[cifs-protocol] correction to SMB SMB_QUERY_FILE_ALL_INFO info level

James Peach jpeach at apple.com
Thu Jun 19 15:55:14 GMT 2008

Hi all,

Just posting this note so that there is something searchable on the web.

The SMB_QUERY_FILE_ALL_INFO info level has been specified incorrectly  
as far back as the Leach-Naik drafts. The correct format for this  
response is:

Data Block Encoding		Description
LARGE_INTEGER CreationTime	Time when file was created
LARGE_INTEGER LastAccessTime	Time of last file access
LARGE_INTEGER LastWriteTime	Time of last write to the file
LARGE_INTEGER ChangeTime	Time when file was last changed
ULONG Attributes		File Attributes
LARGE_INTEGER AllocationSize	Allocated size of the file in number of  
LARGE_INTEGER EndofFile		Offset to the first free byte in the file
ULONG NumberOfLinks		Number of hard links to the file
BOOLEAN DeletePending		Indicates whether the file is marked for deletion
BOOLEAN Directory		Indicates whether the file is a directory
USHORT Unknown			Could be a padd value?
ULONG EASize			Size of the file's extended attributes in bytes
ULONG FileNameLength		Length of the file name in number of bytes
STRING FileName			Name of the file

All versions of Windows and Samba get this right. AFAIK the only  
modern SMB client that uses this info level is the Mac OSX client. I  
believe that some versions of NetApp filers get this wrong. Wireshark  
used to get this wrong, but recent versions get it right.

I posted this on the MSDN File Services forum, but it ate my  
formatting. Hopefully this is more legible :)


More information about the cifs-protocol mailing list