" ,
1136 ( nm_flags
& 1 ) ? "BROADCAST" : "UNICAST" ));
1138 if ( ndo
-> ndo_vflag
< 2 )
1141 ND_PRINT (( ndo
, " \n TrnID=0x%X \n OpCode=%d \n NmFlags=0x%X \n Rcode=%d \n QueryCount=%d \n AnswerCount=%d \n AuthorityCount=%d \n AddressRecCount=%d \n " ,
1142 name_trn_id
, opcode
, nm_flags
, rcode
, qdcount
, ancount
, nscount
,
1147 total
= ancount
+ nscount
+ arcount
;
1149 if ( qdcount
> 100 || total
> 100 ) {
1150 ND_PRINT (( ndo
, "Corrupt packet?? \n " ));
1155 ND_PRINT (( ndo
, "QuestionRecords: \n " ));
1156 for ( i
= 0 ; i
< qdcount
; i
++) {
1157 p
= smb_fdata ( ndo
, p
,
1158 "|Name=[n1] \n QuestionType=[rw] \n QuestionClass=[rw] \n #" ,
1166 ND_PRINT (( ndo
, " \n ResourceRecords: \n " ));
1167 for ( i
= 0 ; i
< total
; i
++) {
1171 p
= smb_fdata ( ndo
, p
, "Name=[n1] \n #" , maxbuf
, 0 );
1175 restype
= EXTRACT_BE_U_2 ( p
);
1176 p
= smb_fdata ( ndo
, p
, "ResType=[rw] \n ResClass=[rw] \n TTL=[rD] \n " , p
+ 8 , 0 );
1180 rdlen
= EXTRACT_BE_U_2 ( p
);
1181 ND_PRINT (( ndo
, "ResourceLength=%d \n ResourceData= \n " , rdlen
));
1184 p
= smb_fdata ( ndo
, p
, "AddrType=[rw] \n Address=[b.b.b.b] \n " , p
+ rdlen
, 0 );
1188 if ( restype
== 0x21 ) {
1192 numnames
= EXTRACT_U_1 ( p
);
1193 p
= smb_fdata ( ndo
, p
, "NumNames=[B] \n " , p
+ 1 , 0 );
1196 while ( numnames
--) {
1197 p
= smb_fdata ( ndo
, p
, "Name=[n2] \t #" , maxbuf
, 0 );
1201 if ( EXTRACT_U_1 ( p
) & 0x80 )
1202 ND_PRINT (( ndo
, "<GROUP> " ));
1203 switch ( EXTRACT_U_1 ( p
) & 0x60 ) {
1204 case 0x00 : ND_PRINT (( ndo
, "B " )); break ;
1205 case 0x20 : ND_PRINT (( ndo
, "P " )); break ;
1206 case 0x40 : ND_PRINT (( ndo
, "M " )); break ;
1207 case 0x60 : ND_PRINT (( ndo
, "_ " )); break ;
1209 if ( EXTRACT_U_1 ( p
) & 0x10 )
1210 ND_PRINT (( ndo
, "<DEREGISTERING> " ));
1211 if ( EXTRACT_U_1 ( p
) & 0x08 )
1212 ND_PRINT (( ndo
, "<CONFLICT> " ));
1213 if ( EXTRACT_U_1 ( p
) & 0x04 )
1214 ND_PRINT (( ndo
, "<ACTIVE> " ));
1215 if ( EXTRACT_U_1 ( p
) & 0x02 )
1216 ND_PRINT (( ndo
, "<PERMANENT> " ));
1217 ND_PRINT (( ndo
, " \n " ));
1221 smb_print_data ( ndo
, p
, min ( rdlen
, length
- ( p
- data
)));
1229 smb_fdata ( ndo
, p
, "AdditionalData: \n " , maxbuf
, 0 );
1232 ND_PRINT (( ndo
, " \n " ));
1235 ND_PRINT (( ndo
, "%s" , tstr
));
1239 * Print an SMB-over-TCP packet received across tcp on port 445
1242 smb_tcp_print ( netdissect_options
* ndo
,
1243 const u_char
* data
, int length
)
1247 const u_char
* maxbuf
;
1251 if ( ndo
-> ndo_snapend
< data
)
1253 caplen
= ndo
-> ndo_snapend
