Display Filter Reference: SMB (Server Message Block Protocol)
Protocol field name: smb
Versions: 1.0.0 to 3.4.5
Back to Display Filter Reference
| Field name | Description | Type | Versions |
|---|---|---|---|
| nt.access_mask | Access required | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| nt.access_mask.access_sacl | Access SACL | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.delete | Delete | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.generic_all | Generic all | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.generic_execute | Generic execute | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.generic_read | Generic read | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.generic_write | Generic write | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.maximum_allowed | Maximum allowed | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.read_control | Read control | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.specific_0 | Specific access, bit 0 | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.specific_1 | Specific access, bit 1 | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.specific_10 | Specific access, bit 10 | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.specific_11 | Specific access, bit 11 | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.specific_12 | Specific access, bit 12 | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.specific_13 | Specific access, bit 13 | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.specific_14 | Specific access, bit 14 | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.specific_15 | Specific access, bit 15 | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.specific_2 | Specific access, bit 2 | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.specific_3 | Specific access, bit 3 | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.specific_4 | Specific access, bit 4 | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.specific_5 | Specific access, bit 5 | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.specific_6 | Specific access, bit 6 | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.specific_7 | Specific access, bit 7 | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.specific_8 | Specific access, bit 8 | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.specific_9 | Specific access, bit 9 | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.synchronise | Synchronise | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.write_dac | Write DAC | Boolean | 1.0.0 to 3.4.5 |
| nt.access_mask.write_owner | Write owner | Boolean | 1.0.0 to 3.4.5 |
| nt.ace.flags | NT ACE Flags | Unsigned integer, 1 byte | 2.0.0 to 3.4.5 |
| nt.ace.flags.container_inherit | Container Inherit | Boolean | 1.0.0 to 3.4.5 |
| nt.ace.flags.failed_access | Audit Failed Accesses | Boolean | 1.0.0 to 3.4.5 |
| nt.ace.flags.inherit_only | Inherit Only | Boolean | 1.0.0 to 3.4.5 |
| nt.ace.flags.inherited_ace | Inherited ACE | Boolean | 1.0.0 to 3.4.5 |
| nt.ace.flags.non_propagate_inherit | Non-Propagate Inherit | Boolean | 1.0.0 to 3.4.5 |
| nt.ace.flags.object_inherit | Object Inherit | Boolean | 1.0.0 to 3.4.5 |
| nt.ace.flags.successful_access | Audit Successful Accesses | Boolean | 1.0.0 to 3.4.5 |
| nt.ace.object.flags | ACE Object Flags | Unsigned integer, 4 bytes | 2.0.0 to 3.4.5 |
| nt.ace.object.flags.inherited_object_type_present | Inherited Object Type Present | Boolean | 1.0.0 to 3.4.5 |
| nt.ace.object.flags.object_type_present | Object Type Present | Boolean | 1.0.0 to 3.4.5 |
| nt.ace.object.guid | GUID | Globally Unique Identifier | 1.0.0 to 3.4.5 |
| nt.ace.object.inherited_guid | Inherited GUID | Globally Unique Identifier | 1.0.0 to 3.4.5 |
| nt.ace.size | Size | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| nt.ace.type | Type | Unsigned integer, 1 byte | 1.0.0 to 3.4.5 |
| nt.ace_extends_beyond_capture | ACE Extends beyond end of captured data | Label | 2.0.0 to 2.6.20 |
| nt.ace_extends_beyond_data | ACE Extends beyond end of data | Label | 3.0.0 to 3.4.5 |
| nt.ace_extends_beyond_reassembled_data | ACE Extends beyond end of reassembled data | Label | 2.0.0 to 3.4.5 |
| nt.acl.num_aces | Num ACEs | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| nt.acl.revision | Revision | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| nt.acl.size | Size | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| nt.group_sid.beyond_captured_data | Group SID beyond end of captured data | Label | 2.0.0 to 2.6.20 |
| nt.group_sid.beyond_data | Group SID beyond end of data | Label | 3.0.0 to 3.4.5 |
| nt.group_sid.beyond_reassembled_data | Group SID beyond end of reassembled data | Label | 2.0.0 to 3.4.5 |
| nt.item_offset.out_of_range | Item offset is out of range | Label | 2.6.0 to 3.4.5 |
| nt.offset_to_dacl | Offset to DACL | Unsigned integer, 4 bytes | 2.0.0 to 3.4.5 |
| nt.offset_to_group_sid | Offset to group SID | Unsigned integer, 4 bytes | 2.0.0 to 3.4.5 |
| nt.offset_to_owner_sid | Offset to owner SID | Unsigned integer, 4 bytes | 2.0.0 to 3.4.5 |
| nt.offset_to_sacl | Offset to SACL | Unsigned integer, 4 bytes | 2.0.0 to 3.4.5 |
| nt.owner_sid.beyond_captured_data | Owner SID beyond end of captured data | Label | 2.0.0 to 2.6.20 |
| nt.owner_sid.beyond_data | Owner SID beyond end of data | Label | 3.0.0 to 3.4.5 |
| nt.owner_sid.beyond_reassembled_data | Owner SID beyond end of reassembled data | Label | 2.0.0 to 3.4.5 |
| nt.sec_desc.revision | Revision | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| nt.sec_desc.type | Type | Unsigned integer, 2 bytes | 2.0.0 to 3.4.5 |
| nt.sec_desc.type.dacl_auto_inherit_req | DACL Auto Inherit Required | Boolean | 1.0.0 to 3.4.5 |
| nt.sec_desc.type.dacl_auto_inherited | DACL Auto Inherited | Boolean | 1.0.0 to 3.4.5 |
| nt.sec_desc.type.dacl_defaulted | DACL Defaulted | Boolean | 1.0.0 to 3.4.5 |
| nt.sec_desc.type.dacl_present | DACL Present | Boolean | 1.0.0 to 3.4.5 |
| nt.sec_desc.type.dacl_protected | DACL Protected | Boolean | 1.0.0 to 3.4.5 |
| nt.sec_desc.type.dacl_trusted | DACL Trusted | Boolean | 1.0.0 to 3.4.5 |
| nt.sec_desc.type.group_defaulted | Group Defaulted | Boolean | 1.0.0 to 3.4.5 |
| nt.sec_desc.type.owner_defaulted | Owner Defaulted | Boolean | 1.0.0 to 3.4.5 |
| nt.sec_desc.type.rm_control_valid | RM Control Valid | Boolean | 1.0.0 to 3.4.5 |
| nt.sec_desc.type.sacl_auto_inherit_req | SACL Auto Inherit Required | Boolean | 1.0.0 to 3.4.5 |
| nt.sec_desc.type.sacl_auto_inherited | SACL Auto Inherited | Boolean | 1.0.0 to 3.4.5 |
| nt.sec_desc.type.sacl_defaulted | SACL Defaulted | Boolean | 1.0.0 to 3.4.5 |
| nt.sec_desc.type.sacl_present | SACL Present | Boolean | 1.0.0 to 3.4.5 |
| nt.sec_desc.type.sacl_protected | SACL Protected | Boolean | 1.0.0 to 3.4.5 |
| nt.sec_desc.type.self_relative | Self Relative | Boolean | 1.0.0 to 3.4.5 |
| nt.sec_desc.type.server_security | Server Security | Boolean | 1.0.0 to 3.4.5 |
| nt.sec_info | SEC INFO | Unsigned integer, 4 bytes | 2.0.0 to 3.4.5 |
| nt.sec_info.dacl | DACL | Boolean | 1.2.0 to 3.4.5 |
| nt.sec_info.group | Group | Boolean | 1.2.0 to 3.4.5 |
| nt.sec_info.owner | Owner | Boolean | 1.2.0 to 3.4.5 |
| nt.sec_info.sacl | SACL | Boolean | 1.2.0 to 3.4.5 |
| nt.sid | SID | Character string | 1.0.0 to 3.4.5 |
| nt.sid.auth | Authority | Unsigned integer, 8 bytes | 1.6.0 to 3.4.5 |
| nt.sid.domain | Domain | Character string | 1.6.0 to 3.4.5 |
| nt.sid.num_auth | Num Auth | Unsigned integer, 1 byte | 1.0.0 to 3.4.5 |
