unknown RPC opcodes during join+logon
Steven French
sfrench at us.ibm.com
Fri Jul 26 16:43:02 GMT 2002
Jim and I were crawling through join and logon again for "native" Win2K to
Win2K AD DC and it was very interesting. Five unknown (at least unknown
to Samba head and ethereal) RPC calls are sent from Win2K. Does anyone
know about them?
I have excerpted the few interesting frames and put their hex data below.
In the native Win2K join of interest in particular is frame pair 5/6
DCE/RPC requests on LSA pipe with unknown (at least to Samba and Ethereal
it is unknown) opcode 0x2E. The response data reminds me a bit of what I
would expect of a "DomainGetInfo" like function (since it returns three
forms of the domain name "mcd"). Also of interest is frame pairs 9/10 and
11/12 (similar request but not identical response) which seem to be
"ServerGetInfo" type functions on the SAMR pipe with unknown opcode 0x3e
(the request supplied the server name \\PSFLINUX2K)
Frame 15/16, unknown opcode 0x28 on NETLOGON pipe given the server name in
the request returns with a trusted domain in the response which may be a
good enough clue to figure out to what call it corresponds.
The only other weird frame is later (not appended below) a NTLMSSP DCERPC
auth request which may be optional.
After join the boot and logon includes only two frames that require
further analysis - the DCE/RPC request to the NETLOGON pipe for unknown
opcode 0x1a (once during boot, once during logon) and request to NETLOGON
pipe for unknown opcode 0x1D (during boot I think).
Ideas?
Excerpts from join trace follows:
Frame 1 (144 on wire, 144 captured)
Tree Connect AndX Request (0x75)
Word Count (WCT): 4
AndXCommand: No further commands
Reserved: 00
AndXOffset: 86
Flags: 0x0008
.... .... .... ...0 = Disconnect TID: Do NOT disconnect TID
Password Length: 1
Byte Count (BCC): 43
Password: 00
Path: \\PSFLINUX2K\IPC$
Service: ?????
0000 00 50 56 09 ab 12 00 50 56 75 43 ca 08 00 45 00 .PV....PVuC...E.
0010 00 82 00 6d 40 00 80 06 3b 4d 0a 4e d5 13 0a 4e ...m at ...;M.N...N
0020 d5 0c 04 0e 01 bd b3 be 4c 4a 71 2e 50 be 50 18 ........LJq.P.P.
0030 42 08 b9 fc 00 00 00 00 00 56 ff 53 4d 42 75 00 B........V.SMBu.
0040 00 00 00 18 07 c8 00 00 0c cc 3e 04 fd 22 ce 1c ..........>.."..
0050 00 00 00 00 ff fe 00 08 80 00 04 ff 00 56 00 08 .............V..
0060 00 01 00 2b 00 00 5c 00 5c 00 50 00 53 00 46 00 ...+..\.\.P.S.F.
0070 4c 00 49 00 4e 00 55 00 58 00 32 00 4b 00 5c 00 L.I.N.U.X.2.K.\.
0080 49 00 50 00 43 00 24 00 00 00 3f 3f 3f 3f 3f 00 I.P.C.$...?????.
Frame 2 (114 on wire, 114 captured)
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response to: 1
SMB Command: Tree Connect AndX (0x75)
NT Status: STATUS_SUCCESS (0x00000000)
0000 00 50 56 75 43 ca 00 50 56 09 ab 12 08 00 45 00 .PVuC..PV.....E.
0010 00 64 03 c7 40 00 80 06 38 11 0a 4e d5 0c 0a 4e .d.. at ...8..N...N
0020 d5 13 01 bd 04 0e 71 2e 50 be b3 be 4c a4 50 18 ......q.P...L.P.
0030 44 16 82 ce 00 00 00 00 00 38 ff 53 4d 42 75 00 D........8.SMBu.
0040 00 00 00 98 07 c8 00 00 17 f0 15 5e 74 86 18 f9 ...........^t...
0050 00 00 00 08 ff fe 00 08 80 00 07 ff 00 38 00 01 .............8..
0060 00 ff 01 00 00 ff 01 00 00 07 00 49 50 43 00 00 ...........IPC..
0070 00 00 ..
Frame 3 (158 on wire, 158 captured)
SMB (Server Message Block Protocol)
NT Create AndX Request (0xa2)
File Name: \lsarpc
0000 00 50 56 09 ab 12 00 50 56 75 43 ca 08 00 45 00 .PV....PVuC...E.
0010 00 90 00 6e 40 00 80 06 3b 3e 0a 4e d5 13 0a 4e ...n at ...;>.N...N
0020 d5 0c 04 0e 01 bd b3 be 4c a4 71 2e 50 fa 50 18 ........L.q.P.P.