- data
;
1256 maxbuf
= data
+ caplen
;
1257 smb_len
= EXTRACT_BE_U_3 ( data
+ 1 );
1264 if ( smb_len
>= 4 && caplen
>= 4 && memcmp ( data
, " \377 SMB" , 4 ) == 0 ) {
1265 if (( int ) smb_len
> caplen
) {
1266 if (( int ) smb_len
> length
)
1267 ND_PRINT (( ndo
, " WARNING: Packet is continued in later TCP segments \n " ));
1269 ND_PRINT (( ndo
, " WARNING: Short packet. Try increasing the snap length by %d \n " ,
1272 ND_PRINT (( ndo
, " " ));
1273 print_smb ( ndo
, data
, maxbuf
> data
+ smb_len
? data
+ smb_len
: maxbuf
);
1275 ND_PRINT (( ndo
, " SMB-over-TCP packet:(raw data or continuation?) \n " ));
1278 ND_PRINT (( ndo
, "%s" , tstr
));
1282 * print a NBT packet received across udp on port 138
1285 nbt_udp138_print ( netdissect_options
* ndo
,
1286 const u_char
* data
, int length
)
1288 const u_char
* maxbuf
= data
+ length
;
1290 if ( maxbuf
> ndo
-> ndo_snapend
)
1291 maxbuf
= ndo
-> ndo_snapend
;
1296 if ( ndo
-> ndo_vflag
< 2 ) {
1297 ND_PRINT (( ndo
, "NBT UDP PACKET(138)" ));
1301 data
= smb_fdata ( ndo
, data
,
1302 " \n >>> NBT UDP PACKET(138) Res=[rw] ID=[rw] IP=[b.b.b.b] Port=[rd] Length=[rd] Res2=[rw] \n SourceName=[n1] \n DestName=[n1] \n #" ,
1306 /* If there isn't enough data for "\377SMB", don't check for it. */
1307 if (( data
+ 3 ) >= maxbuf
)
1310 if ( memcmp ( data
, " \377 SMB" , 4 ) == 0 )
1311 print_smb ( ndo
, data
, maxbuf
);
1314 ND_PRINT (( ndo
, " \n " ));
1319 print netbeui frames
1321 static struct nbf_strings
{
1323 const char * nonverbose
;
1324 const char * verbose
;
1325 } nbf_strings
[ 0x20 ] = {
1326 { "Add Group Name Query" , ", [P23]Name to add=[n2]#" ,
1327 "[P5]ResponseCorrelator=[w] \n [P16]Name to add=[n2] \n " },
1328 { "Add Name Query" , ", [P23]Name to add=[n2]#" ,
1329 "[P5]ResponseCorrelator=[w] \n [P16]Name to add=[n2] \n " },
1330 { "Name In Conflict" , NULL
, NULL
},
1331 { "Status Query" , NULL
, NULL
},
1332 { NULL
, NULL
, NULL
}, /* not used */
1333 { NULL
, NULL
, NULL
}, /* not used */
1334 { NULL
, NULL
, NULL
}, /* not used */
1335 { "Terminate Trace" , NULL
, NULL
},
1337 "[P7]Destination=[n2] \n Source=[n2] \n " },
1338 { "Broadcast Datagram" , NULL
,
1339 "[P7]Destination=[n2] \n Source=[n2] \n " },
1340 { "Name Query" , ", [P7]Name=[n2]#" ,
1341 "[P1]SessionNumber=[B] \n NameType=[B][P2] \n ResponseCorrelator=[w] \n Name=[n2] \n Name of sender=[n2] \n " },
1342 { NULL
, NULL
, NULL
}, /* not used */
1343 { NULL
, NULL
, NULL
}, /* not used */
1344 { "Add Name Response" , ", [P1]GroupName=[w] [P4]Destination=[n2] Source=[n2]#" ,
