Wireshark · Ethereal-dev: Re: [Ethereal-dev] SMB: New info level

[Ian Schorr <spamcontrol2@xxxxxxxxxxx>]

Guy Harris wrote:

> On Jan 19, 2004, at 5:48 PM, Ian Schorr wrote:
>
> > Attached is a diff against latest CVS packet-smb.c, adding a new 
> > infolevel for Query_Path_Info & Query_File_Info.
>
>
> What generates requests for that infolevel?

I noticed it just after a WinXP SP1 client mapped the home directory 
specified in his profile, though I'm not sure if it was part of the 
mapping process (the user's home directory is in a subfolder of a share 
instead of the root, and it was that directory that was being probed) or 
some later mechanism during user logon.  Samba handles this infolevel, 
as well.

> > +    /* file size */
> > +    CHECK_BYTE_COUNT_SUBR(8);
> > +    proto_tree_add_item(tree, hf_smb_file_size64, tvb, offset, 8, 
> > TRUE);
> > +    offset += 8;
> > +    *bcp -= 8;
>
>
> Should that just use hf_smb_end_of_file?  (Or, alternatively, should 
> hf_smb_end_of_file be replaced by hf_smb_file_size64?)


Probably should use hf_smb_end_of_file, though the filter description 
should really be changed from "Offset to the first free byte in the 
file" to "Offset to end of file" or "Length of file"

Ian