I instead of the marked raw stream data, i want smb detailed data.
capture:
https://easyupload.io/xglumm cant upload files so download from this link
a method which could be possible is creating a dissector\lua script or expending smb \ quic dissectors to be able to parse those packets
anyone know how can I do this? or if you have anything similier that does that? I want to know where to start from
This seems to be a simple change to make the netbios session service dissector register with the QUIC dissector, in packet-nbt.c:
proto_reg_handoff_nbt(void)
{
...
dissector_add_string("quic.proto", "smb", nbss_handle);
...
}
@Alexis La Goutte already has a MR 123 but I don't think it's correct as he's simply discarding the NetBIOS Session Service header.
the commit that @Alexis La Goutte pushed is sufficient for this problem? it will now parse the raw data? or there are still things to check? I see it is merged so whats the results now ?
It may work, I haven't checked with your capture, but I think it's wrong as it simply discards the NetBIOS Session Service header. I shall try to create another change to add in the parsing of the NBSS header.
FWIW, this change is not available in a stable release only in an automated build from the automated downloads area of the Wireshark website. Choose the most recent 3.3.0-rc build.
Asked: 2020-09-02 12:06:07 +0000
Seen: 479 times
Last updated: Sep 14 '20
There is a long running bug/issue to extend the QUIC dissector. Maybe ask there?
(This article seems to be referenced often for SMB and QUIC background)
@Chuckc but there is a dissector for QUIC, you it does decrypt and filter the data, It just will not parse the stream data (the same like RPC over SMB) , so how can I get that? the bug is working on that issue?
Facebook QUIC was split out into it's own issue.
I have asked on the original QUIC issue if that should be the case for SMB as well.
Check the comments at end of issue 13881.
Can you provide a sample capture and the info to decrypt?
Merge Request 123 has been merged.
SMB decode now available.
Tested with
/download/automated/win64.Version 3.3.0rc0-2043-g25d10e68a896 (v3.3.0rc0-2043-g25d10e68a896)