[jcifs] ServerEnum2 Problems on smb:// scan

Allen, Michael B (RSCH) Michael_B_Allen at ml.com
Mon Dec 2 10:27:49 EST 2002


> -----Original Message-----
> From:	Matthew Tippett [SMTP:matthew at casero.com]
> Sent:	Wednesday, November 27, 2002 9:42 AM
> To:	jcifs at lists.samba.org
> Subject:	[jcifs] ServerEnum2 Problems on smb:// scan
> 
> Hello,
> 
> I originally sent this email with two network traces attached.  This is 
> larger than the unmoderated limit, so I am posting again sans 
> attachments and will place the attachments at
> 
> 	http://www.technology-forum.org/cifs-winme.pcap
> 	http://www.technology-forum.org/cifs-winme-good.pcap
> 
> Calling SmbFile("smb://").listFiles() has some funny behaviour on our 
> system.  I have done some initial debugging and will report more as I 
> find it.
> 
> The first scan for domains works fine, on subsequent scans the following
> exception occurs..
> 
	What is the significance of this? Do you mean that you are scanning multiple
	times within the same VM instance? Or are you running the VM once, stopping,
	and then running 'java ...' again?

> jcifs.smb.SmbException: 
> GetServerEnum2Response[command=SMB_COM_TRANSACTION,received=true,errorCo
> de=0x00000000,flags=0x0098,flags2=0x0001,tid=51202,pid=64459,uid=0,mid=2
> 59,wordCount=10,byteCount=9,totalParameterCount=8,totalDataCount=0,param
> eterCount=8,parameterOffset=55,parameterDisplacement=0,dataCount=0,dataO
> ffset=64,dataDisplacement=0,setupCount=0,pad=0,pad1=0,status=2320,conver
> ter=0,entriesReturned=0,totalAvailableEntries=45]
> 
> The stack dump against 0.7.0b9 is
> 
	You cut out the exception. What is it?

> at jcifs.smb.SmbFile.listFiles(SmbFile.java:1267)
> at jcifs.smb.SmbFile.listFiles(SmbFile.java:1219)
> at 
> com.casero.eden.service.cifs.CIFSCrawler.listFilesWithAuth(CIFSCrawler.j
> ava:196)
> at com.casero.eden.service.cifs.CIFSCrawler.scan(CIFSCrawler.java:100)
> at com.casero.eden.service.cifs.CIFSCrawler.run(CIFSCrawler.java:67)
> at java.lang.Thread.run(Thread.java:536)
> 
> So, have a look, there are a few differences,
> 
>      o The first time it does an initial connect with *SMBSERVER
>      o The first time it does a Session Setup and X
> 
	So you're saying, an initial Domain Enum is fine but a subsequent Domain Enum
	on an established transport fails with ERRRAP 2320?

> The exception is thrown because the Server2Enum call has a status of 
> 2320 (which is unknown even to ethereal).
> 
	H:\>net helpmsg 2320

	The computer is not active in this domain.

	EXPLANATION

	This message should occur only on a down-level computer. Any action to correct
	the problem should be performed on that computer.
	Your computer is not active in the domain you specified.

	ACTION

	To perform tasks in the specified domain, you must add the domain to the list
	of domains in which the workstation is a member.

	Not sure if this description is correct for a RAP function status code though.

> The client machine is Windows ME.
> 
	And not Win98?

	Looking at your packet capture reveals that a domain of '??D??\1\0' is being
	specified in the NetServerEnum2 request. This is very odd. This is either jCIFS
	packet corruption or you really are passing a domain parameter of that name.
	It is not easy for me to debug packet corruption in RAP functions. Perhaps you
	can add a debugging statement to NetServerEnum2.java to print out the domain
	string being encoded to determine which problem we're seeing.

> More details tomorrow as I hunt things down...
> 
> Regards,
> 
> Matthew
> 
> 
> -----
> 
> The information contained in this message is proprietary of Casero Inc.,
> protected from disclosure, and may be privileged. The information is
> intended to be conveyed only to the designated recipient(s) of the
> message. If the reader of this message is not the intended recipient,
> you are hereby notified that any dissemination, use, distribution or
> copying of this communication is strictly prohibited and may be
> unlawful. If you have received this communication in error, please
> notify us immediately by replying to the message and deleting it from
> your computer. Thank you.
> 




More information about the jcifs mailing list