On Tue, Feb 06, 2007 at 08:11:10PM +0000, Joseph Kuan wrote: > Hi, > > I use ethereal to analysis the CIFS protocol when opening a file. I > notice there are two consecutive sequence of NT_CREATE_ANDX -> READ_ANDX > -> CLOSE. > > However, the first one NT_CREATE_ANDX has File Attributes: 0x00000000 > and the second one has value 0x00000080.
Are these the attributes in the request or the response? Regardless, I don't think it matters much. I'm not an expert on Windows behavior, but as far as I know these two sets of attributes should be mostly equivalent. Microsoft's documentation says the ATTR_NORMAL bit (0x80) indicates that this is a "normal" file with no other attribute bits set. It seems redundant to me, but clients and servers normally send 0x80 instead of just 0x0. > I expect both File Attributes > have values, 0x00000080, such that the bit for "Normal: This file is an > ordinary file" is set. Strangely, the one with zero value have different > label, "Normal: This file has some attribute set". This is probably just how ethereal chooses to label the values. As far as I know there isn't any real semantic difference. -- Adam Simpkins [EMAIL PROTECTED] _______________________________________________ cifs-protocol mailing list [email protected] https://lists.samba.org/mailman/listinfo/cifs-protocol