| nt.sid.revision | Revision | Unsigned integer, 1 byte | 1.0.0 to 3.4.5 |
| nt.sid.rid | RID | Unsigned integer, 4 bytes | 1.6.0 to 3.4.5 |
| nt.sid.subauth | Subauthorities | Character string | 1.6.0 to 3.4.5 |
| nt.sid.wkwn | Well-known SID | Character string | 1.6.0 to 3.4.5 |
| smb.access.append | Append | Boolean | 1.0.0 to 3.4.5 |
| smb.access.caching | Caching | Boolean | 1.0.0 to 3.4.5 |
| smb.access.delete | Delete | Boolean | 1.0.0 to 3.4.5 |
| smb.access.delete_child | Delete Child | Boolean | 1.0.0 to 3.4.5 |
| smb.access.desired | Desired Access | Unsigned integer, 2 bytes | 2.0.0 to 3.4.5 |
| smb.access.execute | Execute | Boolean | 1.0.0 to 3.4.5 |
| smb.access.generic_all | Generic All | Boolean | 1.0.0 to 3.4.5 |
| smb.access.generic_execute | Generic Execute | Boolean | 1.0.0 to 3.4.5 |
| smb.access.generic_read | Generic Read | Boolean | 1.0.0 to 3.4.5 |
| smb.access.generic_write | Generic Write | Boolean | 1.0.0 to 3.4.5 |
| smb.access.granted | Granted Access | Unsigned integer, 2 bytes | 2.0.0 to 3.4.5 |
| smb.access.locality | Locality | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.access.maximum_allowed | Maximum Allowed | Boolean | 1.0.0 to 3.4.5 |
| smb.access.mode | Access Mode | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.access.read | Read | Boolean | 1.0.0 to 3.4.5 |
| smb.access.read_attributes | Read Attributes | Boolean | 1.0.0 to 3.4.5 |
| smb.access.read_control | Read Control | Boolean | 1.0.0 to 3.4.5 |
| smb.access.read_ea | Read EA | Boolean | 1.0.0 to 3.4.5 |
| smb.access.sharing | Sharing Mode | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.access.smb.date | Last Access Date | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.access.smb.time | Last Access Time | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.access.synchronize | Synchronize | Boolean | 1.0.0 to 3.4.5 |
| smb.access.system_security | System Security | Boolean | 1.0.0 to 3.4.5 |
| smb.access.time | Last Access | Date and time | 1.0.0 to 3.4.5 |
| smb.access.write | Write | Boolean | 1.0.0 to 3.4.5 |
| smb.access.write_attributes | Write Attributes | Boolean | 1.0.0 to 3.4.5 |
| smb.access.write_dac | Write DAC | Boolean | 1.0.0 to 3.4.5 |
| smb.access.write_ea | Write EA | Boolean | 1.0.0 to 3.4.5 |
| smb.access.write_owner | Write Owner | Boolean | 1.0.0 to 3.4.5 |
| smb.access.writethrough | Writethrough | Boolean | 1.0.0 to 3.4.5 |
| smb.access_mask | Access Mask | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.account | Account | Character string | 1.0.0 to 3.4.5 |
| smb.actual_free_alloc_units | Actual Free Units | Unsigned integer, 8 bytes | 1.0.0 to 3.4.5 |
| smb.alignment | Alignment | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.alloc.count | Allocation Block Count | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.alloc.size | Allocation Block Count | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.alloc_size | Allocation Size | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.alloc_size64 | Allocation Size | Unsigned integer, 8 bytes | 2.2.0 to 3.4.5 |
| smb.andxoffset | AndXOffset | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.ansi_password | ANSI Password | Sequence of bytes | 1.0.0 to 3.4.5 |
| smb.ansi_pwlen | ANSI Password Length | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.attribute | Attribute | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.avail.units | Available Units | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.backup.time | Backed-up | Date and time | 1.0.0 to 3.4.5 |
| smb.bcc | Byte Count (BCC) | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.blocksize | Block Size | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.bpu | Blocks Per Unit | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.buffer_format | Buffer Format | Unsigned integer, 1 byte | 1.0.0 to 3.4.5 |
| smb.byte_parameters | Byte parameters | Sequence of bytes | 2.0.0 to 3.4.5 |
| smb.caller_free_alloc_units | Caller Free Units | Unsigned integer, 8 bytes | 1.0.0 to 3.4.5 |
| smb.cancel_to | Cancel to | Frame number | 1.0.0 to 3.4.5 |
| smb.challenge | Challenge | Sequence of bytes | 2.0.0 to 3.4.5 |
| smb.challenge_length | Challenge Length | Unsigned integer, 2 bytes | 2.0.0 to 3.4.5 |
| smb.change.time | Change | Date and time | 1.0.0 to 3.4.5 |
| smb.change_count | Change Count | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.cmd | SMB Command | Unsigned integer, 1 byte | 1.0.0 to 3.4.5 |
| smb.compressed.chunk_shift | Chunk Shift | Unsigned integer, 1 byte | 1.0.0 to 3.4.5 |
| smb.compressed.cluster_shift | Cluster Shift | Unsigned integer, 1 byte | 1.0.0 to 3.4.5 |
| smb.compressed.file_size | Compressed Size | Unsigned integer, 8 bytes | 1.0.0 to 3.4.5 |
| smb.compressed.format | Compression Format | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.compressed.unit_shift | Unit Shift | Unsigned integer, 1 byte | 1.0.0 to 3.4.5 |
| smb.connect.flags | Flags | Unsigned integer, 2 bytes | 1.12.0 to 3.4.5 |
| smb.connect.flags.dtid | Disconnect TID | Boolean | 1.0.0 to 3.4.5 |
| smb.connect.flags.extendedresp | Extended Response | Boolean | 1.6.0 to 3.4.5 |
| smb.connect.flags.extendedsig | Extended Signature | Boolean | 1.6.0 to 3.4.5 |
| smb.connect.support | Optional Support | Unsigned integer, 2 bytes | 1.12.0 to 3.4.5 |
| smb.connect.support.cscmask | CSC Mask | Unsigned integer, 2 bytes | 1.6.0 to 3.4.5 |
| smb.connect.support.dfs | In Dfs | Boolean | 1.0.0 to 3.4.5 |
| smb.connect.support.extendedsig | Extended Signatures | Boolean | 1.6.0 to 3.4.5 |
| smb.connect.support.search | Search Bits | Boolean | 1.0.0 to 3.4.5 |
| smb.connect.support.uniqfilename | Unique File Name | Boolean | 1.6.0 to 3.4.5 |
| smb.continuation_to | Continuation to | Frame number | 1.0.0 to 3.4.5 |
| smb.copy.flags | Flags | Unsigned integer, 2 bytes | 1.12.0 to 3.4.5 |
| smb.copy.flags.dest_mode | Destination mode | Boolean | 1.0.0 to 3.4.5 |
| smb.copy.flags.dir | Must be directory | Boolean | 1.0.0 to 3.4.5 |
| smb.copy.flags.ea_action | EA action if EAs not supported on dest | Boolean | 1.0.0 to 3.4.5 |
| smb.copy.flags.file | Must be file | Boolean | 1.0.0 to 3.4.5 |
| smb.copy.flags.source_mode | Source mode | Boolean | 1.0.0 to 3.4.5 |
| smb.copy.flags.tree_copy | Tree copy | Boolean | 1.0.0 to 3.4.5 |
| smb.copy.flags.verify | Verify writes | Boolean | 1.0.0 to 3.4.5 |
| smb.count | Count | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.count_high | Count High (multiply with 64K) | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.count_low | Count Low | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.create.action | Create action | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.create.disposition | Disposition | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.create.file_id | Server unique file ID | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.create.file_id_64b | Server unique 64-bit file ID | Unsigned integer, 8 bytes | 1.8.0 to 3.4.5 |
| smb.create.smb.date | Create Date | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.create.smb.time | Create Time | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.create.time | Created | Date and time | 1.0.0 to 3.4.5 |
