FollowSet Parsers

FollowSet parsers are usually NetBIOS based. A NetBIOS protocol usually has no idea what protocol follows it. The following protocol could be SMB, or any other NetBIOS protocol. If you look in the file PARSER.INI in the root of the Network Monitor installation directory (for example: C:\NM), the NetBIOS parser entry will look something like this:

[NETBIOS]
    Comment     = "Network Basic Input/Output System protocol"
    FollowSet   = SMB, MSRPC
    HelpFile    =

If the NetBIOS parser recognizes a frame, it returns the lpByte of the following protocol, but not the protocol name. The FollowSet handler in the Network Monitor kernel takes the return from the NetBIOS parser, and sequentially calls the SMB handler and the MSRPC parser until one of them claims the frame.