smbcmp: A new tool to diff network captures
summary
A new tool called smbcmp loads pcap/x files via tshark XML output and shows two captures side-by-side with a line-by-line diff of packet details plus synchronized summary panes, so differences in fields (not just topic names) jump out. It accepts Wireshark display filters, reads dumped decryption keys from Samba or the kernel to decrypt SMB traffic, and exists as a curses prototype, a Qt GUI and Windows ports — used to pinpoint unsigned signatures and other subtle wire/parsing bugs.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 0:30SMB Team
- 1:53Bugs
- 2:39Reading code
- 3:24Git bisect
- 4:56Different implementations
- 8:00Troubleshooting
- 8:47Looking at logs
- 9:51Tracing system calls
- 11:03Systemwide recording
- 12:14Network captures
- 13:15Why works on Linux
- 14:40decryption support
- 14:57SMB client
- 15:27Working and nonworking cases
- 18:59Summary view
- 19:47How it works
- 20:48Initial prototype
- 30:01Protocol agnostic
related talks
34mCan your diff(1) do this?! Improving software review and QA with diffoscope
53mForensic Investigations of Web Exploitations
04mPcapy and dpkt - tcpdump on steroids
31mThe SMB Report Card
44mNetsec is Dead(?): Modern Network Fingerprinting for...
21mParDiff: Practical Static Differential Analysis of Network Protocol Parsers
38mPacket Capture the Flag
01h 02mCQTools: The New Ultimate Hacking Toolkit