smb or smb2 packets are all parsed to tcp

decode

asked 2019-05-16 09:28:18 +0000

SteveZhou
201 ●30 ●37 ●42 Shanghai,China

Hi,

all of sudden, not sure what i did, all the smb or smb2 (tcp port 445) are now all displayed as tcp packets. I tried to Decode tcp 445 but there is no option of smb or smb2.

how do I recover this situation? A reinstallation of Wireshark doesn't get it fixed. I guess remove the Wireshark.app (on macOS 10.14.5) can help me, but I don't want to lose the current config.

thank you!

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2019-05-16 10:22:48 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23790 ●4 ●950 ●227 https://www.wireshark.org

Try going back to a default profile, in the bottom right of the Wireshark status bar, click the profile entry and choose "Default" from the list.

edit flag offensive delete link

Comments

aha, the 'Default' profile does show me the SMB traffic, so it is a problem of my current profile, any idea which configuration option could lead to this?

SteveZhou ( 2019-05-17 02:44:09 +0000 )edit

If an answer has solved your issue, for the benefit of others who may also have the same issue, please accept the answer by clicking the checkmark icon to the left of the answer

grahamb ( 2019-05-17 07:38:00 +0000 )edit

No idea what could be different. but you could save the default profile to another profile and then diff the newly saved profile and your faulty profile. Profiles are held in a profiles directory in your personal configuration directory (See Wireshark -> Help -> About Wireshark, Folders tab).

grahamb ( 2019-05-17 07:40:43 +0000 )edit

add a comment