SMB2 Write requests not displayed
This issue was migrated from bug 14598 in our old bug tracker.
Original bug information:
Reporter: PaulE
Status: RESOLVED FIXED
Product: Wireshark
Component: GTK+ UI
OS: Windows 10
Platform: x86
Version: 2.4.6
Attachments:
SMB2-capture.zip: Wireshark capture
: Screen Capture of 1.12.5
: Screen capture of 2.0.4
Activity
Created attachment 16258 Wireshark capture
Build Information: Version 2.4.6 (v2.4.6-0-ge2f395aa)
Copyright 1998-2018 Gerald Combs <gerald@wireshark.org> and contributors. License GPLv2+: GNU GPL version 2 or later <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html> This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with Qt 5.6.3, with WinPcap (4_1_3), with GLib 2.42.0, with zlib 1.2.8, with SMI 0.4.8, with c-ares 1.12.0, with Lua 5.2.4, with GnuTLS 3.4.11, with Gcrypt 1.7.6, with MIT Kerberos, with GeoIP, with nghttp2 1.14.0, with LZ4, with Snappy, with libxml2 2.9.4, with QtMultimedia, with AirPcap, with SBC, with SpanDSP.
Running on 64-bit Windows Server 2016, build 14393, with Intel(R) Xeon(R) CPU E5-2620 0 @ 2.00GHz (with SSE4.2), with 196573 MB of physical memory, with locale English_United States.1252, with WinPcap version 4.1.3 (packet.dll version 4.1.0.2980), based on libpcap version 1.0 branch 1_0_rel0b (20091008), with GnuTLS 3.4.11, with Gcrypt 1.7.6, without AirPcap.
Built using Microsoft Visual C++ 14.0 build 24215
I have noticed that the 2.X versions of Wireshark (on multiple Windows releases, I do not have the same information for Linux) do not display SMB2 write requests contained in network traces. However, the write responses are shown. I do know that the traces do contain write requests because Microsoft Message Analyzer does display them as well as a text dump from tshark. Working back through the different Wireshark releases eventually the write requests are displayed in the 1.x releases. Additionally, write requests are not displayed in the statistics window (Statistics->Service Response Time -> SMB2). Multiple people at my location have seen the same behavior. All install packages were downloaded from the Wireshark web site. 2.4.6 -> write requests are not displayed 2.4.5 -> write requests are not displayed 2.4.0 -> write requests are not displayed 2.2.13 -> write requests are not displayed 2.1.0 -> write requests are not displayed 2.0.4 -> write requests are not displayed 1.12.5 -> write requests ARE displayed Windows Versions tested: Windows 10, Windows 7, Server 2016 I will attach a short network trace that contains 3 write requests with the first write request being packet 78 (when using SMB2 as the filter). I have also attached 2 images one of which shows Wireshark version 1.12.5 displaying packet at 78 which is a write request and one that shows version 2.0.4 not displaying packet 78.added oswindows uigtk version2.4 labels
-
Change 26858 had a related patch set uploaded by Pascal Quantin: NBSS: take into account snaplen when creating the TVB subset
-
Change 26858 merged by Martin Kaiser: NBSS: take into account snaplen when creating the TVB subset
-
Change 26881 had a related patch set uploaded by Pascal Quantin: NBSS: take into account snaplen when creating the TVB subset
-
Change 26882 had a related patch set uploaded by Pascal Quantin: NBSS: take into account snaplen when creating the TVB subset
-
Change 26883 had a related patch set uploaded by Pascal Quantin: NBSS: take into account snaplen when creating the TVB subset
-
Change 26881 merged by Pascal Quantin: NBSS: take into account snaplen when creating the TVB subset
-
Change 26882 merged by Pascal Quantin: NBSS: take into account snaplen when creating the TVB subset
-
Change 26883 merged by Pascal Quantin: NBSS: take into account snaplen when creating the TVB subset