packet-smb-browse.c

   1 /* packet-smb-browse.c
   2  * Routines for SMB Browser packet dissection
   3  * Copyright 1999, Richard Sharpe <rsharpe@ns.aus.com>
   4  *
   5  * $Id: packet-smb-browse.c,v 1.34 2003/11/19 03:53:32 guy Exp $
   6  *
   7  * Ethereal - Network traffic analyzer
   8  * By Gerald Combs <gerald@ethereal.com>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * Copied from packet-pop.c
  12  *
  13  * This program is free software; you can redistribute it and/or
  14  * modify it under the terms of the GNU General Public License
  15  * as published by the Free Software Foundation; either version 2
  16  * of the License, or (at your option) any later version.
  17  *
  18  * This program is distributed in the hope that it will be useful,
  19  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21  * GNU General Public License for more details.
  22  *
  23  * You should have received a copy of the GNU General Public License
  24  * along with this program; if not, write to the Free Software
  25  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  26  */
  27
  28 #ifdef HAVE_CONFIG_H
  29 # include "config.h"
  30 #endif
  31
  32 #include <stdio.h>
  33
  34 #include <time.h>
  35 #include <string.h>
  36 #include <glib.h>
  37 #include <ctype.h>
  38 #include <epan/packet.h>
  39 #include "smb.h"
  40 #include "alignment.h"
  41
  42 #include "packet-smb-browse.h"
  43 #include "packet-dcerpc.h"
  44
  45 static int proto_smb_browse = -1;
  46 static int hf_command = -1;
  47 static int hf_update_count = -1;
  48 static int hf_periodicity = -1;
  49 static int hf_server_name = -1;
  50 static int hf_mb_server_name = -1;
  51 static int hf_mb_reset_command = -1;
  52 static int hf_mb_reset_demote = -1;
  53 static int hf_mb_reset_flush = -1;
  54 static int hf_mb_reset_stop = -1;
  55 static int hf_os_major = -1;
  56 static int hf_os_minor = -1;
  57 static int hf_server_type = -1;
  58 static int hf_server_type_workstation = -1;
  59 static int hf_server_type_server = -1;
  60 static int hf_server_type_sql = -1;
  61 static int hf_server_type_domain = -1;
  62 static int hf_server_type_backup = -1;
  63 static int hf_server_type_time = -1;
  64 static int hf_server_type_apple = -1;
  65 static int hf_server_type_novell = -1;
  66 static int hf_server_type_member = -1;
  67 static int hf_server_type_print = -1;
  68 static int hf_server_type_dialin = -1;
  69 static int hf_server_type_xenix = -1;
  70 static int hf_server_type_ntw = -1;
  71 static int hf_server_type_wfw = -1;
  72 static int hf_server_type_nts = -1;
  73 static int hf_server_type_potentialb = -1;
  74 static int hf_server_type_backupb = -1;
  75 static int hf_server_type_masterb = -1;
  76 static int hf_server_type_domainmasterb = -1;
  77 static int hf_server_type_osf = -1;
  78 static int hf_server_type_vms = -1;
  79 static int hf_server_type_w95 = -1;
  80 static int hf_server_type_local = -1;
  81 static int hf_server_type_domainenum = -1;
  82 static int hf_election_version = -1;
  83 static int hf_proto_major = -1;
  84 static int hf_proto_minor = -1;
  85 static int hf_sig_const = -1;
  86 static int hf_server_comment = -1;
  87 static int hf_unused_flags = -1;
  88 static int hf_response_computer_name = -1;
  89 static int hf_election_criteria = -1;
  90 static int hf_election_desire = -1;
  91 static int hf_election_desire_flags_backup = -1;
  92 static int hf_election_desire_flags_standby = -1;
  93 static int hf_election_desire_flags_master = -1;
  94 static int hf_election_desire_flags_domain_master = -1;
  95 static int hf_election_desire_flags_wins = -1;
  96 static int hf_election_desire_flags_nt = -1;
  97 static int hf_election_revision = -1;
  98 static int hf_election_os = -1;
  99 static int hf_election_os_wfw = -1;
 100 static int hf_election_os_ntw = -1;
 101 static int hf_election_os_nts = -1;
 102 static int hf_server_uptime = -1;
 103 static int hf_backup_count = -1;
 104 static int hf_backup_token = -1;
 105 static int hf_backup_server = -1;
 106 static int hf_browser_to_promote = -1;
 107
 108 static gint ett_browse = -1;
 109 static gint ett_browse_flags = -1;
 110 static gint ett_browse_election_criteria = -1;
 111 static gint ett_browse_election_os = -1;
 112 static gint ett_browse_election_desire = -1;
 113 static gint ett_browse_reset_cmd_flags = -1;
 114
 115 #define SERVER_WORKSTATION              0
 116 #define SERVER_SERVER                   1
 117 #define SERVER_SQL_SERVER               2
 118 #define SERVER_DOMAIN_CONTROLLER        3
 119 #define SERVER_BACKUP_CONTROLLER        4
 120 #define SERVER_TIME_SOURCE              5
 121 #define SERVER_APPLE_SERVER             6
 122 #define SERVER_NOVELL_SERVER            7
 123 #define SERVER_DOMAIN_MEMBER_SERVER     8
 124 #define SERVER_PRINT_QUEUE_SERVER       9
 125 #define SERVER_DIALIN_SERVER            10
 126 #define SERVER_XENIX_SERVER             11
 127 #define SERVER_NT_WORKSTATION           12
 128 #define SERVER_WINDOWS_FOR_WORKGROUPS   13
 129 #define SERVER_NT_SERVER                15
 130 #define SERVER_POTENTIAL_BROWSER        16
 131 #define SERVER_BACKUP_BROWSER           17
 132 #define SERVER_MASTER_BROWSER           18
 133 #define SERVER_DOMAIN_MASTER_BROWSER    19
 134 #define SERVER_OSF                      20
 135 #define SERVER_VMS                      21
 136 #define SERVER_WINDOWS_95               22
 137 #define SERVER_LOCAL_LIST_ONLY          30
 138 #define SERVER_DOMAIN_ENUM              31
 139
 140 static const value_string server_types[] = {
 141         {SERVER_WORKSTATION,            "Workstation"},
 142         {SERVER_SERVER,                 "Server"},
 143         {SERVER_SQL_SERVER,             "SQL Server"},
 144         {SERVER_DOMAIN_CONTROLLER,      "Domain Controller"},
 145         {SERVER_BACKUP_CONTROLLER,      "Backup Controller"},
 146         {SERVER_TIME_SOURCE,            "Time Source"},
 147         {SERVER_APPLE_SERVER,           "Apple Server"},
 148         {SERVER_NOVELL_SERVER,          "Novell Server"},
 149         {SERVER_DOMAIN_MEMBER_SERVER,   "Domain Member Server"},
 150         {SERVER_PRINT_QUEUE_SERVER,     "Print Queue Server"},
 151         {SERVER_DIALIN_SERVER,          "Dialin Server"},
 152         {SERVER_XENIX_SERVER,           "Xenix Server"},
 153         {SERVER_NT_WORKSTATION,         "NT Workstation"},
