Smb2-protocol: [Smb2-protocol] opcode 0x0b

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: ronnie sahlberg <ronniesahlberg@xxxxxxxxx>
Date: Tue, 15 Nov 2005 10:46:35 +1100
opcode 0x0b is not a secondary treedissconnect    i dont even think it is associated with shares at all.

it appears that this function can be used on shares   but it can be used on other things as well.


It takes bytes 8-23   a FID
and also a name further down in the packet.


in the trace dir-then-open...

there are a lot of these calls   and successful replies.
Look at 1455/1456   the reply contains things like the strings "BUILTIN"
A SID in text form  and a fe account names.