0030 41 cc 67 fc 00 00 00 00 00 64 ff 53 4d 42 a2 00 A.g......d.SMB..
0040 00 00 00 18 07 c8 00 00 c4 ab 76 4e 81 2f 50 7f ..........vN./P.
0050 00 00 00 08 d4 00 00 08 c0 00 18 ff 00 de de 00 ................
0060 0e 00 16 00 00 00 00 00 00 00 9f 01 02 00 00 00 ................
0070 00 00 00 00 00 00 00 00 00 00 03 00 00 00 01 00 ................
0080 00 00 40 00 00 00 02 00 00 00 03 11 00 00 5c 00 .. at ...........\.
0090 6c 00 73 00 61 00 72 00 70 00 63 00 00 00 l.s.a.r.p.c...
Frame 4 (193 on wire, 193 captured)
Server Component: SMB
Response to: 3
SMB Command: NT Create AndX (0xa2)
NT Status: STATUS_SUCCESS (0x00000000)
0000 00 50 56 75 43 ca 00 50 56 09 ab 12 08 00 45 00 .PVuC..PV.....E.
0010 00 b3 03 c8 40 00 80 06 37 c1 0a 4e d5 0c 0a 4e .... at ...7..N...N
0020 d5 13 01 bd 04 0e 71 2e 50 fa b3 be 4d 0c 50 18 ......q.P...M.P.
0030 43 ae 36 51 00 00 00 00 00 87 ff 53 4d 42 a2 00 C.6Q.......SMB..
0040 00 00 00 98 07 c8 00 00 18 3f 07 c4 c1 de 46 01 .........?....F.
0050 00 00 00 08 d4 00 00 08 c0 00 2a ff 00 87 00 00 ..........*.....
0060 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 . at ..............
0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0080 00 00 00 00 00 00 80 00 00 00 00 10 00 00 00 00 ................
0090 00 00 00 00 00 00 00 00 00 00 02 00 ff 05 00 00 ................
00a0 00 02 02 06 0a 2a 86 48 86 f7 12 01 02 02 03 06 .....*.H........
00b0 0a 2b 06 01 04 01 82 ff 01 1f 00 9b 01 12 00 04 .+..............
00c0 82 .
Frame 5 (188 on wire, 188 captured)
DCE RPC
0000 00 50 56 09 ab 12 00 50 56 75 43 ca 08 00 45 00 .PV....PVuC...E.
0010 00 ae 00 71 40 00 80 06 3b 1d 0a 4e d5 13 0a 4e ...q at ...;..N...N
0020 d5 0c 04 0e 01 bd b3 be 4e 64 71 2e 52 71 50 18 ........Ndq.RqP.
0030 40 55 43 a1 00 00 00 00 00 82 ff 53 4d 42 25 00 @UC........SMB%.
0040 00 00 00 18 07 c8 00 00 b5 64 c5 0a 88 f4 5c 5c .........d....\\
0050 00 00 00 08 d4 00 00 08 80 01 10 00 00 2e 00 00 ................
0060 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 54 ...............T
0070 00 2e 00 54 00 02 00 26 00 00 40 3f 00 05 5c 00 ...T...&..@?..\.
0080 50 00 49 00 50 00 45 00 5c 00 00 00 79 a0 05 00 P.I.P.E.\...y...
0090 00 03 10 00 00 00 2e 00 00 00 02 00 00 00 16 00 ................
00a0 00 00 00 00 2e 00 00 00 00 00 c0 00 40 18 c4 a0 ............ at ...
00b0 d6 11 8c ed 00 50 56 09 ab 12 0c 00 .....PV.....
Frame 6 (330 on wire, 330 captured)
DCE RPC
0000 00 50 56 75 43 ca 00 50 56 09 ab 12 08 00 45 00 .PVuC..PV.....E.
0010 01 3c 03 cb 40 00 80 06 37 35 0a 4e d5 0c 0a 4e .<.. at ...75.N...N
0020 d5 13 01 bd 04 0e 71 2e 52 71 b3 be 4e ea 50 18 ......q.Rq..N.P.
0030 41 d0 8f 44 00 00 00 00 01 10 ff 53 4d 42 25 00 A..D.......SMB%.
0040 00 00 00 98 07 c8 00 00 6d bb 6a d5 52 c8 1a 80 ........m.j.R...
0050 00 00 00 08 d4 00 00 08 80 01 0a 00 00 d8 00 00 ................
0060 00 00 00 38 00 00 00 d8 00 38 00 00 00 00 00 d9 ...8.....8......
