[cifs-protocol] File Attributes in NT_CREATE_ANDX

[Adam Simpkins]

On Tue, Feb 06, 2007 at 08:11:10PM +0000, Joseph Kuan wrote:
> Hi,
> 
>   I use ethereal to analysis the CIFS protocol when opening a file. I 
> notice there are two consecutive sequence of NT_CREATE_ANDX -> READ_ANDX 
> -> CLOSE.
> 
> However, the first one NT_CREATE_ANDX has File Attributes: 0x00000000 
> and the second one has value 0x00000080.

Are these the attributes in the request or the response?

Regardless, I don't think it matters much.  I'm not an expert on
Windows behavior, but as far as I know these two sets of attributes
should be mostly equivalent.  Microsoft's documentation says the
ATTR_NORMAL bit (0x80) indicates that this is a "normal" file with no
other attribute bits set.  It seems redundant to me, but clients and
servers normally send 0x80 instead of just 0x0.


> I expect both File Attributes 
> have values, 0x00000080, such that the bit for "Normal: This file is an 
> ordinary file" is set. Strangely, the one with zero value have different 
> label, "Normal: This file has some attribute set".

This is probably just how ethereal chooses to label the values.  As
far as I know there isn't any real semantic difference.

-- 
Adam Simpkins
simpkins at neopathnetworks.com