| smb.create_flags | Create Flags | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.create_options | Create Options | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.data_disp | Data Displacement | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.data_len | Data Length | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.data_len_high | Data Length High (multiply with 64K) | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.data_len_low | Data Length Low | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.data_offset | Data Offset | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.data_size | Data Size | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.dc | Data Count | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.dcm | Data Compaction Mode | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.delete_pending | Delete Pending | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.destination_name | Destination Name | Character string | 1.0.0 to 3.4.5 |
| smb.device | Device Characteristics | Unsigned integer, 4 bytes | 1.12.0 to 3.4.5 |
| smb.device.aat | Allow Appcontainer Traversal | Boolean | 2.6.0 to 3.4.5 |
| smb.device.floppy | Floppy | Boolean | 1.0.0 to 3.4.5 |
| smb.device.mounted | Mounted | Boolean | 1.0.0 to 3.4.5 |
| smb.device.portable | Portable | Boolean | 2.6.0 to 3.4.5 |
| smb.device.read_only | Read Only | Boolean | 1.0.0 to 3.4.5 |
| smb.device.remote | Remote | Boolean | 1.0.0 to 3.4.5 |
| smb.device.removable | Removable | Boolean | 1.0.0 to 3.4.5 |
| smb.device.secure_open | Secure Open | Boolean | 2.6.0 to 3.4.5 |
| smb.device.ts | Terminal Services | Boolean | 2.6.0 to 3.4.5 |
| smb.device.type | Device Type | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.device.virtual | Virtual | Boolean | 1.0.0 to 3.4.5 |
| smb.device.webdav | Webdav | Boolean | 2.6.0 to 3.4.5 |
| smb.device.write_once | Write Once | Boolean | 1.0.0 to 3.4.5 |
| smb.dfs.flags | Flags | Unsigned integer, 2 bytes | 1.12.0 to 3.4.5 |
| smb.dfs.flags.fielding | Fielding | Boolean | 1.0.0 to 3.4.5 |
| smb.dfs.flags.server_hold_storage | Hold Storage | Boolean | 1.0.0 to 3.4.5 |
| smb.dfs.num_referrals | Num Referrals | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.dfs.path_consumed | Path Consumed | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.dfs.referral.alt_path | Alt Path | Character string | 1.0.0 to 3.4.5 |
| smb.dfs.referral.alt_path_offset | Alt Path Offset | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.dfs.referral.domain_name | Domain Name | Character string | 1.2.3 to 3.4.5 |
| smb.dfs.referral.domain_offset | Domain Offset | Unsigned integer, 2 bytes | 1.2.3 to 3.4.5 |
| smb.dfs.referral.expname | Expanded Name | Character string | 1.2.3 to 3.4.5 |
| smb.dfs.referral.expnames_offset | Expanded Names Offset | Unsigned integer, 2 bytes | 1.2.3 to 3.4.5 |
| smb.dfs.referral.flags | Flags | Unsigned integer, 2 bytes | 1.12.0 to 3.4.5 |
| smb.dfs.referral.flags.name_list_referral | NameListReferral | Boolean | 1.2.3 to 3.4.5 |
| smb.dfs.referral.flags.strip | Strip | Boolean | 1.0.0 to 1.2.2 |
| smb.dfs.referral.flags.target_set_boundary | TargetSetBoundary | Boolean | 1.2.3 to 3.4.5 |
| smb.dfs.referral.node | Node | Character string | 1.0.0 to 3.4.5 |
| smb.dfs.referral.node_offset | Node Offset | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.dfs.referral.number_of_expnames | Number of Expanded Names | Unsigned integer, 2 bytes | 1.2.3 to 3.4.5 |
| smb.dfs.referral.path | Path | Character string | 1.0.0 to 3.4.5 |
| smb.dfs.referral.path_offset | Path Offset | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.dfs.referral.proximity | Proximity | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.dfs.referral.server.type | Server Type | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.dfs.referral.server_guid | Server GUID | Globally Unique Identifier | 1.2.3 to 3.4.5 |
| smb.dfs.referral.size | Size | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.dfs.referral.ttl | TTL | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.dfs.referral.version | Version | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.dialect | Dialect | Character string | 1.12.0 to 3.4.5 |
| smb.dialect.index | Selected Index | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.dialect.name | Name | Character string | 1.0.0 to 3.4.5 |
| smb.dir.accessmask.add_file | Add File | Boolean | 1.0.0 to 3.4.5 |
| smb.dir.accessmask.add_subdir | Add Subdir | Boolean | 1.0.0 to 3.4.5 |
| smb.dir.accessmask.delete_child | Delete Child | Boolean | 1.0.0 to 3.4.5 |
| smb.dir.accessmask.full_control | FULL CONTROL | Unsigned integer, 4 bytes | 2.0.0 to 3.4.5 |
| smb.dir.accessmask.list | List | Boolean | 1.0.0 to 3.4.5 |
| smb.dir.accessmask.read_attribute | Read Attribute | Boolean | 1.0.0 to 3.4.5 |
| smb.dir.accessmask.read_ea | Read EA | Boolean | 1.0.0 to 3.4.5 |
| smb.dir.accessmask.traverse | Traverse | Boolean | 1.0.0 to 3.4.5 |
| smb.dir.accessmask.write_attribute | Write Attribute | Boolean | 1.0.0 to 3.4.5 |
| smb.dir.accessmask.write_ea | Write EA | Boolean | 1.0.0 to 3.4.5 |
| smb.dir.count | Root Directory Count | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.dir_name | Directory | Character string | 1.0.0 to 3.4.5 |
| smb.disposition.delete_on_close | Delete on close | Boolean | 1.0.0 to 3.4.5 |
| smb.ea.data | EA Data | Sequence of bytes | 1.0.0 to 3.4.5 |
| smb.ea.data_length | EA Data Length | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.ea.error_offset | EA Error offset | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.ea.flags | EA Flags | Unsigned integer, 1 byte | 1.0.0 to 3.4.5 |
| smb.ea.list_length | EA List Length | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.ea.name | EA Name | Character string | 1.0.0 to 3.4.5 |
| smb.ea.name_length | EA Name Length | Unsigned integer, 1 byte | 1.0.0 to 3.4.5 |
| smb.echo.count | Echo Count | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.echo.data | Echo Data | Sequence of bytes | 1.0.0 to 3.4.5 |
| smb.echo.seq_num | Echo Seq Num | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.encryption_key | Encryption Key | Sequence of bytes | 1.0.0 to 1.12.13 |
| smb.encryption_key_length | Key Length | Unsigned integer, 2 bytes | 1.0.0 to 1.12.13 |
| smb.end_of_file | End Of File | Unsigned integer, 8 bytes | 1.0.0 to 3.4.5 |
| smb.end_of_search | End Of Search | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.error_class | Error Class | Unsigned integer, 1 byte | 1.0.0 to 3.4.5 |
| smb.error_code | Error Code | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.ext_attr | Extended Attributes | Sequence of bytes | 1.0.0 to 3.4.5 |
| smb.extra_byte_parameters | Extra byte parameters | Sequence of bytes | 2.0.0 to 3.4.5 |
| smb.ff2_loi | Level of Interest | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.fid | FID | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.fid.closed_in | Closed in | Frame number | 1.0.0 to 3.4.5 |
| smb.fid.mapped_in | Mapped in | Frame number | 1.0.0 to 3.4.5 |
| smb.fid.opened_in | Opened in | Frame number | 1.0.0 to 3.4.5 |
| smb.fid.unmapped_in | Unmapped in | Frame number | 1.0.0 to 3.4.5 |
| smb.file | File Name | Character string | 1.0.0 to 3.4.5 |
| smb.file.accessmask.append_data | Append Data | Boolean | 1.0.0 to 3.4.5 |
| smb.file.accessmask.execute | Execute | Boolean | 1.0.0 to 3.4.5 |
| smb.file.accessmask.full_control | FULL CONTROL | Unsigned integer, 4 bytes | 2.0.0 to 3.4.5 |
| smb.file.accessmask.read_attribute | Read Attribute | Boolean | 1.0.0 to 3.4.5 |
| smb.file.accessmask.read_data | Read Data | Boolean | 1.0.0 to 3.4.5 |
| smb.file.accessmask.read_ea | Read EA | Boolean | 1.0.0 to 3.4.5 |
| smb.file.accessmask.write_attribute | Write Attribute | Boolean | 1.0.0 to 3.4.5 |
