On Fri, 2002-11-08 at 14:32, Ronnie Sahlberg wrote: > They require a lot of additional memory to keep state and PDU fragments > hanging around between packets. > Since they need (potentially) a lot more memory when enabled, they are > disabled by default. Ok. That makes sense.
> Strange. > I have myself decoded DCERPC packets spanning 200+ kb successfully, > fragmented on all three NBSS, SMB and DCERPC layers. > > You can send a trace to me (or to the list) and I (or someone else) can look > at it. > When doing so, please also specify which packet in the capture you think > there is a problem with. The trace is attached. The problem starts at packet 103. With the "Reassemble DCERPC over SMB" option disabled, the frame is shown as a LookupRIDs request (although it reports as a short frame). If "Reassemble DCERPC over SMB" is enabled, it is only shown as a DCE Request. Any feedback you can provide would be greatly appreciated. Thanks, -- Devin Heitmueller Senior Software Engineer Netilla Networks Inc
test_query_administrator_2000_fail.eth.gz
Description: GNU Zip compressed data
