If the client adds a 0x10 flag in the Flags field of
SMB_COM_OPEN_ANDX, a Windows server will send back an alternate 19
WordCount response. Neither the 0x10 flag nor the 19 WordCount
response are documented in MS-CIFS.
Wireshark can't handle the flag or response, but netmon seems to
document it.
Good morning Zachary - thanks for your questions. We have created the following
case to track our work on those:
SRX091217600064 [MS-CIFS] OPEN_ANDX undocumented flag with 19 word count
I expect the lack of documentation in [MS-CIFS] concerning your questions is
due to the relationship between
Bill - Thanks! I apologize for not checking MS-SMB as well, woops.
-Original Message-
From: Bill Wesse [mailto:bil...@microsoft.com]
Sent: Thursday, December 17, 2009 9:25 AM
To: Zachary Loafman
Cc: p...@tridgell.net; cifs-proto...@samba.org
Subject: RE: OPEN_ANDX undocumented flag
No problem! Some information on CIFS/SMB (both the technical and legal
definitions, which differ) was presented at the Sept '09 SNIA Plugfest, and it
may take me a bit to obtain the presentation materials - hopefully that won't
take too long.
I will keep you advised!
Regards,
Bill Wesse
MCSE,