0070 00 00 05 00 02 03 10 00 00 00 d8 00 00 00 02 00 ................
0080 00 00 c0 00 00 00 00 00 00 00 c8 2b 13 00 0c 00 ...........+....
0090 40 18 06 00 08 00 40 4e 0f 00 20 00 22 00 68 83 @..... at N.. .".h.
00a0 11 00 20 00 22 00 38 83 11 00 0f 64 ce f7 1d fe .. .".8....d....
00b0 30 45 8d f5 78 80 b3 a7 42 93 e8 82 11 00 04 00 0E..x...B.......
00c0 00 00 00 00 00 00 03 00 00 00 4d 00 43 00 44 00 ..........M.C.D.
00d0 00 00 11 00 00 00 00 00 00 00 10 00 00 00 6d 00 ..............m.
00e0 63 00 64 00 2e 00 6d 00 61 00 69 00 6e 00 65 00 c.d...m.a.i.n.e.
00f0 2e 00 72 00 72 00 2e 00 63 00 6f 00 6d 00 11 00 ..r.r...c.o.m...
0100 00 00 00 00 00 00 10 00 00 00 6d 00 63 00 64 00 ..........m.c.d.
0110 2e 00 6d 00 61 00 69 00 6e 00 65 00 2e 00 72 00 ..m.a.i.n.e...r.
0120 72 00 2e 00 63 00 6f 00 6d 00 04 00 00 00 01 04 r...c.o.m.......
0130 00 00 00 00 00 05 15 00 00 00 c2 e9 ba 17 c5 dd ................
0140 9a a7 82 f7 23 e3 00 00 00 00 ....#.....
Frame 7 (154 on wire, 154 captured)
NT Create AndX Request (0xa2)
File Name: \samr
0000 00 50 56 09 ab 12 00 50 56 75 43 ca 08 00 45 00 .PV....PVuC...E.
0010 00 8c 00 73 40 00 80 06 3b 3d 0a 4e d5 13 0a 4e ...s at ...;=.N...N
0020 d5 0c 04 0e 01 bd b3 be 4f 70 71 2e 54 21 50 18 ........Opq.T!P.
0030 44 70 ac f1 00 00 00 00 00 60 ff 53 4d 42 a2 00 Dp.......`.SMB..
0040 00 00 00 18 07 c8 00 00 92 23 e5 a3 7c a8 60 b8 .........#..|.`.
0050 00 00 00 08 d4 00 00 08 00 02 18 ff 00 de de 00 ................
0060 0a 00 16 00 00 00 00 00 00 00 9f 01 02 00 00 00 ................
0070 00 00 00 00 00 00 00 00 00 00 03 00 00 00 01 00 ................
0080 00 00 40 00 00 00 02 00 00 00 03 0d 00 00 5c 00 .. at ...........\.
0090 73 00 61 00 6d 00 72 00 00 00 s.a.m.r...
Frame 8 (193 on wire, 193 captured)
SMB Command: NT Create AndX (0xa2)
NT Status: STATUS_SUCCESS (0x00000000)
0000 00 50 56 75 43 ca 00 50 56 09 ab 12 08 00 45 00 .PVuC..PV.....E.
0010 00 b3 03 cd 40 00 80 06 37 bc 0a 4e d5 0c 0a 4e .... at ...7..N...N
0020 d5 13 01 bd 04 0e 71 2e 54 21 b3 be 4f d4 50 18 ......q.T!..O.P.
0030 40 e6 5b 24 00 00 00 00 00 87 ff 53 4d 42 a2 00 @.[$.......SMB..
0040 00 00 00 98 07 c8 00 00 87 7b e1 6c 25 75 07 9e .........{.l%u..
0050 00 00 00 08 d4 00 00 08 00 02 2a ff 00 87 00 00 ..........*.....
0060 01 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 . at ..............
0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0080 00 00 00 00 00 00 80 00 00 00 00 10 00 00 00 00 ................
0090 00 00 00 00 00 00 00 00 00 00 02 00 ff 05 00 00 ................
00a0 00 00 20 00 22 00 38 83 11 00 0f 64 ce f7 1d fe .. .".8....d....
00b0 30 45 8d f5 78 80 b3 ff 01 1f 00 9b 01 12 00 00 0E..x...........
00c0 00 .
Frame 9 (218 on wire, 218 captured)
SMB (Server Message Block Protocol)
DCE RPC
Opnum: 62
0000 00 50 56 09 ab 12 00 50 56 75 43 ca 08 00 45 00 .PV....PVuC...E.
0010 00 cc 00 75 40 00 80 06 3a fb 0a 4e d5 13 0a 4e ...u at ...:..N...N
0020 d5 0c 04 0e 01 bd b3 be 50 74 71 2e 55 2c 50 18 ........Ptq.U,P.