 154         {SERVER_WINDOWS_FOR_WORKGROUPS, "Windows for Workgroups"},
 155         {SERVER_NT_SERVER,              "NT Server"},
 156         {SERVER_POTENTIAL_BROWSER,      "Potential Browser"},
 157         {SERVER_BACKUP_BROWSER,         "Backup Browser"},
 158         {SERVER_MASTER_BROWSER,         "Master Browser"},
 159         {SERVER_DOMAIN_MASTER_BROWSER,  "Domain Master Browser"},
 160         {SERVER_OSF,                    "OSF"},
 161         {SERVER_VMS,                    "VMS"},
 162         {SERVER_WINDOWS_95,             "Windows 95 or above"},
 163         {SERVER_LOCAL_LIST_ONLY,        "Local List Only"},
 164         {SERVER_DOMAIN_ENUM,            "Domain Enum"},
 165         {0,     NULL}
 166 };
 167
 168 static const value_string resetbrowserstate_command_names[] = {
 169   { 0x01, "Stop being a master browser and become a backup browser"},
 170   { 0x02, "Discard browse lists, stop being a master browser, and try again"},
 171   { 0x04, "Stop being a master browser for ever"},
 172   { 0, NULL}
 173 };
 174
 175 static true_false_string tfs_demote_to_backup = {
 176         "Demote an LMB to a Backup Browser",
 177         "Do not demote an LMB to a Backup Browser"
 178 };
 179
 180 static true_false_string tfs_flush_browse_list = {
 181         "Flush the Browse List",
 182         "Do not Flush the Browse List"
 183 };
 184
 185 static true_false_string tfs_stop_being_lmb = {
 186         "Stop Being a Local Master Browser",
 187         "Do not Stop Being a Local Master Browser"
 188 };
 189
 190 static const true_false_string tfs_workstation = {
 191         "This is a Workstation",
 192         "This is NOT a Workstation"
 193 };
 194 static const true_false_string tfs_server = {
 195         "This is a Server",
 196         "This is NOT a Server"
 197 };
 198 static const true_false_string tfs_sql = {
 199         "This is an SQL server",
 200         "This is NOT an SQL server"
 201 };
 202 static const true_false_string tfs_domain = {
 203         "This is a Domain Controller",
 204         "This is NOT a Domain Controller"
 205 };
 206 static const true_false_string tfs_backup = {
 207         "This is a Backup Controller",
 208         "This is NOT a Backup Controller"
 209 };
 210 static const true_false_string tfs_time = {
 211         "This is a Time Source",
 212         "This is NOT a Time Source"
 213 };
 214 static const true_false_string tfs_apple = {
 215         "This is an Apple host",
 216         "This is NOT an Apple host"
 217 };
 218 static const true_false_string tfs_novell = {
 219         "This is a Novell server",
 220         "This is NOT a Novell server"
 221 };
 222 static const true_false_string tfs_member = {
 223         "This is a Domain Member server",
 224         "This is NOT a Domain Member server"
 225 };
 226 static const true_false_string tfs_print = {
 227         "This is a Print Queue server",
 228         "This is NOT a Print Queue server"
 229 };
 230 static const true_false_string tfs_dialin = {
 231         "This is a Dialin server",
 232         "This is NOT a Dialin server"
 233 };
 234 static const true_false_string tfs_xenix = {
 235         "This is a Xenix server",
 236         "This is NOT a Xenix server"
 237 };
 238 static const true_false_string tfs_ntw = {
 239         "This is an NT Workstation",
 240         "This is NOT an NT Workstation"
 241 };
 242 static const true_false_string tfs_wfw = {
 243         "This is a WfW host",
 244         "This is NOT a WfW host"
 245 };
 246 static const true_false_string tfs_nts = {
 247         "This is an NT Server",
 248         "This is NOT an NT Server"
 249 };
 250 static const true_false_string tfs_potentialb = {
 251         "This is a Potential Browser",
 252         "This is NOT a Potential Browser"
 253 };
 254 static const true_false_string tfs_backupb = {
 255         "This is a Backup Browser",
 256         "This is NOT a Backup Browser"
 257 };
 258 static const true_false_string tfs_masterb = {
 259         "This is a Master Browser",
 260         "This is NOT a Master Browser"
 261 };
 262 static const true_false_string tfs_domainmasterb = {
 263         "This is a Domain Master Browser",
 264         "This is NOT a Domain Master Browser"
 265 };
 266 static const true_false_string tfs_osf = {
 267         "This is an OSF host",
 268         "This is NOT an OSF host"
 269 };
 270 static const true_false_string tfs_vms = {
 271         "This is a VMS host",
 272         "This is NOT a VMS host"
 273 };
 274 static const true_false_string tfs_w95 = {
 275         "This is a Windows 95 or above host",
 276         "This is NOT a Windows 95 or above host"
 277 };
 278 static const true_false_string tfs_local = {
 279         "This is a local list only request",
 280         "This is NOT a local list only request"
 281 };
 282 static const true_false_string tfs_domainenum = {
 283         "This is a Domain Enum request",
 284         "This is NOT a Domain Enum request"
 285 };
 286
 287 #define DESIRE_BACKUP                   0
 288 #define DESIRE_STANDBY                  1
 289 #define DESIRE_MASTER                   2
 290 #define DESIRE_DOMAIN_MASTER            3
 291 #define DESIRE_WINS                     5
 292 #define DESIRE_NT                       7
 293
 294 static const value_string desire_flags[] = {
 295         {DESIRE_BACKUP,         "Backup Browse Server"},
 296         {DESIRE_STANDBY,        "Standby Browse Server"},
 297         {DESIRE_MASTER,         "Master Browser"},
 298         {DESIRE_DOMAIN_MASTER,  "Domain Master Browse Server"},
 299         {DESIRE_WINS,           "WINS Client"},
 300         {DESIRE_NT,             "Windows NT Advanced Server"},
 301         {0,                     NULL}
 302 };
 303
 304 static const true_false_string tfs_desire_backup = {
 305         "Backup Browse Server",
 306         "NOT Backup Browse Server"
 307  };
 308 static const true_false_string tfs_desire_standby = {
 309         "Standby Browse Server",
 310         "NOT Standby Browse Server"
 311 };
 312 static const true_false_string tfs_desire_master = {
 313         "Master Browser",
 314         "NOT Master Browser"
 315 };
 316 static const true_false_string tfs_desire_domain_master = {
 317         "Domain Master Browse Server",
 318         "NOT Domain Master Browse Server"
 319 };
 320 static const true_false_string tfs_desire_wins = {
 321         "WINS Client",