| smb.file.accessmask.write_data | Write Data | Boolean | 1.0.0 to 3.4.5 |
| smb.file.accessmask.write_ea | Write EA | Boolean | 1.0.0 to 3.4.5 |
| smb.file.count | Root File Count | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.file.rw.length | File RW Length | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.file.rw.offset | File Offset | Unsigned integer, 8 bytes | 1.0.0 to 3.4.5 |
| smb.file_attribute | File Attributes | Unsigned integer, 2 bytes | 1.12.0 to 3.4.5 |
| smb.file_attribute.archive | Archive | Boolean | 1.0.0 to 3.4.5 |
| smb.file_attribute.compressed | Compressed | Boolean | 1.0.0 to 3.4.5 |
| smb.file_attribute.device | Device | Boolean | 1.0.0 to 3.4.5 |
| smb.file_attribute.directory | Directory | Boolean | 1.0.0 to 3.4.5 |
| smb.file_attribute.encrypted | Encrypted | Boolean | 1.0.0 to 3.4.5 |
| smb.file_attribute.hidden | Hidden | Boolean | 1.0.0 to 3.4.5 |
| smb.file_attribute.normal | Normal | Boolean | 1.0.0 to 3.4.5 |
| smb.file_attribute.not_content_indexed | Content Indexed | Boolean | 1.0.0 to 3.4.5 |
| smb.file_attribute.offline | Offline | Boolean | 1.0.0 to 3.4.5 |
| smb.file_attribute.read_only | Read Only | Boolean | 1.0.0 to 3.4.5 |
| smb.file_attribute.reparse | Reparse Point | Boolean | 1.0.0 to 3.4.5 |
| smb.file_attribute.sparse | Sparse | Boolean | 1.0.0 to 3.4.5 |
| smb.file_attribute.system | System | Boolean | 1.0.0 to 3.4.5 |
| smb.file_attribute.temporary | Temporary | Boolean | 1.0.0 to 3.4.5 |
| smb.file_attribute.volume | Volume ID | Boolean | 1.0.0 to 3.4.5 |
| smb.file_data | File Data | Sequence of bytes | 1.0.0 to 3.4.5 |
| smb.file_index | File Index | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.file_name_len | File Name Len | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.file_size | File Size | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.file_type | File Type | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.files_moved | Files Moved | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.find_first2.flags | Flags | Unsigned integer, 2 bytes | 1.12.0 to 3.4.5 |
| smb.find_first2.flags.backup | Backup Intent | Boolean | 1.0.0 to 3.4.5 |
| smb.find_first2.flags.close | Close | Boolean | 1.0.0 to 3.4.5 |
| smb.find_first2.flags.continue | Continue | Boolean | 1.0.0 to 3.4.5 |
| smb.find_first2.flags.eos | Close on EOS | Boolean | 1.0.0 to 3.4.5 |
| smb.find_first2.flags.resume | Resume | Boolean | 1.0.0 to 3.4.5 |
| smb.flags | Flags | Unsigned integer, 1 byte | 1.12.0 to 3.4.5 |
| smb.flags.canon | Canonicalized Pathnames | Boolean | 1.0.0 to 3.4.5 |
| smb.flags.caseless | Case Sensitivity | Boolean | 1.0.0 to 3.4.5 |
| smb.flags.lock | Lock and Read | Boolean | 1.0.0 to 3.4.5 |
| smb.flags.notify | Notify | Boolean | 1.0.0 to 3.4.5 |
| smb.flags.oplock | Oplocks | Boolean | 1.0.0 to 3.4.5 |
| smb.flags.receive_buffer | Receive Buffer Posted | Boolean | 1.0.0 to 3.4.5 |
| smb.flags.response | Request/Response | Boolean | 1.0.0 to 3.4.5 |
| smb.flags2 | Flags2 | Unsigned integer, 2 bytes | 1.12.0 to 3.4.5 |
| smb.flags2.compressed | Compressed | Boolean | 1.8.0 to 3.4.5 |
| smb.flags2.dfs | Dfs | Boolean | 1.0.0 to 3.4.5 |
| smb.flags2.ea | Extended Attributes | Boolean | 1.0.0 to 3.4.5 |
| smb.flags2.esn | Extended Security Negotiation | Boolean | 1.0.0 to 3.4.5 |
| smb.flags2.long_names_allowed | Long Names Allowed | Boolean | 1.0.0 to 3.4.5 |
| smb.flags2.long_names_used | Long Names Used | Boolean | 1.0.0 to 3.4.5 |
| smb.flags2.nt_error | Error Code Type | Boolean | 1.0.0 to 3.4.5 |
| smb.flags2.reparse_path | Reparse Path | Boolean | 1.8.0 to 3.4.5 |
| smb.flags2.roe | Execute-only Reads | Boolean | 1.0.0 to 3.4.5 |
| smb.flags2.sec_sig | Security Signatures | Boolean | 1.0.0 to 3.4.5 |
| smb.flags2.sec_sig_required | Security Signatures Required | Boolean | 1.8.0 to 3.4.5 |
| smb.flags2.string | Unicode Strings | Boolean | 1.0.0 to 3.4.5 |
| smb.fn_loi | Level of Interest | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.forwarded_name | Forwarded Name | Character string | 1.0.0 to 3.4.5 |
| smb.fragment.count | Fragment count | Unsigned integer, 4 bytes | 1.6.0 to 3.4.5 |
| smb.free_alloc_units | Free Units | Unsigned integer, 8 bytes | 1.0.0 to 3.4.5 |
| smb.free_block.count | Free Block Count | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.free_units | Free Units | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.fs_attr | FS Attributes | Unsigned integer, 4 bytes | 1.12.0 to 3.4.5 |
| smb.fs_attr.cpn | Case Preserving | Boolean | 1.0.0 to 3.4.5 |
| smb.fs_attr.css | Case Sensitive Search | Boolean | 1.0.0 to 3.4.5 |
| smb.fs_attr.fc | Compression | Boolean | 1.0.0 to 3.4.5 |
| smb.fs_attr.ns | Named Streams | Boolean | 1.0.0 to 3.4.5 |
| smb.fs_attr.pacls | Persistent ACLs | Boolean | 1.0.0 to 3.4.5 |
| smb.fs_attr.rov | Read Only Volume | Boolean | 1.0.0 to 3.4.5 |
| smb.fs_attr.sbr | Block Refcounting | Boolean | 2.6.0 to 3.4.5 |
| smb.fs_attr.se | Supports Encryption | Boolean | 1.0.0 to 3.4.5 |
| smb.fs_attr.shl | Hard Links | Boolean | 2.6.0 to 3.4.5 |
| smb.fs_attr.sis | Integrity Streams | Boolean | 2.6.0 to 3.4.5 |
| smb.fs_attr.sla | LFN APIs | Boolean | 1.0.0 to 3.4.5 |
| smb.fs_attr.soids | Supports OIDs | Boolean | 1.0.0 to 3.4.5 |
| smb.fs_attr.srp | Reparse Points | Boolean | 1.0.0 to 3.4.5 |
| smb.fs_attr.srs | Remote Storage | Boolean | 1.0.0 to 3.4.5 |
| smb.fs_attr.ssf | Sparse Files | Boolean | 1.0.0 to 3.4.5 |
| smb.fs_attr.ssv | Sparse VDL | Boolean | 2.6.0 to 3.4.5 |
| smb.fs_attr.st | Transactions | Boolean | 2.6.0 to 3.4.5 |
| smb.fs_attr.swo | Sequential Write Once | Boolean | 2.6.0 to 3.4.5 |
| smb.fs_attr.uod | Unicode On Disk | Boolean | 1.0.0 to 3.4.5 |
| smb.fs_attr.vis | Volume Is Compressed | Boolean | 1.0.0 to 3.4.5 |
| smb.fs_attr.vq | Volume Quotas | Boolean | 1.0.0 to 3.4.5 |
| smb.fs_bytes_per_sector | Bytes per Sector | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.fs_id | FS Id | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.fs_max_name_len | Max name length | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.fs_name | FS Name | Character string | 1.0.0 to 3.4.5 |
| smb.fs_name.len | Label Length | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.fs_sector_per_unit | Sectors/Unit | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.fs_units | Total Units | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.group_id | Group ID | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.impersonation.level | Impersonation | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.index_number | Index Number | Unsigned integer, 8 bytes | 1.0.0 to 3.4.5 |
| smb.info_level_not_understood | Information level not understood | Label | 2.0.0 to 3.4.5 |
| smb.info_level_unknown | Information level unknown | Label | 2.0.0 to 3.4.5 |
| smb.information_level.malformed | Information level structure goes past the end of the transaction data. | Label | 1.12.0 to 3.4.5 |
| smb.ipc_state | IPC State | Unsigned integer, 2 bytes | 1.12.0 to 3.4.5 |
| smb.ipc_state.endpoint | Endpoint | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.ipc_state.icount | Icount | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.ipc_state.nonblocking | Nonblocking | Boolean | 1.0.0 to 3.4.5 |
| smb.ipc_state.pipe_type | Pipe Type | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.ipc_state.read_mode | Read Mode | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.is_directory | Is Directory | Unsigned integer, 1 byte | 1.0.0 to 3.4.5 |