1345 "AddNameInProcess=[B] \n GroupName=[w] \n TransmitCorrelator=[w][P2] \n Destination=[n2] \n Source=[n2] \n " },
1346 { "Name Recognized" , NULL
,
1347 "[P1]Data2=[w] \n TransmitCorrelator=[w] \n ResponseCorelator=[w] \n Destination=[n2] \n Source=[n2] \n " },
1348 { "Status Response" , NULL
, NULL
},
1349 { NULL
, NULL
, NULL
}, /* not used */
1350 { NULL
, NULL
, NULL
}, /* not used */
1351 { NULL
, NULL
, NULL
}, /* not used */
1352 { "Terminate Trace" , NULL
, NULL
},
1354 "[P3]TransmitCorrelator=[w][P2] \n RemoteSessionNumber=[B] \n LocalSessionNumber=[B] \n " },
1355 { "Data First/Middle" , NULL
,
1356 "Flags=[{RECEIVE_CONTINUE|NO_ACK||PIGGYBACK_ACK_INCLUDED|}] \n ResyncIndicator=[w][P2] \n ResponseCorelator=[w] \n RemoteSessionNumber=[B] \n LocalSessionNumber=[B] \n " },
1357 { "Data Only/Last" , NULL
,
1358 "Flags=[{|NO_ACK|PIGGYBACK_ACK_ALLOWED|PIGGYBACK_ACK_INCLUDED|}] \n ResyncIndicator=[w][P2] \n ResponseCorelator=[w] \n RemoteSessionNumber=[B] \n LocalSessionNumber=[B] \n " },
1359 { "Session Confirm" , NULL
,
1360 "Data1=[B] \n Data2=[w] \n TransmitCorrelator=[w] \n ResponseCorelator=[w] \n RemoteSessionNumber=[B] \n LocalSessionNumber=[B] \n " },
1361 { "Session End" , NULL
,
1362 "[P1]Data2=[w][P4] \n RemoteSessionNumber=[B] \n LocalSessionNumber=[B] \n " },
1363 { "Session Initialize" , NULL
,
1364 "Data1=[B] \n Data2=[w] \n TransmitCorrelator=[w] \n ResponseCorelator=[w] \n RemoteSessionNumber=[B] \n LocalSessionNumber=[B] \n " },
1365 { "No Receive" , NULL
,
1366 "Flags=[{|SEND_NO_ACK}] \n DataBytesAccepted=[b][P4] \n RemoteSessionNumber=[B] \n LocalSessionNumber=[B] \n " },
1367 { "Receive Outstanding" , NULL
,
1368 "[P1]DataBytesAccepted=[b][P4] \n RemoteSessionNumber=[B] \n LocalSessionNumber=[B] \n " },
1369 { "Receive Continue" , NULL
,
1370 "[P2]TransmitCorrelator=[w] \n [P2]RemoteSessionNumber=[B] \n LocalSessionNumber=[B] \n " },
1371 { NULL
, NULL
, NULL
}, /* not used */
1372 { NULL
, NULL
, NULL
}, /* not used */
1373 { "Session Alive" , NULL
, NULL
}
1377 netbeui_print ( netdissect_options
* ndo
,
1378 u_short control
, const u_char
* data
, int length
)
1380 const u_char
* maxbuf
= data
+ length
;
1383 const u_char
* data2
;
1384 int is_truncated
= 0 ;
1386 if ( maxbuf
> ndo
-> ndo_snapend
)
1387 maxbuf
= ndo
-> ndo_snapend
;
1388 ND_TCHECK_1 ( data
+ 4 );
1389 len
= EXTRACT_LE_U_2 ( data
);
1390 command
= EXTRACT_U_1 ( data
+ 4 );
1392 if ( data2
>= maxbuf
) {
1399 if ( ndo
-> ndo_vflag
< 2 ) {
1400 ND_PRINT (( ndo
