Ask Your Question

Parse SMB over QUIC packets

asked 2020-09-02 12:06:07 +0000

user_name gravatar image

updated 2020-09-04 10:49:06 +0000

I instead of the marked raw stream data, i want smb detailed data.

capture: cant upload files so download from this link

a method which could be possible is creating a dissector\lua script or expending smb \ quic dissectors to be able to parse those packets

anyone know how can I do this? or if you have anything similier that does that? I want to know where to start from

edit retag flag offensive close merge delete


There is a long running bug/issue to extend the QUIC dissector. Maybe ask there?
(This article seems to be referenced often for SMB and QUIC background)

Chuckc gravatar imageChuckc ( 2020-09-03 05:53:27 +0000 )edit

@Chuckc but there is a dissector for QUIC, you it does decrypt and filter the data, It just will not parse the stream data (the same like RPC over SMB) , so how can I get that? the bug is working on that issue?

user_name gravatar imageuser_name ( 2020-09-03 06:17:03 +0000 )edit

Facebook QUIC was split out into it's own issue.
I have asked on the original QUIC issue if that should be the case for SMB as well.

Check the comments at end of issue 13881.
Can you provide a sample capture and the info to decrypt?

Chuckc gravatar imageChuckc ( 2020-09-03 15:16:31 +0000 )edit

Merge Request 123 has been merged.
SMB decode now available.

Tested with /download/automated/win64.
Version 3.3.0rc0-2043-g25d10e68a896 (v3.3.0rc0-2043-g25d10e68a896)

Chuckc gravatar imageChuckc ( 2020-09-14 13:59:50 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2020-09-04 13:27:49 +0000

grahamb gravatar image

This seems to be a simple change to make the netbios session service dissector register with the QUIC dissector, in packet-nbt.c:

    dissector_add_string("quic.proto", "smb", nbss_handle);
edit flag offensive delete link more


I'll follow along with the merge request as a tutorial. :-)

Chuckc gravatar imageChuckc ( 2020-09-04 16:10:31 +0000 )edit

@Alexis La Goutte already has a MR 123 but I don't think it's correct as he's simply discarding the NetBIOS Session Service header.

grahamb gravatar imagegrahamb ( 2020-09-04 16:14:52 +0000 )edit

the commit that @Alexis La Goutte pushed is sufficient for this problem? it will now parse the raw data? or there are still things to check? I see it is merged so whats the results now ?

user_name gravatar imageuser_name ( 2020-09-06 09:51:13 +0000 )edit

It may work, I haven't checked with your capture, but I think it's wrong as it simply discards the NetBIOS Session Service header. I shall try to create another change to add in the parsing of the NBSS header.

FWIW, this change is not available in a stable release only in an automated build from the automated downloads area of the Wireshark website. Choose the most recent 3.3.0-rc build.

grahamb gravatar imagegrahamb ( 2020-09-06 11:04:09 +0000 )edit

your change will appear in the automated build as well ? if you are already working on it, maybe you can confirm? I never used the automated build before, it the same as to running the project from git and creating execute file?

user_name gravatar imageuser_name ( 2020-09-06 14:52:10 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2020-09-02 12:06:07 +0000

Seen: 412 times

Last updated: Sep 14 '20