| smb.key | Key | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.last_name_offset | Last Name Offset | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.last_write.smb.date | Last Write Date | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.last_write.smb.time | Last Write Time | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.last_write.time | Last Write | Date and time | 1.0.0 to 3.4.5 |
| smb.length_of_sid | Length of SID | Unsigned integer, 4 bytes | 1.12.0 to 3.4.5 |
| smb.link_count | Link Count | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.lock.length | Length | Unsigned integer, 8 bytes | 1.0.0 to 3.4.5 |
| smb.lock.offset | Offset | Unsigned integer, 8 bytes | 1.0.0 to 3.4.5 |
| smb.lock.type | Lock Type | Unsigned integer, 1 byte | 1.12.0 to 3.4.5 |
| smb.lock.type.cancel | Cancel | Boolean | 1.0.0 to 3.4.5 |
| smb.lock.type.change | Change | Boolean | 1.0.0 to 3.4.5 |
| smb.lock.type.large | Large Files | Boolean | 1.0.0 to 3.4.5 |
| smb.lock.type.oplock_release | Oplock Break | Boolean | 1.0.0 to 3.4.5 |
| smb.lock.type.shared | Shared | Boolean | 1.0.0 to 3.4.5 |
| smb.locking.num_locks | Number of Locks | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.locking.num_unlocks | Number of Unlocks | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.locking.oplock.level | Oplock Level | Unsigned integer, 1 byte | 1.0.0 to 3.4.5 |
| smb.logged_in | Logged In | Frame number | 1.0.0 to 3.4.5 |
| smb.logged_out | Logged Out | Frame number | 1.0.0 to 3.4.5 |
| smb.mac | Mac Support Flags | Unsigned integer, 4 bytes | 1.12.0 to 3.4.5 |
| smb.mac.access_control | Mac Access Control | Boolean | 1.0.0 to 3.4.5 |
| smb.mac.desktop_db_calls | Desktop DB Calls | Boolean | 1.0.0 to 3.4.5 |
| smb.mac.finderinfo | Finder Info | Sequence of bytes | 1.0.0 to 3.4.5 |
| smb.mac.get_set_comments | Get Set Comments | Boolean | 1.0.0 to 3.4.5 |
| smb.mac.streams_support | Mac Streams | Boolean | 1.0.0 to 3.4.5 |
| smb.mac.support.flags | Mac Support Flags | Unsigned integer, 4 bytes | 1.0.0 to 1.8.15 |
| smb.mac.uids | Macintosh Unique IDs | Boolean | 1.0.0 to 3.4.5 |
| smb.machine_name | Machine Name | Character string | 1.0.0 to 3.4.5 |
| smb.marked_for_deletion | Marked for Deletion | Boolean | 1.0.0 to 3.4.5 |
| smb.max_buf | Max Buffer | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.max_bufsize | Max Buffer Size | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.max_mpx_count | Max Mpx Count | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.max_raw | Max Raw Buffer | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.max_referral_level | Max Referral Level | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.max_vcs | Max VCs | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.maxcount | Max Count | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.maxcount_high | Max Count High (multiply with 64K) | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.maxcount_low | Max Count Low | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.mdc | Max Data Count | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.message | Message | Character string | 1.0.0 to 3.4.5 |
| smb.message.len | Message Len | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.mgid | Message Group ID | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.mid | Multiplex ID | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.mincount | Min Count | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.missing_word_parameters | The word parameters are missing, so the byte parameters cannot be dissected. | Label | 2.4.16, 2.6.10 to 2.6.20, 3.0.3 to 3.4.5 |
| smb.mode | Mode | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.modify.time | Modified | Date and time | 1.0.0 to 3.4.5 |
| smb.monitor_handle | Monitor Handle | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.move.flags | Flags | Unsigned integer, 2 bytes | 1.12.0 to 3.4.5 |
| smb.move.flags.dir | Must be directory | Boolean | 1.0.0 to 3.4.5 |
| smb.move.flags.file | Must be file | Boolean | 1.0.0 to 3.4.5 |
| smb.move.flags.verify | Verify writes | Boolean | 1.0.0 to 3.4.5 |
| smb.mpc | Max Parameter Count | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.msc | Max Setup Count | Unsigned integer, 1 byte | 1.0.0 to 3.4.5 |
| smb.native_fs | Native File System | Character string | 1.0.0 to 3.4.5 |
| smb.native_lanman | Native LAN Manager | Character string | 1.0.0 to 3.4.5 |
| smb.native_os | Native OS | Character string | 1.0.0 to 3.4.5 |
| smb.next_entry_offset | Next Entry Offset | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.not_implemented | Not Implemented yet | Label | 1.12.0 to 3.4.5 |
| smb.nt.create.batch_oplock | Batch Oplock | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.create.dir | Create Directory | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.create.ext | Extended Response | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.create.oplock | Exclusive Oplock | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.create_options.backup_intent | Backup Intent | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.create_options.complete_if_oplocked | Complete If Oplocked | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.create_options.create_tree_connection | Create Tree Connection | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.create_options.delete_on_close | Delete On Close | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.create_options.directory | Directory | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.create_options.eight_dot_three_only | 8.3 Only | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.create_options.intermediate_buffering | Intermediate Buffering | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.create_options.no_compression | No Compression | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.create_options.no_ea_knowledge | No EA Knowledge | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.create_options.non_directory | Non-Directory | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.create_options.open_by_fileid | Open By FileID | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.create_options.open_for_free_space_query | Open For Free Space query | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.create_options.open_no_recall | Open No Recall | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.create_options.open_reparse_point | Open Reparse Point | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.create_options.random_access | Random Access | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.create_options.reserve_opfilter | Reserve Opfilter | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.create_options.sequential_only | Sequential Only | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.create_options.sync_io_alert | Sync I/O Alert | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.create_options.sync_io_nonalert | Sync I/O Nonalert | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.create_options.write_through | Write Through | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.function | Function | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.nt.ioctl.completion_filter | Completion Filter | Unsigned integer, 1 byte | 1.12.0 to 3.4.5 |
| smb.nt.ioctl.flags.root_handle | Root Handle | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.ioctl.isfsctl | IsFSctl | Unsigned integer, 1 byte | 1.0.0 to 3.4.5 |