 322         "NOT WINS Client"
 323 };
 324 static const true_false_string tfs_desire_nt = {
 325         "Windows NT Advanced Server",
 326         "NOT Windows NT Advanced Server"
 327 };
 328
 329 #define BROWSE_HOST_ANNOUNCE                    1
 330 #define BROWSE_REQUEST_ANNOUNCE                 2
 331 #define BROWSE_ELECTION_REQUEST                 8
 332 #define BROWSE_BACKUP_LIST_REQUEST              9
 333 #define BROWSE_BACKUP_LIST_RESPONSE             10
 334 #define BROWSE_BECOME_BACKUP                    11
 335 #define BROWSE_DOMAIN_ANNOUNCEMENT              12
 336 #define BROWSE_MASTER_ANNOUNCEMENT              13
 337 #define BROWSE_RESETBROWSERSTATE_ANNOUNCEMENT   14
 338 #define BROWSE_LOCAL_MASTER_ANNOUNCEMENT        15
 339
 340 static const value_string commands[] = {
 341         {BROWSE_HOST_ANNOUNCE,          "Host Announcement"},
 342         {BROWSE_REQUEST_ANNOUNCE,       "Request Announcement"},
 343         {BROWSE_ELECTION_REQUEST,       "Browser Election Request"},
 344         {BROWSE_BACKUP_LIST_REQUEST,    "Get Backup List Request"},
 345         {BROWSE_BACKUP_LIST_RESPONSE,   "Get Backup List Response"},
 346         {BROWSE_BECOME_BACKUP,          "Become Backup Browser"},
 347         {BROWSE_DOMAIN_ANNOUNCEMENT,    "Domain/Workgroup Announcement"},
 348         {BROWSE_MASTER_ANNOUNCEMENT,    "Master Announcement"},
 349         {BROWSE_RESETBROWSERSTATE_ANNOUNCEMENT, "Reset Browser State Announcement"},
 350         {BROWSE_LOCAL_MASTER_ANNOUNCEMENT,"Local Master Announcement"},
 351         {0,                             NULL}
 352 };
 353
 354 #define OS_WFW                          0
 355 #define OS_NTW                          4
 356 #define OS_NTS                          5
 357
 358 static const value_string os_flags[] = {
 359         {OS_WFW,                "Windows for Workgroups"},
 360         {OS_NTW,                "Windows NT Workstation"},
 361         {OS_NTS,                "Windows NT Server"},
 362         {0,                     NULL}
 363 };
 364
 365 static const true_false_string tfs_os_wfw = {
 366         "Windows for Workgroups",
 367         "Not Windows for Workgroups"
 368 };
 369 static const true_false_string tfs_os_ntw = {
 370         "Windows NT Workstation",
 371         "Not Windows NT Workstation"
 372 };
 373 static const true_false_string tfs_os_nts = {
 374         "Windows NT Server",
 375         "Not Windows NT Server"
 376 };
 377
 378 static void
 379 dissect_election_criterion_os(tvbuff_t *tvb, proto_tree *parent_tree, int offset)
 380 {
 381         proto_tree *tree = NULL;
 382         proto_item *item = NULL;
 383         guint8 os;
 384
 385         os = tvb_get_guint8(tvb, offset);
 386
 387         if (parent_tree) {
 388                 item = proto_tree_add_uint(parent_tree, hf_election_os, tvb, offset, 1, os);
 389                 tree = proto_item_add_subtree(item, ett_browse_election_os);
 390         }
 391
 392         proto_tree_add_boolean(tree, hf_election_os_wfw,
 393                 tvb, offset, 1, os);
 394         proto_tree_add_boolean(tree, hf_election_os_ntw,
 395                 tvb, offset, 1, os);
 396         proto_tree_add_boolean(tree, hf_election_os_nts,
 397                 tvb, offset, 1, os);
 398
 399 }
 400
 401 static void
 402 dissect_election_criterion_desire(tvbuff_t *tvb, proto_tree *parent_tree, int offset)
 403 {
 404         proto_tree *tree = NULL;
 405         proto_item *item = NULL;
 406         guint8 desire;
 407
 408         desire = tvb_get_guint8(tvb, offset);
 409
 410         if (parent_tree) {
 411                 item = proto_tree_add_uint(parent_tree, hf_election_desire, tvb, offset, 1, desire);
 412                 tree = proto_item_add_subtree(item, ett_browse_election_desire);
 413         }
 414
 415         proto_tree_add_boolean(tree, hf_election_desire_flags_backup,
 416                 tvb, offset, 1, desire);
 417         proto_tree_add_boolean(tree, hf_election_desire_flags_standby,
 418                 tvb, offset, 1, desire);
 419         proto_tree_add_boolean(tree, hf_election_desire_flags_master,
 420                 tvb, offset, 1, desire);
 421         proto_tree_add_boolean(tree, hf_election_desire_flags_domain_master,
 422                 tvb, offset, 1, desire);
 423         proto_tree_add_boolean(tree, hf_election_desire_flags_wins,
 424                 tvb, offset, 1, desire);
 425         proto_tree_add_boolean(tree, hf_election_desire_flags_nt,
 426                 tvb, offset, 1, desire);
 427
 428 }
 429
 430 static void
 431 dissect_election_criterion(tvbuff_t *tvb, proto_tree *parent_tree, int offset)
 432 {
 433         proto_tree *tree = NULL;
 434         proto_item *item = NULL;
 435         guint32 criterion;
 436
 437         criterion = tvb_get_letohl(tvb, offset);
 438
 439         if (parent_tree) {
 440                 item = proto_tree_add_uint(parent_tree, hf_election_criteria, tvb, offset, 4, criterion);
 441                 tree = proto_item_add_subtree(item, ett_browse_election_criteria);
 442         }
 443
 444         /* election desire */
 445         dissect_election_criterion_desire(tvb, tree, offset);
 446         offset += 1;
 447
 448         /* browser protocol major version */
 449         proto_tree_add_item(tree, hf_proto_major, tvb, offset, 1, TRUE);
 450         offset += 1;
 451
 452         /* browser protocol minor version */
 453         proto_tree_add_item(tree, hf_proto_minor, tvb, offset, 1, TRUE);
 454         offset += 1;
 455
 456         /* election os */
 457         dissect_election_criterion_os(tvb, tree, offset);
 458         offset += 1;
 459
 460 }
 461
 462 /*
 463  * XXX - this causes non-browser packets to have browser fields.
 464  */
 465 int
 466 dissect_smb_server_type_flags(tvbuff_t *tvb, int offset, packet_info *pinfo,
 467                               proto_tree *parent_tree, char *drep,
 468                               gboolean infoflag)
 469 {
 470         proto_tree *tree = NULL;
 471         proto_item *item = NULL;
 472         guint32 flags;
 473         int i;
 474
 475         if (drep != NULL) {
 476                 /*
 477                  * Called from a DCE RPC protocol dissector, for a
 478                  * protocol where a 32-bit NDR integer contains
 479                  * an server type mask; extract the server type mask
 480                  * with an NDR call.
