[SMB] NTCreateANDX quesiotn

[Michael B Allen]

On Fri, 8 Jun 2007 11:11:21 +0900
"yang mikey" <mikeyredmoon at gmail.com> wrote:

> hi, everybody
> I found a interesting thing,
> 
> when I see the header of NTCreateANCX[0xA2] via Ethereal
> I found the value of WORD COUNT is 42, but the position of BYTE COUNT is not
> at
> (offset of WORD COUNT) +  (value of  WORD COUNT) *2.
> 
> Why it happened, and How Ethereal knows  the correct position of BYTE COUNT.

The WordCount should be more like 24. I would have to see a capture
to understand what the problem is. It could be that Ethereal just got
confused. Try the latest Wireshark.

Mike