Wireshark · Smb2-protocol: [Smb2-protocol] Re: create blob

[tridge@xxxxxxxxx]

Ronnie,

 > > I've worked out what the 16 bytes between the access_mask and filename
 > > are in the all_info2 level for SMB2. The first 8 bytes are the
 > > position (as set by the POSITION_INFORMATION level) and the 2nd 8
 > > bytes are the mode (as set by the MODE_INFORMATION level).
 > 
 > 
 > Neither me nor ethereal knows those levels.
 > 
 > Can you point me to which file in samba you implement these levels and
 > i will update the wiki and ethereal with dissection both for SMB and
 > SMB2

sure. Full list of levels for trans2 are in:

 http://samba.org/ftp/unpacked/samba4/source/include/trans2.h

structure definitions of all those levels is in:

 http://samba.org/ftp/unpacked/samba4/source/include/smb_interfaces.h

parsing code for all the queryfileinfo levels is in:

 http://samba.org/ftp/unpacked/samba4/source/libcli/raw/rawfileinfo.c

parsing code for all the setfileinfo levels is in:

 http://samba.org/ftp/unpacked/samba4/source/libcli/raw/rawsetfileinfo.c

parsing code for all the queryfsinfo levels is in:

  http://samba.org/ftp/unpacked/samba4/source/libcli/raw/rawfsinfo.c

pasrsing code for all the EA related blobs is in:

  http://samba.org/ftp/unpacked/samba4/source/libcli/raw/raweas.c

Also see 
	http://wiki.ethereal.com/SMB?action=AttachFile&do=get&target=smbtorture.cap.gz

for a (large) capture I've just uploaded that gives you examples of
all the levels that Samba4 knows about, as well as examples of a wide
range of other SMB stuff.

Cheers, Tridge