 481                  */
 482                 offset = dissect_ndr_uint32(
 483                         tvb, offset, pinfo, tree, drep, hf_server_type, &flags);
 484         } else {
 485                 /*
 486                  * Called from SMB browser or RAS, where the server type
 487                  * mask is just a 4-byte little-endian quantity with no
 488                  * special NDR alignment requirement; extract it with
 489                  * "tvb_get_letohl()".
 490                  */
 491                 flags = tvb_get_letohl(tvb, offset);
 492                 offset += 4;
 493         }
 494
 495         if (parent_tree) {
 496                 item = proto_tree_add_uint(parent_tree, hf_server_type, tvb, offset, 4, flags);
 497                 tree = proto_item_add_subtree(item, ett_browse_flags);
 498         }
 499
 500         if (infoflag) {
 501                 /* Append the type(s) of the system to the COL_INFO line ... */
 502                 if (check_col(pinfo->cinfo, COL_INFO)) {
 503                         for (i = 0; i < 32; i++) {
 504                                 if (flags & (1<<i)) {
 505                                         col_append_fstr(pinfo->cinfo, COL_INFO, ", %s",
 506                                                 val_to_str(i, server_types,
 507                                                 "Unknown server type:%d"));
 508                                 }
 509                         }
 510                 }
 511         }
 512
 513         proto_tree_add_boolean(tree, hf_server_type_workstation,
 514                 tvb, offset, 4, flags);
 515         proto_tree_add_boolean(tree, hf_server_type_server,
 516                 tvb, offset, 4, flags);
 517         proto_tree_add_boolean(tree, hf_server_type_sql,
 518                 tvb, offset, 4, flags);
 519         proto_tree_add_boolean(tree, hf_server_type_domain,
 520                 tvb, offset, 4, flags);
 521         proto_tree_add_boolean(tree, hf_server_type_backup,
 522                 tvb, offset, 4, flags);
 523         proto_tree_add_boolean(tree, hf_server_type_time,
 524                 tvb, offset, 4, flags);
 525         proto_tree_add_boolean(tree, hf_server_type_apple,
 526                 tvb, offset, 4, flags);
 527         proto_tree_add_boolean(tree, hf_server_type_novell,
 528                 tvb, offset, 4, flags);
 529         proto_tree_add_boolean(tree, hf_server_type_member,
 530                 tvb, offset, 4, flags);
 531         proto_tree_add_boolean(tree, hf_server_type_print,
 532                 tvb, offset, 4, flags);
 533         proto_tree_add_boolean(tree, hf_server_type_dialin,
 534                 tvb, offset, 4, flags);
 535         proto_tree_add_boolean(tree, hf_server_type_xenix,
 536                 tvb, offset, 4, flags);
 537         proto_tree_add_boolean(tree, hf_server_type_ntw,
 538                 tvb, offset, 4, flags);
 539         proto_tree_add_boolean(tree, hf_server_type_wfw,
 540                 tvb, offset, 4, flags);
 541         proto_tree_add_boolean(tree, hf_server_type_nts,
 542                 tvb, offset, 4, flags);
 543         proto_tree_add_boolean(tree, hf_server_type_potentialb,
 544                 tvb, offset, 4, flags);
 545         proto_tree_add_boolean(tree, hf_server_type_backupb,
 546                 tvb, offset, 4, flags);
 547         proto_tree_add_boolean(tree, hf_server_type_masterb,
 548                 tvb, offset, 4, flags);
 549         proto_tree_add_boolean(tree, hf_server_type_domainmasterb,
 550                 tvb, offset, 4, flags);
 551         proto_tree_add_boolean(tree, hf_server_type_osf,
 552                 tvb, offset, 4, flags);
 553         proto_tree_add_boolean(tree, hf_server_type_vms,
 554                 tvb, offset, 4, flags);
 555         proto_tree_add_boolean(tree, hf_server_type_w95,
 556                 tvb, offset, 4, flags);
 557         proto_tree_add_boolean(tree, hf_server_type_local,
 558                 tvb, offset, 4, flags);
 559         proto_tree_add_boolean(tree, hf_server_type_domainenum,
 560                 tvb, offset, 4, flags);
 561
 562         return offset;
 563 }
 564
 565
 566 static void
 567 dissect_mailslot_browse(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree)
 568 {
 569         int offset = 0;
 570         guint8 cmd;
 571         proto_tree *tree = NULL;
 572         proto_item *item = NULL;
 573         guint32 periodicity;
 574         char host_name[17];
 575         guint namelen;
 576         guint8 server_count, reset_cmd;
 577         int i;
 578         guint32 uptime;
 579
 580         if (check_col(pinfo->cinfo, COL_PROTOCOL)) {
 581                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "BROWSER");
 582         }
 583         if (check_col(pinfo->cinfo, COL_INFO)) {
 584                 col_clear(pinfo->cinfo, COL_INFO);
 585         }
 586
 587         cmd = tvb_get_guint8(tvb, offset);
 588
 589         if (check_col(pinfo->cinfo, COL_INFO)) {
 590                 /* Put in something, and replace it later */
 591                 col_set_str(pinfo->cinfo, COL_INFO, val_to_str(cmd, commands, "Unknown command:0x%02x"));
 592         }
 593
 594
 595         if (parent_tree) {
 596                 item = proto_tree_add_item(parent_tree, proto_smb_browse, tvb, offset, -1, TRUE);
 597
 598                 tree = proto_item_add_subtree(item, ett_browse);
 599         }
 600
 601         /* command */
 602         proto_tree_add_uint(tree, hf_command, tvb, offset, 1, cmd);
 603         offset += 1;
 604
 605         switch (cmd) {
 606         case BROWSE_DOMAIN_ANNOUNCEMENT:
 607         case BROWSE_LOCAL_MASTER_ANNOUNCEMENT:
 608         case BROWSE_HOST_ANNOUNCE: {
 609                 /* update count */
 610                 proto_tree_add_item(tree, hf_update_count, tvb, offset, 1, TRUE);
 611                 offset += 1;
 612
 613                 /* periodicity (in milliseconds) */
 614                 periodicity = tvb_get_letohl(tvb, offset);
 615                 proto_tree_add_uint_format(tree, hf_periodicity, tvb, offset, 4,
 616                     periodicity,
 617                     "Update Periodicity: %s",
 618                     time_msecs_to_str(periodicity));
 619                 offset += 4;
 620
 621                 /* server name */
 622                 tvb_get_nstringz0(tvb, offset, sizeof(host_name), host_name);
 623                 if (check_col(pinfo->cinfo, COL_INFO)) {
 624                         col_append_fstr(pinfo->cinfo, COL_INFO, " %s", host_name);
 625                 }
 626                 proto_tree_add_string_format(tree, hf_server_name,
 627                         tvb, offset, 16,
 628                         host_name,
 629                         (cmd==BROWSE_DOMAIN_ANNOUNCEMENT)?
