Govinda Sharma prngovinda at hotmail.com
Thu Nov 23 05:50:22 GMT 2000


> >
> > I am using a sniffer to observe the SMB packets.
> >
> > I find that windows client makes multiple TREE_CONNECTS
> > to the IPC$ share prior to an actual TREE_CONNECT to
> > the mapped share and also prior to opening a file.
> > Does anyone know what do these TREE_CONNECTS to the IPC$
> > share achieve ?
>The IPC$ share is a built in share for an SMB server which
>clients can connect to in order to perform session level
>validation.  This then allows other remote administration
>commands (including the ability to support named pipes
>over IPC$).

But then why does the client do multiple TREE_CONNECT to the IPC$ share on 
the server ? It does these after the SESSION_SETUP is over.

Specifically, I observe the following on the sniffer (after NEGOTIATE
and SETUP have been done):

[1] multiple TREE_CONNECT requests to the IPC$
[2] TREE_CONNECT request to the [test] share (e: on client is
    being mapped to [test] on the server)
[3] multiple TREE_CONNECT requests to the IPC$

I don't understand why the client is doing steps [1] and [3].



> > Furthermore, Samba returns a DIFFERENT Tid for each TREE_CONNECT
> > request to the IPC$ share. Is that required by the client ?
>the Tree connection ID for each resouce connection should be
>an ID used on a per session basis.
>Cheers, jerry
>    /\  Gerald (Jerry) Carter                     Professional Services
>  \/    http://www.valinux.com/  VA Linux Systems   gcarter at valinux.com
>        http://www.samba.org/       SAMBA Team          jerry at samba.org
>        http://www.plainjoe.org/                     jerry at plainjoe.org
>        "...a hundred billion castaways looking for a home."
>                                 - Sting "Message in a Bottle" ( 1979 )

Get more from the Web.  FREE MSN Explorer download : http://explorer.msn.com

More information about the samba-technical mailing list