On Mon, Jun 17, 2002 at 09:00:31PM -0400, Todd Sabin wrote: > Good stuff, but it's not working correctly for me. I only took a > glance, but I think it may be going wrong due to the auth data in my > capture. Did you one you worked on have any auth data?
Yes, but I didn't notice that "dissect_dcerpc_dg_auth()" has been broken for quite a while - it incorrectly computed the starting offset of the authentication data, as it used the fragment length as the offset rather than *adding* the fragment length to the offset of the beginning of the fragment data. I'm checking in a fix for that. That's probably not the cause of all the problems, though. Also, the one on which I worked didn't have all the fragments (it was missing IP fragments as well as DCE RPC fragments).