 630                                 "Domain/Workgroup: %s":
 631                                 "Host Name: %s",
 632                         host_name);
 633                 offset += 16;
 634
 635                 /* OS major version */
 636                 proto_tree_add_item(tree, hf_os_major, tvb, offset, 1, TRUE);
 637                 offset += 1;
 638
 639                 /* OS minor version */
 640                 proto_tree_add_item(tree, hf_os_minor, tvb, offset, 1, TRUE);
 641                 offset += 1;
 642
 643                 /* server type flags */
 644                 offset = dissect_smb_server_type_flags(
 645                         tvb, offset, pinfo, tree, NULL, TRUE);
 646
 647                 if (cmd == BROWSE_DOMAIN_ANNOUNCEMENT) {
 648                         /*
 649                          * Network Monitor claims this is a "Comment
 650                          * Pointer".  I don't believe it.
 651                          *
 652                          * It's not a browser protocol major/minor
 653                          * version number, and signature constant,
 654                          * however.
 655                          */
 656                         proto_tree_add_text(tree, tvb, offset, 4,
 657                             "Mysterious Field: 0x%08x",
 658                             tvb_get_letohl(tvb, offset));
 659                         offset += 4;
 660                 } else {
 661                         /* browser protocol major version */
 662                         proto_tree_add_item(tree, hf_proto_major, tvb, offset, 1, TRUE);
 663                         offset += 1;
 664
 665                         /* browser protocol minor version */
 666                         proto_tree_add_item(tree, hf_proto_minor, tvb, offset, 1, TRUE);
 667                         offset += 1;
 668
 669                         /* signature constant */
 670                         proto_tree_add_item(tree, hf_sig_const, tvb, offset, 2, TRUE);
 671                         offset += 2;
 672                 }
 673
 674                 /* master browser server name or server comment */
 675                 namelen = tvb_strsize(tvb, offset);
 676                 proto_tree_add_item(tree,
 677                         (cmd==BROWSE_DOMAIN_ANNOUNCEMENT)?
 678                             hf_mb_server_name : hf_server_comment,
 679                         tvb, offset, namelen, TRUE);
 680                 offset += namelen;
 681                 break;
 682         }
 683         case BROWSE_REQUEST_ANNOUNCE: {
 684                 char *computer_name;
 685
 686                 /* unused/unknown flags */
 687                 proto_tree_add_item(tree, hf_unused_flags,
 688                         tvb, offset, 1, TRUE);
 689                 offset += 1;
 690
 691                 /* name of computer to which to send reply */
 692                 computer_name = tvb_get_stringz(tvb, offset, &namelen);
 693                 proto_tree_add_string(tree, hf_response_computer_name,
 694                         tvb, offset, namelen, computer_name);
 695                 if (check_col(pinfo->cinfo, COL_INFO))
 696                         col_append_fstr(
 697                                 pinfo->cinfo, COL_INFO, " %s", computer_name);
 698                 g_free(computer_name);
 699                 offset += namelen;
 700                 break;
 701         }
 702
 703         case BROWSE_ELECTION_REQUEST:
 704                 /* election version */
 705                 proto_tree_add_item(tree, hf_election_version, tvb, offset, 1, TRUE);
 706                 offset += 1;
 707
 708                 /* criterion */
 709                 dissect_election_criterion(tvb, tree, offset);
 710                 offset += 4;
 711
 712                 /* server uptime */
 713                 uptime = tvb_get_letohl(tvb, offset);
 714                 proto_tree_add_uint_format(tree, hf_server_uptime,
 715                     tvb, offset, 4, uptime,
 716                     "Uptime: %s",
 717                     time_msecs_to_str(uptime));
 718                 offset += 4;
 719
 720                 /* next 4 bytes must be zero */
 721                 offset += 4;
 722
 723                 /* server name */
 724                 namelen = tvb_strsize(tvb, offset);
 725                 proto_tree_add_item(tree, hf_server_name,
 726                         tvb, offset, namelen, TRUE);
 727                 offset += namelen;
 728                 break;
 729
 730         case BROWSE_BACKUP_LIST_REQUEST:
 731                 /* backup list requested count */
 732                 proto_tree_add_item(tree, hf_backup_count, tvb, offset, 1, TRUE);
 733                 offset += 1;
 734
 735                 /* backup requested token */
 736                 proto_tree_add_item(tree, hf_backup_token, tvb, offset, 4, TRUE);
 737                 offset += 4;
 738                 break;
 739
 740         case BROWSE_BACKUP_LIST_RESPONSE:
 741                 /* backup list requested count */
 742                 server_count = tvb_get_guint8(tvb, offset);
 743                 proto_tree_add_uint(tree, hf_backup_count, tvb, offset, 1,
 744                     server_count);
 745                 offset += 1;
 746
 747                 /* backup requested token */
 748                 proto_tree_add_item(tree, hf_backup_token, tvb, offset, 4, TRUE);
 749                 offset += 4;
 750
 751                 /* backup server names */
 752                 for (i = 0; i < server_count; i++) {
 753                         namelen = tvb_strsize(tvb, offset);
 754                         proto_tree_add_item(tree, hf_backup_server,
 755                                 tvb, offset, namelen, TRUE);
 756                         offset += namelen;
 757                 }
 758                 break;
 759
 760         case BROWSE_MASTER_ANNOUNCEMENT:
 761                 /* master browser server name */
 762                 namelen = tvb_strsize(tvb, offset);
 763                 proto_tree_add_item(tree, hf_mb_server_name,
 764                         tvb, offset, namelen, TRUE);
 765                 offset += namelen;
 766                 break;
 767
 768         case BROWSE_RESETBROWSERSTATE_ANNOUNCEMENT: {
 769                 proto_tree *sub_tree;
 770                 proto_item *reset_item;
 771
 772                 /* the subcommand follows ... one of three values */
 773
 774                 reset_cmd = tvb_get_guint8(tvb, offset);
 775                 reset_item = proto_tree_add_uint(tree, hf_mb_reset_command, tvb,
 776                                                  offset, 1, reset_cmd);
 777                 sub_tree = proto_item_add_subtree(item, ett_browse_reset_cmd_flags);
 778                 proto_tree_add_boolean(sub_tree, hf_mb_reset_demote, tvb,
 779                                        offset, 1, reset_cmd);
 780                 proto_tree_add_boolean(sub_tree, hf_mb_reset_flush, tvb,
 781                                        offset, 1, reset_cmd);
 782                 proto_tree_add_boolean(sub_tree, hf_mb_reset_stop, tvb,
 783                                        offset, 1, reset_cmd);
 784                 offset += 1;
 785                 break;
 786         }
 787
 788         case BROWSE_BECOME_BACKUP:
 789                 /* name of browser to promote */
 790                 namelen = tvb_strsize(tvb, offset);
 791                 proto_tree_add_item(tree, hf_browser_to_promote,
 792                         tvb, offset, namelen, TRUE);
 793                 offset += namelen;
 794                 break;
 795         }
 796 }
 797
 798 /*
 799  * It appears that browser announcements sent to \MAILSLOT\LANMAN aren't
 800  * the same as browser announcements sent to \MAILSLOT\BROWSE.
