[cifs-protocol] File Attributes in NT_CREATE_ANDX

[Joseph Kuan]

Hi,

  I use ethereal to analysis the CIFS protocol when opening a file. I 
notice there are two consecutive sequence of NT_CREATE_ANDX -> READ_ANDX 
-> CLOSE.

However, the first one NT_CREATE_ANDX has File Attributes: 0x00000000 
and the second one has value 0x00000080. I expect both File Attributes 
have values, 0x00000080, such that the bit for "Normal: This file is an 
ordinary file" is set. Strangely, the one with zero value have different 
label, "Normal: This file has some attribute set".

What does this mean?

Many thanks in advance.
Joe



**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote also confirms that this email message has been swept for the presence of viruses using SOPHOS.

http://www.itheon.com
**********************************************************************