, "NBF Packet: " ));
1401 data
= smb_fdata ( ndo
, data
, "[P5]#" , maxbuf
, 0 );
1403 ND_PRINT (( ndo
, " \n >>> NBF Packet \n Type=0x%X " , control
));
1404 data
= smb_fdata ( ndo
, data
, "Length=[d] Signature=[w] Command=[B] \n #" , maxbuf
, 0 );
1409 if ( command
> 0x1f || nbf_strings
[ command
]. name
== NULL
) {
1410 if ( ndo
-> ndo_vflag
< 2 )
1411 data
= smb_fdata ( ndo
, data
, "Unknown NBF Command#" , data2
, 0 );
1413 data
= smb_fdata ( ndo
, data
, "Unknown NBF Command \n " , data2
, 0 );
1415 if ( ndo
-> ndo_vflag
< 2 ) {
1416 ND_PRINT (( ndo
, "%s" , nbf_strings
[ command
]. name
));
1417 if ( nbf_strings
[ command
]. nonverbose
!= NULL
)
1418 data
= smb_fdata ( ndo
, data
, nbf_strings
[ command
]. nonverbose
, data2
, 0 );
1420 ND_PRINT (( ndo
, "%s: \n " , nbf_strings
[ command
]. name
));
1421 if ( nbf_strings
[ command
]. verbose
!= NULL
)
1422 data
= smb_fdata ( ndo
, data
, nbf_strings
[ command
]. verbose
, data2
, 0 );
1424 ND_PRINT (( ndo
, " \n " ));
1428 if ( ndo
-> ndo_vflag
< 2 )
1435 /* data2 was past the end of the buffer */
1439 /* If this isn't a command that would contain an SMB message, quit. */
1440 if ( command
!= 0x08 && command
!= 0x09 && command
!= 0x15 &&
1444 /* If there isn't enough data for "\377SMB", don't look for it. */
1445 if (( data2
+ 3 ) >= maxbuf
)
1448 if ( memcmp ( data2
, " \377 SMB" , 4 ) == 0 )
1449 print_smb ( ndo
, data2
, maxbuf
);
1452 for ( i
= 0 ; i
< 128 ; i
++) {
1453 if (( data2
+ i
+ 3 ) >= maxbuf
)
1455 if ( memcmp ( data2
+ i
, " \377 SMB" , 4 ) == 0 ) {
1456 ND_PRINT (( ndo
, "found SMB packet at %d \n " , i
));
1457 print_smb ( ndo
, data2
+ i
, maxbuf
);
1464 ND_PRINT (( ndo
, " \n " ));
1467 ND_PRINT (( ndo
, "%s" , tstr
));
1472 * print IPX-Netbios frames
1475 ipx_netbios_print ( netdissect_options
* ndo
,
1476 const u_char
* data
, u_int length
)
1479 * this is a hack till I work out how to parse the rest of the
1480 * NetBIOS-over-IPX stuff
1483 const u_char
* maxbuf
;
1485 maxbuf
= data
+ length
;
1486 /* Don't go past the end of the captured data in the packet. */
1487 if ( maxbuf
> ndo
-> ndo_snapend
)
1488 maxbuf
= ndo
-> ndo_snapend
;
1490 for ( i
= 0 ; i
< 128 ; i
++) {
1491 if (( data
+ i
+ 4 ) > maxbuf
)
1493 if ( memcmp ( data
+ i
, " \377 SMB" , 4 ) == 0 ) {
1494 smb_fdata ( ndo
, data
, " \n >>> IPX transport " , data
+ i
, 0 );
1495 print_smb ( ndo
, data
+ i
, maxbuf
);
1496 ND_PRINT (( ndo
, " \n " ));
1501 smb_fdata ( ndo
, data
, " \n >>> Unknown IPX " , maxbuf
, 0 );