It happens quite frequently that you have multiple NBSS messages in one TCP segment. Really.
On station is sending two or more _SMALL_ NBSS messages after each others on the same TCP session, all these NBSS messages have the PSH flag set so they are delivered one by one in their own unique _SMALL_ TCP segment. Assume the first small TCP segment is lost by the network. TCP retransmission kicks in and retransmits (up to) a full segment which contains the lost segment as well as as much as can fit from the later segments transmitted. TCP collapsing small segments to retransmit a full sized segment happens everytime we have TCP retranmsissions. For ONC-RPC it means we can get one TCP segment containing a HUGE number of GETATTR or other tiny commands. ----- Original Message ----- From: "Richard Sharpe" Sent: Tuesday, July 23, 2002 7:31 AM Subject: Re: [Ethereal-dev] COL_INFO for andX commands > On Mon, 22 Jul 2002, Guy Harris wrote: > > > On Tue, Jul 23, 2002 at 05:54:30AM +1000, Ronnie Sahlberg wrote: > > > The same problem also exists in the ONC-RPC dissector. > > > > There's no "andX" in ONC RPC (although there are COMPOUND operations in > > NFSv4); are you referring to having multiple ONC RPC requests or > > responses in a single TCP segment? If so, that exists for NBSS as well, > > so if you're concerned about that, there are *two* layers where it can > > happen for CIFS. > > Hmmm, because SMB is a request/response protocol, I cannot think of a case > where you are going to have two NBSS messages in a TCP segment in > practice? >
