+ ndo->ndo_protocol = "smb_tcp";
+ if (length < 4)
+ goto trunc;
+ if (ndo->ndo_snapend < data)
+ goto trunc;
+ caplen = ND_BYTES_AVAILABLE_AFTER(data);
+ if (caplen < 4)
+ goto trunc;
+ maxbuf = data + caplen;
+ smb_len = GET_BE_U_3(data + 1);
+ length -= 4;
+ caplen -= 4;
+
+ startbuf = data;
+ data += 4;
+
+ if (smb_len >= 4 && caplen >= 4 && memcmp(data,"\377SMB",4) == 0) {
+ if (smb_len > caplen) {
+ if (smb_len > length)
+ ND_PRINT(" WARNING: Packet is continued in later TCP segments\n");
+ else
+ ND_PRINT(" WARNING: Short packet. Try increasing the snap length by %u\n",
+ smb_len - caplen);
+ } else
+ ND_PRINT(" ");
+ print_smb(ndo, data, maxbuf > data + smb_len ? data + smb_len : maxbuf);
+ } else
+ ND_PRINT(" SMB-over-TCP packet:(raw data or continuation?)\n");
+ return;
+trunc:
+ nd_print_trunc(ndo);
+}