 801  * Was that an older version of the protocol?
 802  *
 803  * The document at
 804  *
 805  *      http://www.samba.org/samba/ftp/specs/brow_rev.txt
 806  *
 807  * gives both formats of host announcement packets, saying that
 808  * "[The first] format seems wrong", that one being what appears to
 809  * show up in \MAILSLOT\LANMAN packets, and that "[The second one]
 810  * may be better", that one being what appears to show up in
 811  * \MAILSLOT\BROWSE packets.
 812  *
 813  * XXX - what other browser packets go out to that mailslot?
 814  */
 815 static void
 816 dissect_mailslot_lanman(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree)
 817 {
 818         int offset = 0;
 819         guint8 cmd;
 820         proto_tree *tree = NULL;
 821         proto_item *item = NULL;
 822         guint32 periodicity;
 823         const char *host_name;
 824         guint namelen;
 825
 826         if (check_col(pinfo->cinfo, COL_PROTOCOL)) {
 827                 col_set_str(pinfo->cinfo, COL_PROTOCOL, "BROWSER");
 828         }
 829         if (check_col(pinfo->cinfo, COL_INFO)) {
 830                 col_clear(pinfo->cinfo, COL_INFO);
 831         }
 832
 833         cmd = tvb_get_guint8(tvb, offset);
 834
 835         if (check_col(pinfo->cinfo, COL_INFO)) {
 836                 /* Put in something, and replace it later */
 837                 col_set_str(pinfo->cinfo, COL_INFO, val_to_str(cmd, commands, "Unknown command:0x%02x"));
 838         }
 839
 840
 841         if (parent_tree) {
 842                 item = proto_tree_add_item(parent_tree, proto_smb_browse, tvb, offset, -1, TRUE);
 843
 844                 tree = proto_item_add_subtree(item, ett_browse);
 845         }
 846
 847         /* command */
 848         proto_tree_add_uint(tree, hf_command, tvb, offset, 1, cmd);
 849         offset += 1;
 850
 851         switch (cmd) {
 852         case BROWSE_DOMAIN_ANNOUNCEMENT:
 853         case BROWSE_LOCAL_MASTER_ANNOUNCEMENT:
 854         case BROWSE_HOST_ANNOUNCE:
 855
 856                 /* update count */
 857                 proto_tree_add_item(tree, hf_update_count, tvb, offset, 1, TRUE);
 858                 offset += 1;
 859
 860                 /* server type flags */
 861                 offset = dissect_smb_server_type_flags(
 862                         tvb, offset, pinfo, tree, NULL, TRUE);
 863
 864                 /* OS major version */
 865                 proto_tree_add_item(tree, hf_os_major, tvb, offset, 1, TRUE);
 866                 offset += 1;
 867
 868                 /* OS minor version */
 869                 proto_tree_add_item(tree, hf_os_minor, tvb, offset, 1, TRUE);
 870                 offset += 1;
 871
 872                 /* periodicity (in seconds; convert to milliseconds) */
 873                 periodicity = tvb_get_letohs(tvb, offset)*1000;
 874                 proto_tree_add_uint_format(tree, hf_periodicity, tvb, offset, 2,
 875                     periodicity,
 876                     "Update Periodicity: %s",
 877                     time_msecs_to_str(periodicity));
 878                 offset += 2;
 879
 880                 /* server name */
 881                 namelen = tvb_strsize(tvb, offset);
 882                 host_name = tvb_get_ptr(tvb, offset, namelen);
 883                 if (check_col(pinfo->cinfo, COL_INFO)) {
 884                         col_append_fstr(pinfo->cinfo, COL_INFO, " %s", host_name);
 885                 }
 886                 proto_tree_add_item(tree, hf_server_name,
 887                         tvb, offset, namelen, TRUE);
 888                 offset += namelen;
 889
 890                 /* master browser server name or server comment */
 891                 namelen = tvb_strsize(tvb, offset);
 892                 proto_tree_add_item(tree,
 893                         (cmd==BROWSE_DOMAIN_ANNOUNCEMENT)?
 894                             hf_mb_server_name : hf_server_comment,
 895                         tvb, offset, namelen, TRUE);
 896                 offset += namelen;
 897                 break;
 898         }
 899 }
 900
 901 void
 902 proto_register_smb_browse(void)
 903 {
 904         static hf_register_info hf[] = {
 905                 { &hf_command,
 906                         { "Command", "browser.command", FT_UINT8, BASE_HEX,
 907                         VALS(commands), 0, "Browse command opcode", HFILL }},
 908
 909                 { &hf_update_count,
 910                         { "Update Count", "browser.update_count", FT_UINT8, BASE_DEC,
 911                         NULL, 0, "Browse Update Count", HFILL }},
 912
 913                 { &hf_periodicity,
 914                         { "Update Periodicity", "browser.period", FT_UINT32, BASE_DEC,
 915                         NULL, 0, "Update Periodicity in ms", HFILL }},
 916
 917                 { &hf_server_name,
 918                         { "Server Name", "browser.server", FT_STRING, BASE_NONE,
 919                         NULL, 0, "BROWSE Server Name", HFILL }},
 920
 921                 { &hf_mb_server_name,
 922                         { "Master Browser Server Name", "browser.mb_server", FT_STRING, BASE_NONE,
 923                         NULL, 0, "BROWSE Master Browser Server Name", HFILL }},
 924
 925                 { &hf_mb_reset_command,
 926                   { "ResetBrowserState Command", "browser.reset_cmd", FT_UINT8,
 927                     BASE_HEX, VALS(&resetbrowserstate_command_names), 0,
 928                     "ResetBrowserState Command", HFILL }},
 929                 { &hf_mb_reset_demote,
 930                   { "Demote LMB", "browser.reset_cmd.demote", FT_BOOLEAN,
 931                     8, TFS(&tfs_demote_to_backup), 0x01, "Demote LMB", HFILL}},
 932                 { &hf_mb_reset_flush,
 933                   { "Flush Browse List", "browser.reset_cmd.flush", FT_BOOLEAN,
 934                     8, TFS(&tfs_flush_browse_list), 0x02, "Flush Browse List", HFILL}},
 935                 { &hf_mb_reset_stop,
 936                   { "Stop Being LMB", "browser.reset_cmd.stop_lmb", FT_BOOLEAN,
 937                     8, TFS(&tfs_stop_being_lmb), 0x04, "Stop Being LMB", HFILL}},
 938                 { &hf_os_major,
 939                         { "OS Major Version", "browser.os_major", FT_UINT8, BASE_DEC,
 940                         NULL, 0, "Operating System Major Version", HFILL }},
 941
 942                 { &hf_os_minor,
 943                         { "OS Minor Version", "browser.os_minor", FT_UINT8, BASE_DEC,
