This is our old Q&A Site. Please post any new questions and answers at

Hi. When NBSS session or session smb occurs in the middle of the TCP packet, I can not see them properly in wireshark.alt text How do I can see the analysis of these protocols, if they are in the middle of the tcp packet? I tried to do it using the menu "Decode as...", but nothing happened.!

asked 26 May '16, 05:30

barabashka's gravatar image

accept rate: 0%

Working from a screenshot is prohibitively difficult. Can you share a capture in a publicly accessible spot, e.g. CloudShark?

(26 May '16, 05:57) Jaap ♦

Sorry for the long silence;) Here is the link I Thank you for your attention to this issue

(06 Jun '16, 01:56) barabashka


I moved your "answer" to a comment under the question when you posted it and then deleted the 2nd "answer" as it was a duplicate.

Please read the site FAQ for more information.

(06 Jun '16, 06:00) grahamb ♦

can see the analysis of these protocols, if they are in the middle of the tcp packet?

Currently, no. Wireshark would have to scan through the packet to find the beginning of the SMB2 message (which actually beings with the "NetBIOS SS" data - Wireshark really should be labeling port 445 traffic as SMB, not NBSS, as SMB-over-TCP uses something similar to, but simpler than, NBSS), show the data before it as continuation data, and show the SMB2 message. It currently doesn't do that.

It'd be a lot easier to test and implement it if we had a capture file, just as Jaap suggested.

permanent link

answered 26 May '16, 15:40

Guy%20Harris's gravatar image

Guy Harris ♦♦
accept rate: 19%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 26 May '16, 05:30

question was seen: 3,140 times

last updated: 06 Jun '16, 06:00

p​o​w​e​r​e​d by O​S​Q​A