title: scapy SMB/CIFS decoding
body: <p><strong>The Background</strong>
  I'm writing a Windows OS detection script using scapy.  While I could use other tools like p0f, nmap with the SMB script, etc, this part of functionality is only one small piece of the whole, and so I am committed to the scapy route.</p>
  
  <p><strong>The Problem</strong>
  Being quite the novice with scapy, I am having some trouble figuring out the best practice for using the SMB decoder.  So far I have:</p>
  
  <pre><code>def disp(pkt):
      print(pkt.getlayer(IP).src)
      if pkt.haslayer(Raw):
          print(SMBSession_Setup_AndX_Request(pkt.getlayer(Raw).load).NativeOS)
  
  foo=sniff(prn=disp,filter="port 445",count=10)
  </code></pre>
  
  <p>As you can see, I am simply stuffing the 'Raw' layer through the SMBSession_Setup_AndX_Request() class, in the hope it'll do The Right Thing with the 'Raw' payload.</p>
  
  <p>This does appear to be functional, but returns the "default" class setting for the NativeOS attribute of "Windows 4.0" (Well, it is on my version of scapy's smb.py), and sometimes treats me to a stack trace, depending on whether a Mac is on the network, doing CIFS.  My blind asumption that I can just grab NativeOS and be done with it is surely ill-conceived.</p>
  
  <p><strong>The Question</strong>
  If my methodology is just plain wrong, what would be the correct approach to custom protocol decoding using scapy's sniff() method?</p>
  
  <p>Many thanks for any advice,</p>
  
  <p>sc.</p>