| smb.nt.notify.action | Action | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.nt.notify.attributes | Attribute Change | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.notify.completion_filter | Completion Filter | Unsigned integer, 4 bytes | 1.12.0 to 3.4.5 |
| smb.nt.notify.creation | Created Change | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.notify.dir_name | Directory Name Change | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.notify.ea | EA Change | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.notify.file_name | File Name Change | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.notify.last_access | Last Access Change | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.notify.last_write | Last Write Change | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.notify.security | Security Change | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.notify.size | Size Change | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.notify.stream_name | Stream Name Change | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.notify.stream_size | Stream Size Change | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.notify.stream_write | Stream Write | Boolean | 1.0.0 to 3.4.5 |
| smb.nt.notify.watch_tree | Watch Tree | Unsigned integer, 1 byte | 1.0.0 to 3.4.5 |
| smb.nt_qsd | Security Information | Unsigned integer, 4 bytes | 1.12.0 to 3.4.5 |
| smb.nt_qsd.dacl | DACL | Boolean | 1.0.0 to 3.4.5 |
| smb.nt_qsd.group | Group | Boolean | 1.0.0 to 3.4.5 |
| smb.nt_qsd.owner | Owner | Boolean | 1.0.0 to 3.4.5 |
| smb.nt_qsd.sacl | SACL | Boolean | 1.0.0 to 3.4.5 |
| smb.nt_status | NT Status | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.nt_transaction_setup | NT Transaction Setup | Sequence of bytes | 2.0.0 to 3.4.5 |
| smb.nt_transaction_setup.unknown | Unknown NT Transaction Setup (matching request not seen) | Label | 2.0.0 to 3.4.5 |
| smb.ntr_clu | Cluster count | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.ntr_loi | Level of Interest | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.offset | Offset | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.offset_high | High Offset | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.old_file | Old File Name | Character string | 1.0.0 to 3.4.5 |
| smb.open.action | Action | Unsigned integer, 2 bytes | 1.12.0 to 3.4.5 |
| smb.open.action.lock | Exclusive Open | Boolean | 1.0.0 to 3.4.5 |
| smb.open.action.open | Open Action | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.open.flags | Flags | Unsigned integer, 2 bytes | 1.12.0 to 3.4.5 |
| smb.open.flags.add_info | Additional Info | Boolean | 1.0.0 to 3.4.5 |
| smb.open.flags.batch_oplock | Batch Oplock | Boolean | 1.0.0 to 3.4.5 |
| smb.open.flags.ealen | Total EA Len | Boolean | 1.0.0 to 3.4.5 |
| smb.open.flags.ex_oplock | Exclusive Oplock | Boolean | 1.0.0 to 3.4.5 |
| smb.open.function | Open Function | Unsigned integer, 2 bytes | 1.12.0 to 3.4.5 |
| smb.open.function.create | Create | Boolean | 1.0.0 to 3.4.5 |
| smb.open.function.open | Open | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.oplock.level | Oplock level | Unsigned integer, 1 byte | 1.0.0 to 3.4.5 |
| smb.originator_name | Originator Name | Character string | 1.0.0 to 3.4.5 |
| smb.padding | Padding | Sequence of bytes | 1.0.0 to 3.4.5 |
| smb.password | Password | Sequence of bytes | 1.0.0 to 3.4.5 |
| smb.path | Path | Character string | 1.0.0 to 3.4.5 |
| smb.pc | Parameter Count | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.pd | Parameter Displacement | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.pid | Process ID | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.pid.high | Process ID High | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.pipe.write_len | Pipe Write Len | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.pipe_info_flag | Pipe Info | Boolean | 1.0.0 to 3.4.5 |
| smb.po | Parameter Offset | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.position | Position | Unsigned integer, 8 bytes | 1.0.0 to 3.4.5 |
| smb.posix_acl.ace_perms | Permissions | Unsigned integer, 1 byte | 1.0.0 to 3.4.5 |
| smb.posix_acl.ace_perms.execute | EXECUTE | Boolean | 1.0.0 to 3.4.5 |
| smb.posix_acl.ace_perms.gid | GID | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.posix_acl.ace_perms.owner_gid | Owner GID | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.posix_acl.ace_perms.owner_uid | Owner UID | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.posix_acl.ace_perms.read | READ | Boolean | 1.0.0 to 3.4.5 |
| smb.posix_acl.ace_perms.uid | UID | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.posix_acl.ace_perms.write | WRITE | Boolean | 1.0.0 to 3.4.5 |
| smb.posix_acl.ace_type | ACE Type | Unsigned integer, 1 byte | 1.0.0 to 3.4.5 |
| smb.posix_acl.ace_type.unknown | Unknown posix ace type | Label | 2.0.0 to 3.4.5 |
| smb.posix_acl.num_def_aces | Number of default ACEs | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.posix_acl.num_file_aces | Number of file ACEs | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.posix_acl.version | Posix ACL version | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.primary_domain | Primary Domain | Character string | 1.0.0 to 3.4.5 |
| smb.print.identifier | Identifier | Character string | 1.0.0 to 3.4.5 |
| smb.print.mode | Mode | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.print.queued.date | Queued | Date and time | 1.0.0 to 3.4.5 |
| smb.print.queued.smb.date | Queued Date | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.print.queued.smb.time | Queued Time | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.print.restart_index | Restart Index | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.print.setup.len | Setup Len | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.print.spool.file_number | Spool File Number | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.print.spool.file_size | Spool File Size | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.print.spool.name | Name | Character string | 1.0.0 to 3.4.5 |
| smb.print.start_index | Start Index | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.print.status | Status | Unsigned integer, 1 byte | 1.0.0 to 3.4.5 |
| smb.pwlen | Password Length | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.qfsi_loi | Level of Interest | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.qpi_loi | Level of Interest | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.quota.flags | Quota Flags | Unsigned integer, 1 byte | 2.0.0 to 3.4.5 |
| smb.quota.flags.deny_disk | Deny Disk | Boolean | 1.0.0 to 3.4.5 |
| smb.quota.flags.enabled | Enabled | Boolean | 1.0.0 to 3.4.5 |
| smb.quota.flags.log_limit | Log Limit | Boolean | 1.0.0 to 3.4.5 |
| smb.quota.flags.log_warning | Log Warning | Boolean | 1.0.0 to 3.4.5 |
| smb.quota.hard.default | (Hard) Quota Limit | Unsigned integer, 8 bytes | 1.0.0 to 3.4.5 |
| smb.quota.soft.default | (Soft) Quota Threshold | Unsigned integer, 8 bytes | 1.0.0 to 3.4.5 |
| smb.quota.used | Quota Used | Unsigned integer, 8 bytes | 1.0.0 to 3.4.5 |
| smb.quota.user.change_time | Change Time | Date and time | 2.4.0 to 3.4.5 |
| smb.quota.user.offset | Next Offset | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.reassembled.length | Reassembled SMB length | Unsigned integer, 4 bytes | 1.4.0 to 3.4.5 |
| smb.remaining | Remaining | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.reparse_tag | Reparse Tag | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.replace | Replace | Boolean | 1.0.0 to 3.4.5 |