 944                         NULL, 0, "Operating System Minor Version", HFILL }},
 945
 946                 { &hf_server_type,
 947                         { "Server Type", "browser.server_type", FT_UINT32, BASE_HEX,
 948                         NULL, 0, "Server Type Flags", HFILL }},
 949
 950                 { &hf_server_type_workstation,
 951                         { "Workstation", "browser.server_type.workstation", FT_BOOLEAN, 32,
 952                         TFS(&tfs_workstation), 1<<SERVER_WORKSTATION, "Is This A Workstation?", HFILL }},
 953
 954                 { &hf_server_type_server,
 955                         { "Server", "browser.server_type.server", FT_BOOLEAN, 32,
 956                         TFS(&tfs_server), 1<<SERVER_SERVER, "Is This A Server?", HFILL }},
 957
 958                 { &hf_server_type_sql,
 959                         { "SQL", "browser.server_type.sql", FT_BOOLEAN, 32,
 960                         TFS(&tfs_sql), 1<<SERVER_SQL_SERVER, "Is This A SQL Server?", HFILL }},
 961
 962                 { &hf_server_type_domain,
 963                         { "Domain Controller", "browser.server_type.domain_controller", FT_BOOLEAN, 32,
 964                         TFS(&tfs_domain), 1<<SERVER_DOMAIN_CONTROLLER, "Is This A Domain Controller?", HFILL }},
 965
 966                 { &hf_server_type_backup,
 967                         { "Backup Controller", "browser.server_type.backup_controller", FT_BOOLEAN, 32,
 968                         TFS(&tfs_backup), 1<<SERVER_BACKUP_CONTROLLER, "Is This A Backup Domain Controller?", HFILL }},
 969
 970                 { &hf_server_type_time,
 971                         { "Time Source", "browser.server_type.time", FT_BOOLEAN, 32,
 972                         TFS(&tfs_time), 1<<SERVER_TIME_SOURCE, "Is This A Time Source?", HFILL }},
 973
 974                 { &hf_server_type_apple,
 975                         { "Apple", "browser.server_type.apple", FT_BOOLEAN, 32,
 976                         TFS(&tfs_apple), 1<<SERVER_APPLE_SERVER, "Is This An Apple Server ?", HFILL }},
 977
 978                 { &hf_server_type_novell,
 979                         { "Novell", "browser.server_type.novell", FT_BOOLEAN, 32,
 980                         TFS(&tfs_novell), 1<<SERVER_NOVELL_SERVER, "Is This A Novell Server?", HFILL }},
 981
 982                 { &hf_server_type_member,
 983                         { "Member", "browser.server_type.member", FT_BOOLEAN, 32,
 984                         TFS(&tfs_member), 1<<SERVER_DOMAIN_MEMBER_SERVER, "Is This A Domain Member Server?", HFILL }},
 985
 986                 { &hf_server_type_print,
 987                         { "Print", "browser.server_type.print", FT_BOOLEAN, 32,
 988                         TFS(&tfs_print), 1<<SERVER_PRINT_QUEUE_SERVER, "Is This A Print Server?", HFILL }},
 989
 990                 { &hf_server_type_dialin,
 991                         { "Dialin", "browser.server_type.dialin", FT_BOOLEAN, 32,
 992                         TFS(&tfs_dialin), 1<<SERVER_DIALIN_SERVER, "Is This A Dialin Server?", HFILL }},
 993
 994                 { &hf_server_type_xenix,
 995                         { "Xenix", "browser.server_type.xenix", FT_BOOLEAN, 32,
 996                         TFS(&tfs_xenix), 1<<SERVER_XENIX_SERVER, "Is This A Xenix Server?", HFILL }},
 997
 998                 { &hf_server_type_ntw,
 999                         { "NT Workstation", "browser.server_type.ntw", FT_BOOLEAN, 32,
1000                         TFS(&tfs_ntw), 1<<SERVER_NT_WORKSTATION, "Is This A NT Workstation?", HFILL }},
1001
1002                 { &hf_server_type_wfw,
1003                         { "WfW", "browser.server_type.wfw", FT_BOOLEAN, 32,
1004                         TFS(&tfs_wfw), 1<<SERVER_WINDOWS_FOR_WORKGROUPS, "Is This A Windows For Workgroups Server?", HFILL }},
1005
1006                 { &hf_server_type_nts,
1007                         { "NT Server", "browser.server_type.nts", FT_BOOLEAN, 32,
1008                         TFS(&tfs_nts), 1<<SERVER_NT_SERVER, "Is This A NT Server?", HFILL }},
1009
1010                 { &hf_server_type_potentialb,
1011                         { "Potential Browser", "browser.server_type.browser.potential", FT_BOOLEAN, 32,
1012                         TFS(&tfs_potentialb), 1<<SERVER_POTENTIAL_BROWSER, "Is This A Potential Browser?", HFILL }},
1013
1014                 { &hf_server_type_backupb,
1015                         { "Backup Browser", "browser.server_type.browser.backup", FT_BOOLEAN, 32,
1016                         TFS(&tfs_backupb), 1<<SERVER_BACKUP_BROWSER, "Is This A Backup Browser?", HFILL }},
1017
1018                 { &hf_server_type_masterb,
1019                         { "Master Browser", "browser.server_type.browser.master", FT_BOOLEAN, 32,
1020                         TFS(&tfs_masterb), 1<<SERVER_MASTER_BROWSER, "Is This A Master Browser?", HFILL }},
1021
1022                 { &hf_server_type_domainmasterb,
1023                         { "Domain Master Browser", "browser.server_type.browser.domain_master", FT_BOOLEAN, 32,
1024                         TFS(&tfs_domainmasterb), 1<<SERVER_DOMAIN_MASTER_BROWSER, "Is This A Domain Master Browser?", HFILL }},
1025
1026                 { &hf_server_type_osf,
1027                         { "OSF", "browser.server_type.osf", FT_BOOLEAN, 32,
1028                         TFS(&tfs_osf), 1<<SERVER_OSF, "Is This An OSF server ?", HFILL }},
1029
1030                 { &hf_server_type_vms,
1031                         { "VMS", "browser.server_type.vms", FT_BOOLEAN, 32,
1032                         TFS(&tfs_vms), 1<<SERVER_VMS, "Is This A VMS Server?", HFILL }},
1033
1034                 { &hf_server_type_w95,
1035                         { "Windows 95+", "browser.server_type.w95", FT_BOOLEAN, 32,
1036                         TFS(&tfs_w95), 1<<SERVER_WINDOWS_95, "Is This A Windows 95 or above server?", HFILL }},
1037
1038                 { &hf_server_type_local,
1039                         { "Local", "browser.server_type.local", FT_BOOLEAN, 32,
1040                         TFS(&tfs_local), 1<<SERVER_LOCAL_LIST_ONLY, "Is This A Local List Only request?", HFILL }},
1041
1042                 { &hf_server_type_domainenum,
1043                         { "Domain Enum", "browser.server_type.domainenum", FT_BOOLEAN, 32,
1044                         TFS(&tfs_domainenum), 1<<SERVER_DOMAIN_ENUM, "Is This A Domain Enum request?", HFILL }},
1045
1046                 { &hf_election_version,
