I have posted patches to the Wireshark developers list to handle NT TRANSACT requests better ...

[Richard Sharpe]

Hi folks,

Attached is a patch for those interested (against the current
Wireshark SVN repos) that corrects the handling of NT TRANSACT
requests. It properly reassembles them, both requests and responses,
as far as I can tell.

There is still one unsatisfactory aspect ... but I will get there.

-- 
Regards,
Richard Sharpe
(何以解憂？唯有杜康。--曹操)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: packet-smb.nttrans.patch
Type: application/octet-stream
Size: 7146 bytes
Desc: not available
URL: <http://lists.samba.org/pipermail/samba-technical/attachments/20120609/1e994a0d/attachment.obj>