Home / server / Questions / 369244
Accepted
schroeder
Asked: 2012-03-14 07:15:57 +0800 CST

NBSS Continuation Message - Wireshark - Definition?

  • 772

Looking at a capture and seeing a "NBSS Continuation Message" port 445, but I cannot find any reference anywhere to what this might mean.

I assume it's a normal message for the NetBIOS Session Service, but can't find a definition of it anywhere.

Can someone point me to further details?

windows wireshark

2 Answers

  1. It could be a client trying to connect to a samba share with a "negotiate protocol request" using naked tcp. If the smb share doesn't respond to smb over naked tcp, then it might look like a continuation message.

    • 2
  2. Best Answer

    Typically, there would have been a preceding packet with full header information about the request/response to this "continuation message". Wireshark would be able to detect it automatically and reassemble the PDU labeling the packet [TCP segment of a reassembled PDU]. But in your case, apparently either the packet starting the transmission got lost or the NBSS dissectors / reassembly features of Wireshark have been disabled.

    • 1