| smb.request.mask | Request Mask | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.reserved | Reserved | Sequence of bytes | 1.0.0 to 3.4.5 |
| smb.response.mask | Response Mask | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.response_in | Response in | Frame number | 1.0.0 to 3.4.5 |
| smb.response_to | Response to | Frame number | 1.0.0 to 3.4.5 |
| smb.response_type | Response type | Unsigned integer, 1 byte | 3.2.0 to 3.4.5 |
| smb.resume | Resume Key | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.resume.client.cookie | Client Cookie | Sequence of bytes | 1.0.0 to 3.4.5 |
| smb.resume.find_id | Find ID | Unsigned integer, 1 byte | 1.0.0 to 3.4.5 |
| smb.resume.key_len | Resume Key Length | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.resume.server.cookie | Server Cookie | Sequence of bytes | 1.0.0 to 3.4.5 |
| smb.rfid | Root FID | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.rm | Raw Mode | Unsigned integer, 2 bytes | 1.12.0 to 3.4.5 |
| smb.rm.read | Read Raw | Boolean | 1.0.0 to 3.4.5 |
| smb.rm.write | Write Raw | Boolean | 1.0.0 to 3.4.5 |
| smb.root.dir.count | Root Directory Count | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.root.file.count | Root File Count | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.root_dir_handle | Root Directory Handle | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.sc | Setup Count | Unsigned integer, 1 byte | 1.0.0 to 3.4.5 |
| smb.sd.length | SD Length | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.search.attribute | Search Attributes | Unsigned integer, 2 bytes | 1.12.0 to 3.4.5 |
| smb.search.attribute.archive | Archive | Boolean | 1.0.0 to 3.4.5 |
| smb.search.attribute.directory | Directory | Boolean | 1.0.0 to 3.4.5 |
| smb.search.attribute.hidden | Hidden | Boolean | 1.0.0 to 3.4.5 |
| smb.search.attribute.read_only | Read Only | Boolean | 1.0.0 to 3.4.5 |
| smb.search.attribute.system | System | Boolean | 1.0.0 to 3.4.5 |
| smb.search.attribute.volume | Volume ID | Boolean | 1.0.0 to 3.4.5 |
| smb.search_count | Search Count | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.search_id | Search ID | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.search_pattern | Search Pattern | Character string | 1.0.0 to 3.4.5 |
| smb.sec_desc_len | NT Security Descriptor Length | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.security.flags | Security Flags | Unsigned integer, 1 byte | 1.12.0 to 3.4.5 |
| smb.security.flags.context_tracking | Context Tracking | Boolean | 1.0.0 to 3.4.5 |
| smb.security.flags.effective_only | Effective Only | Boolean | 1.0.0 to 3.4.5 |
| smb.security_blob | Security Blob | Sequence of bytes | 1.0.0 to 3.4.5 |
| smb.security_blob_len | Security Blob Length | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.seek_mode | Seek Mode | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.segment | SMB Segment | Frame number | 1.0.0 to 3.4.5 |
| smb.segment.error | Defragmentation error | Frame number | 1.0.0 to 3.4.5 |
| smb.segment.multipletails | Multiple tail fragments found | Boolean | 1.0.0 to 3.4.5 |
| smb.segment.overlap | Fragment overlap | Boolean | 1.0.0 to 3.4.5 |
| smb.segment.overlap.conflict | Conflicting data in fragment overlap | Boolean | 1.0.0 to 3.4.5 |
| smb.segment.segments | SMB Segments | Label | 1.0.0 to 3.4.5 |
| smb.segment.toolongfragment | Fragment too long | Boolean | 1.0.0 to 3.4.5 |
| smb.sequence_num | Sequence Number | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.server | Server | Character string | 1.0.0 to 3.4.5 |
| smb.server_cap | Capabilities | Unsigned integer, 4 bytes | 1.12.0 to 3.4.5 |
| smb.server_cap.bulk_transfer | Bulk Transfer | Boolean | 1.0.0 to 1.6.16 |
| smb.server_cap.compressed_data | Compressed Data | Boolean | 1.0.0 to 3.4.5 |
| smb.server_cap.dfs | Dfs | Boolean | 1.0.0 to 3.4.5 |
| smb.server_cap.dynamic_reauth | Dynamic Reauth | Boolean | 1.8.0 to 3.4.5 |
| smb.server_cap.extended_security | Extended Security | Boolean | 1.0.0 to 3.4.5 |
| smb.server_cap.infolevel_passthru | Infolevel Passthru | Boolean | 1.0.0 to 3.4.5 |
| smb.server_cap.large_files | Large Files | Boolean | 1.0.0 to 3.4.5 |
| smb.server_cap.large_readx | Large ReadX | Boolean | 1.0.0 to 3.4.5 |
| smb.server_cap.large_writex | Large WriteX | Boolean | 1.0.0 to 3.4.5 |
| smb.server_cap.level_2_oplocks | Level 2 Oplocks | Boolean | 1.0.0 to 3.4.5 |
| smb.server_cap.lock_and_read | Lock and Read | Boolean | 1.0.0 to 3.4.5 |
| smb.server_cap.lwio | LWIO | Boolean | 1.8.0 to 3.4.5 |
| smb.server_cap.mpx_mode | MPX Mode | Boolean | 1.0.0 to 3.4.5 |
| smb.server_cap.nt_find | NT Find | Boolean | 1.0.0 to 3.4.5 |
| smb.server_cap.nt_smbs | NT SMBs | Boolean | 1.0.0 to 3.4.5 |
| smb.server_cap.nt_status | NT Status Codes | Boolean | 1.0.0 to 3.4.5 |
| smb.server_cap.raw_mode | Raw Mode | Boolean | 1.0.0 to 3.4.5 |
| smb.server_cap.reserved | Reserved | Boolean | 1.0.0 to 1.6.16 |
| smb.server_cap.rpc_remote_apis | RPC Remote APIs | Boolean | 1.0.0 to 3.4.5 |
| smb.server_cap.unicode | Unicode | Boolean | 1.0.0 to 3.4.5 |
| smb.server_cap.unix | UNIX | Boolean | 1.0.0 to 3.4.5 |
| smb.server_component | Server Component | Unsigned integer, 4 bytes | 2.0.0 to 3.4.5 |
| smb.server_date_time | Server Date and Time | Date and time | 1.0.0 to 3.4.5 |
| smb.server_date_time.smb_date | Server Date | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.server_date_time.smb_time | Server Time | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.server_fid | Server FID | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.server_guid | Server GUID | Globally Unique Identifier | 1.0.0 to 3.4.5 |
| smb.server_timezone | Server Time Zone | Signed integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.service | Service | Character string | 1.0.0 to 3.4.5 |
| smb.sessid | Session ID | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.session_key | Session Key | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.setup.action | Action | Unsigned integer, 2 bytes | 1.12.0 to 3.4.5 |
| smb.setup.action.guest | Guest | Boolean | 1.0.0 to 3.4.5 |
| smb.sfsi_loi | Level of Interest | Unsigned integer, 2 bytes | 1.8.0 to 3.4.5 |
| smb.share.access.delete | Delete | Boolean | 1.0.0 to 3.4.5 |
| smb.share.access.read | Read | Boolean | 1.0.0 to 3.4.5 |
| smb.share.access.write | Write | Boolean | 1.0.0 to 3.4.5 |
| smb.share_access | Share Access | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.short_file | Short File Name | Character string | 1.0.0 to 3.4.5 |
| smb.short_file_name_len | Short File Name Len | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.signature | Signature | Sequence of bytes | 1.0.0 to 3.4.5 |
| smb.size_returned_quota_data | Size of returned Quota data | Unsigned integer, 4 bytes | 1.12.0 to 3.4.5 |
| smb.sm | Security Mode | Unsigned integer, 2 bytes | 1.12.0 to 3.4.5 |
| smb.sm.mode | Mode | Boolean | 1.0.0 to 3.4.5 |
| smb.sm.password | Password | Boolean | 1.0.0 to 3.4.5 |
| smb.sm.sig_required | Sig Req | Boolean | 1.0.0 to 3.4.5 |
| smb.sm.signatures | Signatures | Boolean | 1.0.0 to 3.4.5 |
| smb.spi_loi | Level of Interest | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.storage_type | Storage Type | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.stream_name | Stream Name | Character string | 1.0.0 to 3.4.5 |
| smb.stream_name_len | Stream Name Length | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.stream_size | Stream Size | Unsigned integer, 8 bytes | 1.0.0 to 3.4.5 |
| smb.system.time | System Time | Date and time | 1.0.0 to 3.4.5 |
