Create a column to show smb credits requested/granted

asked 2020-10-06 14:46:45 +0000

petepete gravatar image

Hello.

I would like to create a column where I can display the smb credits requested/granted.

Looking at the filter reference I can see that the field names are as follows:

smb_direct.credits.granted smb_direct.credits.requested

I'm have tried doing this but I don't think the content I am seeing is correct, can anyone suggest the correct column format?

edit retag flag offensive close merge delete

Comments

Are you getting the proper decode?
The sample capture was being decoded as Artemis. Once that was disabled, the SMBDirect decode was available and the columns can be displayed.

Chuckc gravatar imageChuckc ( 2020-10-06 15:05:36 +0000 )edit

I am not sure. how can I tell if it is being decoded correctly? I can use smb_direct.credits.granted/smb_direct.credits.requested as a filter and it is recognized but nothing is displayed, not sure you can even use it as a filter as it would make no sense to do so

petepete gravatar imagepetepete ( 2020-10-06 15:12:12 +0000 )edit

This is what I have setup, but the information is blank on the capture output:

https://pasteboard.co/JupcG07.png

https://pasteboard.co/Jupd2ig.png

petepete gravatar imagepetepete ( 2020-10-06 15:20:13 +0000 )edit

If you pick one of the longer packets, right click and look at Decode As... Is there an entry for Current?
If the capture was being decoded as SMB Direct, the smb_direct fields would work as a filter to show which packets contain that field.

EDIT: Looks like it is being decoded as SMB. Are there any entries for SMBDirect in the protocol column?

Chuckc gravatar imageChuckc ( 2020-10-06 15:22:20 +0000 )edit

So if I hit decode on a create request I can see the following:

https://pasteboard.co/JupfCcb.png

Nothing is marked under current. Checking on the list I see no entry for SMB/SMB Direct

EDIT: Protocol column is showing all as SMB2

petepete gravatar imagepetepete ( 2020-10-06 15:28:22 +0000 )edit
see more comments