Added SMB option : sid_name_snooping.
authorRonnie Sahlberg <ronnie_sahlberg@ozemail.com.au>
Tue, 25 Mar 2003 09:41:42 +0000 (09:41 -0000)
committerRonnie Sahlberg <ronnie_sahlberg@ozemail.com.au>
Tue, 25 Mar 2003 09:41:42 +0000 (09:41 -0000)
commitcec5c81ac3a5590cabdc28cf4d4e343ee9a8b33d
treeaafa8f25a9cde7e8e34b53bd4893ac4b8ac13c79
parent2fecf91a175d91f3c2d0a202cb0acd9a94068b40
Added SMB option : sid_name_snooping.

This feature, when enabled through Edit/preferences/protocols/smb,
will look at certain SMB and CIFS related protocols to discover the
mapping between SIDs and their Names.

For those SIDs whose name has been snooped/discovered ethereal will
also add "(<name>)" to the end of the SID when printed in the tree pane
through the function dissect_nt_sid().

Currently the feature is not too exciting since the only thing that packet-smb-sidsnooping.c will look at to build this mapping table is
replies to the LSA/QueryInfoPolicy infolevel 3  packets and thus
discover mappings between a Domain SID and a Domain Name.
In the near future this future will be enhanced to also look at more interesting calls such as LSA/LookupSIDs2 and similar.

svn path=/trunk/; revision=7362
Makefile.am
Makefile.nmake
packet-smb-sidsnooping.c [new file with mode: 0644]
packet-smb-sidsnooping.h [new file with mode: 0644]
packet-smb.c
smb.h