1047                         { "Election Version", "browser.election.version", FT_UINT8, BASE_DEC,
1048                         NULL, 0, "Election Version", HFILL }},
1049
1050                 { &hf_proto_major,
1051                         { "Browser Protocol Major Version", "browser.proto_major", FT_UINT8, BASE_DEC,
1052                         NULL, 0, "Browser Protocol Major Version", HFILL }},
1053
1054                 { &hf_proto_minor,
1055                         { "Browser Protocol Minor Version", "browser.proto_minor", FT_UINT8, BASE_DEC,
1056                         NULL, 0, "Browser Protocol Minor Version", HFILL }},
1057
1058                 { &hf_sig_const,
1059                         { "Signature", "browser.sig", FT_UINT16, BASE_HEX,
1060                         NULL, 0, "Signature Constant", HFILL }},
1061
1062                 { &hf_server_comment,
1063                         { "Host Comment", "browser.comment", FT_STRINGZ, BASE_NONE,
1064                         NULL, 0, "Server Comment", HFILL }},
1065
1066                 { &hf_unused_flags,
1067                         { "Unused flags", "browser.unused", FT_UINT8, BASE_HEX,
1068                         NULL, 0, "Unused/unknown flags", HFILL }},
1069
1070                 { &hf_response_computer_name,
1071                         { "Response Computer Name", "browser.response_computer_name", FT_STRINGZ, BASE_NONE,
1072                         NULL, 0, "Response Computer Name", HFILL }},
1073
1074                 { &hf_election_criteria,
1075                         { "Election Criteria", "browser.election.criteria", FT_UINT32, BASE_HEX,
1076                         NULL, 0, "Election Criteria", HFILL }},
1077
1078                 { &hf_election_desire,
1079                         { "Election Desire", "browser.election.desire", FT_UINT8, BASE_HEX,
1080                         NULL, 0, "Election Desire", HFILL }},
1081
1082                 { &hf_election_desire_flags_backup,
1083                         { "Backup", "browser.election.desire.backup", FT_BOOLEAN, 8,
1084                         TFS(&tfs_desire_backup), 1<<DESIRE_BACKUP, "Is this a backup server", HFILL }},
1085
1086                 { &hf_election_desire_flags_standby,
1087                         { "Standby", "browser.election.desire.standby", FT_BOOLEAN, 8,
1088                         TFS(&tfs_desire_standby), 1<<DESIRE_STANDBY, "Is this a standby server?", HFILL }},
1089
1090                 { &hf_election_desire_flags_master,
1091                         { "Master", "browser.election.desire.master", FT_BOOLEAN, 8,
1092                         TFS(&tfs_desire_master), 1<<DESIRE_MASTER, "Is this a master server", HFILL }},
1093
1094                 { &hf_election_desire_flags_domain_master,
1095                         { "Domain Master", "browser.election.desire.domain_master", FT_BOOLEAN, 8,
1096                         TFS(&tfs_desire_domain_master), 1<<DESIRE_DOMAIN_MASTER, "Is this a domain master", HFILL }},
1097
1098                 { &hf_election_desire_flags_wins,
1099                         { "WINS", "browser.election.desire.wins", FT_BOOLEAN, 8,
1100                         TFS(&tfs_desire_wins), 1<<DESIRE_WINS, "Is this a WINS server", HFILL }},
1101
1102                 { &hf_election_desire_flags_nt,
1103                         { "NT", "browser.election.desire.nt", FT_BOOLEAN, 8,
1104                         TFS(&tfs_desire_nt), 1<<DESIRE_NT, "Is this a NT server", HFILL }},
1105
1106                 { &hf_election_revision,
1107                         { "Election Revision", "browser.election.revision", FT_UINT16, BASE_DEC,
1108                         NULL, 0, "Election Revision", HFILL }},
1109
1110                 { &hf_election_os,
1111                         { "Election OS", "browser.election.os", FT_UINT8, BASE_HEX,
1112                         NULL, 0, "Election OS", HFILL }},
1113
1114                 { &hf_election_os_wfw,
1115                         { "WfW", "browser.election.os.wfw", FT_BOOLEAN, 8,
1116                         TFS(&tfs_os_wfw), 1<<OS_WFW, "Is this a WfW host?", HFILL }},
1117
1118                 { &hf_election_os_ntw,
1119                         { "NT Workstation", "browser.election.os.ntw", FT_BOOLEAN, 8,
1120                         TFS(&tfs_os_ntw), 1<<OS_NTW, "Is this a NT Workstation?", HFILL }},
1121
1122                 { &hf_election_os_nts,
1123                         { "NT Server", "browser.election.os.nts", FT_BOOLEAN, 8,
1124                         TFS(&tfs_os_nts), 1<<OS_NTS, "Is this a NT Server?", HFILL }},
1125
1126                 { &hf_server_uptime,
1127                         { "Uptime", "browser.uptime", FT_UINT32, BASE_DEC,
1128                         NULL, 0, "Server uptime in ms", HFILL }},
1129
1130                 { &hf_backup_count,
1131                         { "Backup List Requested Count", "browser.backup.count", FT_UINT8, BASE_DEC,
1132                         NULL, 0, "Backup list requested count", HFILL }},
1133
1134                 { &hf_backup_token,
1135                         { "Backup Request Token", "browser.backup.token", FT_UINT32, BASE_DEC,
1136                         NULL, 0, "Backup requested/response token", HFILL }},
1137
1138                 { &hf_backup_server,
1139                         { "Backup Server", "browser.backup.server", FT_STRING, BASE_NONE,
1140                         NULL, 0, "Backup Server Name", HFILL }},
1141
1142                 { &hf_browser_to_promote,
1143                         { "Browser to Promote", "browser.browser_to_promote", FT_STRINGZ, BASE_NONE,
1144                         NULL, 0, "Browser to Promote", HFILL }},
1145
1146         };
1147
1148         static gint *ett[] = {
1149                 &ett_browse,
1150                 &ett_browse_flags,
1151                 &ett_browse_election_criteria,
1152                 &ett_browse_election_os,
1153                 &ett_browse_election_desire,
1154                 &ett_browse_reset_cmd_flags,
1155         };
1156
1157         proto_smb_browse = proto_register_protocol("Microsoft Windows Browser Protocol",
1158             "BROWSER", "browser");
1159
1160         proto_register_field_array(proto_smb_browse, hf, array_length(hf));
1161         proto_register_subtree_array(ett, array_length(ett));
1162
1163         register_dissector("mailslot_browse", dissect_mailslot_browse,
1164             proto_smb_browse);
1165         register_dissector("mailslot_lanman", dissect_mailslot_lanman,
1166             proto_smb_browse);
1167 }