| smb.target_name | Target name | Character string | 1.0.0 to 3.4.5 |
| smb.target_name_len | Target name length | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.tdc | Total Data Count | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.tid | Tree ID | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.time | Time from request | Time offset | 1.0.0 to 3.4.5 |
| smb.timeout | Timeout | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.total_data_len | Total Data Length | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.tpc | Total Parameter Count | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.trans2.cmd | Subcommand | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.trans_data | Data | Sequence of bytes | 1.12.0 to 3.4.5 |
| smb.trans_data.parameters | Parameters | Sequence of bytes | 1.12.0 to 3.4.5 |
| smb.trans_data.setup_word | Setup Word | Unsigned integer, 2 bytes | 1.12.0 to 3.4.5 |
| smb.trans_name | Transaction Name | Character string | 1.0.0 to 3.4.5 |
| smb.transaction.flags | Flags | Unsigned integer, 2 bytes | 1.12.0 to 3.4.5 |
| smb.transaction.flags.dtid | Disconnect TID | Boolean | 1.0.0 to 3.4.5 |
| smb.transaction.flags.owt | One Way Transaction | Boolean | 1.0.0 to 3.4.5 |
| smb.uid | User ID | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.unicode_password | Unicode Password | Sequence of bytes | 1.0.0 to 3.4.5 |
| smb.unicode_pwlen | Unicode Password Length | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.units | Total Units | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.unix.capability | Capabilities | Unsigned integer, 8 bytes | 1.12.0 to 3.4.5 |
| smb.unix.capability.attr | Additional Attributes Capability | Boolean | 1.12.0 to 3.4.5 |
| smb.unix.capability.ea | EA Capability | Boolean | 1.12.0 to 3.4.5 |
| smb.unix.capability.encrpytion | Encryption Capability | Boolean | 1.12.0 to 3.2.13 |
| smb.unix.capability.encryption | Encryption Capability | Boolean | 3.4.0 to 3.4.5 |
| smb.unix.capability.fcntl | FCNTL Capability | Boolean | 1.0.0 to 3.4.5 |
| smb.unix.capability.large_read | Large Read Capability | Boolean | 1.12.0 to 3.4.5 |
| smb.unix.capability.large_write | Large Write Capability | Boolean | 1.12.0 to 3.4.5 |
| smb.unix.capability.mandatory_crypto | Mandatory Encryption Capability | Boolean | 1.12.0 to 3.4.5 |
| smb.unix.capability.posix_acl | POSIX ACL Capability | Boolean | 1.0.0 to 3.4.5 |
| smb.unix.capability.posix_path_ops | POSIX Path Operations Capability | Boolean | 1.12.0 to 3.4.5 |
| smb.unix.capability.posix_paths | POSIX Pathnames Capability | Boolean | 1.12.0 to 3.4.5 |
| smb.unix.capability.proxy | Proxy Capability | Boolean | 1.12.0 to 3.4.5 |
| smb.unix.file.atime | Last access | Date and time | 1.0.0 to 3.4.5 |
| smb.unix.file.crtime | Creation time | Date and time | 1.6.0 to 3.4.5 |
| smb.unix.file.dev_major | Major device | Unsigned integer, 8 bytes | 1.0.0 to 3.4.5 |
| smb.unix.file.dev_minor | Minor device | Unsigned integer, 8 bytes | 1.0.0 to 3.4.5 |
| smb.unix.file.file_type | File type | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.unix.file.gid | GID | Unsigned integer, 8 bytes | 1.0.0 to 3.4.5 |
| smb.unix.file.link_dest | Link destination | Character string | 1.0.0 to 3.4.5 |
| smb.unix.file.mtime | Last modification | Date and time | 1.0.0 to 3.4.5 |
| smb.unix.file.name | File name | Character string | 1.6.0 to 3.4.5 |
| smb.unix.file.name_length | File name length | Unsigned integer, 4 bytes | 1.6.0 to 3.4.5 |
| smb.unix.file.num_bytes | Number of bytes | Unsigned integer, 8 bytes | 1.0.0 to 3.4.5 |
| smb.unix.file.num_links | Num links | Unsigned integer, 8 bytes | 1.0.0 to 3.4.5 |
| smb.unix.file.perms | File permissions | Unsigned integer, 8 bytes | 1.0.0 to 3.4.5 |
| smb.unix.file.size | File size | Unsigned integer, 8 bytes | 1.0.0 to 3.4.5 |
| smb.unix.file.stime | Last status change | Date and time | 1.0.0 to 3.4.5 |
| smb.unix.file.uid | UID | Unsigned integer, 8 bytes | 1.0.0 to 3.4.5 |
| smb.unix.file.unique_id | Unique ID | Unsigned integer, 8 bytes | 1.0.0 to 3.4.5 |
| smb.unix.find_file.next_offset | Next entry offset | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.unix.find_file.resume_key | Resume key | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.unix.major_version | Major Version | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.unix.minor_version | Minor Version | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.unix.whoami.mapflags | UNIX whoami mapping flags | Unsigned integer, 4 bytes | 1.12.0 to 3.4.5 |
| smb.unix.whoami.mapflags_mask | UNIX whoami mapping flags mask | Unsigned integer, 4 bytes | 1.12.0 to 3.4.5 |
| smb.unix.whoami.num_gids | Number of supplementary UNIX GIDs | Unsigned integer, 4 bytes | 1.12.0 to 3.4.5 |
| smb.unix.whoami.num_sids | Number of supplementary SIDs | Unsigned integer, 4 bytes | 1.12.0 to 3.4.5 |
| smb.unix.whoami.sids_buflen | Supplementary SIDs buffer length | Unsigned integer, 4 bytes | 1.12.0 to 3.4.5 |
| smb.unix_info2.file.flags | Flags | Unsigned integer, 4 bytes | 1.6.0 to 3.4.5 |
| smb.unix_info2.file.flags.append_only | Append-only | Boolean | 1.6.0 to 3.4.5 |
| smb.unix_info2.file.flags.do_not_backup | Do not backup | Boolean | 1.6.0 to 3.4.5 |
| smb.unix_info2.file.flags.enable_undelete | Enable undelete | Boolean | 1.6.0 to 3.4.5 |
| smb.unix_info2.file.flags.hidden | Hidden | Boolean | 1.6.0 to 3.4.5 |
| smb.unix_info2.file.flags.immutable | Immutable | Boolean | 1.6.0 to 3.4.5 |
| smb.unix_info2.file.flags.no_update_atime | Don\'t update atime | Boolean | 1.6.0 to 3.4.5 |
| smb.unix_info2.file.flags.secure_delete | Secure delete | Boolean | 1.6.0 to 3.4.5 |
| smb.unix_info2.file.flags.synchronous | Synchronous | Boolean | 1.6.0 to 3.4.5 |
| smb.unix_info2.file.flags_mask | Flags mask | Unsigned integer, 4 bytes | 1.6.0 to 3.4.5 |
| smb.unknown | Unknown Data | Sequence of bytes | 1.0.0 to 1.2.18 |
| smb.unknown_data | Unknown Data | Sequence of bytes | 1.4.0 to 3.4.5 |
| smb.unknown_field | Unknown field | Unsigned integer, 4 bytes | 1.4.0 to 1.10.14 |
| smb.vc | VC Number | Unsigned integer, 2 bytes | 1.0.0 to 3.4.5 |
| smb.volume.label | Label | Character string | 1.0.0 to 3.4.5 |
| smb.volume.label.len | Label Length | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.volume.serial | Volume Serial Number | Unsigned integer, 4 bytes | 1.0.0 to 3.4.5 |
| smb.volume_guid | Volume GUID | Globally Unique Identifier | 1.8.0 to 3.4.5 |
| smb.wct | Word Count (WCT) | Unsigned integer, 1 byte | 1.0.0 to 3.4.5 |
| smb.word_parameters | Word parameters | Sequence of bytes | 2.0.0 to 3.4.5 |
| smb.word_unk_response_format | Words for unknown response format | Sequence of bytes | 2.0.0 to 3.4.5 |
| smb.write.mode | Write Mode | Unsigned integer, 2 bytes | 1.12.0 to 3.4.5 |
| smb.write.mode.connectionless | Connectionless | Boolean | 1.0.0 to 3.4.5 |
| smb.write.mode.message_start | Message Start | Boolean | 1.0.0 to 3.4.5 |
| smb.write.mode.raw | Write Raw | Boolean | 1.0.0 to 3.4.5 |
| smb.write.mode.return_remaining | Return Remaining | Boolean | 1.0.0 to 3.4.5 |
| smb.write.mode.write_through | Write Through | Boolean | 1.0.0 to 3.4.5 |
Go Beyond with Riverbed Technology
I have a lot of traffic...
ANSWER: SteelCentral™ AppResponse 11
- • Full stack analysis – from packets to pages
- • Rich performance metrics & pre-defined insights for fast problem identification/resolution
- • Modular, flexible solution for deeply-analyzing network & application performance