0030 43 65 42 63 00 00 00 00 00 a0 ff 53 4d 42 25 00 CeBc.......SMB%.
0040 00 00 00 18 07 c8 00 00 7c 44 aa dc 86 03 9d 4c ........|D.....L
0050 00 00 00 08 d4 00 00 08 80 02 10 00 00 4c 00 00 .............L..
0060 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 54 ...............T
0070 00 4c 00 54 00 02 00 26 00 01 40 5d 00 00 5c 00 .L.T...&..@]..\.
0080 50 00 49 00 50 00 45 00 5c 00 00 00 00 00 05 00 P.I.P.E.\.......
0090 00 03 10 00 00 00 4c 00 00 00 01 00 00 00 34 00 ......L.......4.
00a0 00 00 00 00 3e 00 20 80 0f 00 0d 00 00 00 00 00 ....>. .........
00b0 00 00 0d 00 00 00 5c 00 5c 00 50 00 53 00 46 00 ......\.\.P.S.F.
00c0 4c 00 49 00 4e 00 55 00 58 00 32 00 4b 00 00 00 L.I.N.U.X.2.K...
00d0 48 60 02 00 00 00 30 00 00 00 H`....0...
Frame 10 (162 on wire, 162 captured)
DCE RPC
0000 00 50 56 75 43 ca 00 50 56 09 ab 12 08 00 45 00 .PVuC..PV.....E.
0010 00 94 03 cf 40 00 80 06 37 d9 0a 4e d5 0c 0a 4e .... at ...7..N...N
0020 d5 13 01 bd 04 0e 71 2e 55 2c b3 be 51 18 50 18 ......q.U,..Q.P.
0030 3f a2 36 40 00 00 00 00 00 68 ff 53 4d 42 25 00 ?.6 at .....h.SMB%.
0040 00 00 00 98 07 c8 00 00 fe ae ec ff 95 ca c4 b0 ................
0050 00 00 00 08 d4 00 00 08 80 02 0a 00 00 30 00 00 .............0..
0060 00 00 00 38 00 00 00 30 00 38 00 00 00 00 00 31 ...8...0.8.....1
0070 00 00 05 00 02 03 10 00 00 00 30 00 00 00 01 00 ..........0.....
0080 00 00 18 00 00 00 00 00 00 00 00 00 00 00 c1 00 ................
0090 40 18 c4 a0 d6 11 8c ed 00 50 56 09 ab 12 00 00 @........PV.....
00a0 00 00 ..
Frame 11 (218 on wire, 218 captured)
DCE RPC
Opnum: 62
0000 00 50 56 09 ab 12 00 50 56 75 43 ca 08 00 45 00 .PV....PVuC...E.
0010 00 cc 00 7f 40 00 80 06 3a f1 0a 4e d5 13 0a 4e .... at ...:..N...N
0020 d5 0c 04 0e 01 bd b3 be 55 cf 71 2e 59 b2 50 18 ........U.q.Y.P.
0030 3e df fd 7f 00 00 00 00 00 a0 ff 53 4d 42 25 00 >..........SMB%.
0040 00 00 00 18 07 c8 00 00 b2 7a 00 74 8a 2c b3 da .........z.t.,..
0050 00 00 00 08 d4 00 00 08 00 05 10 00 00 4c 00 00 .............L..
0060 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 54 ...............T
0070 00 4c 00 54 00 02 00 26 00 02 40 5d 00 00 5c 00 .L.T...&..@]..\.
0080 50 00 49 00 50 00 45 00 5c 00 00 00 00 00 05 00 P.I.P.E.\.......
0090 00 03 10 00 00 00 4c 00 00 00 01 00 00 00 34 00 ......L.......4.
00a0 00 00 00 00 3e 00 48 80 0f 00 0d 00 00 00 00 00 ....>.H.........
00b0 00 00 0d 00 00 00 5c 00 5c 00 50 00 53 00 46 00 ......\.\.P.S.F.
00c0 4c 00 49 00 4e 00 55 00 58 00 32 00 4b 00 00 00 L.I.N.U.X.2.K...
00d0 48 60 02 00 00 00 21 00 00 00 H`....!...
Frame 12 (162 on wire, 162 captured)
DCE RPC
0000 00 50 56 75 43 ca 00 50 56 09 ab 12 08 00 45 00 .PVuC..PV.....E.
0010 00 94 03 d9 40 00 80 06 37 cf 0a 4e d5 0c 0a 4e .... at ...7..N...N
0020 d5 13 01 bd 04 0e 71 2e 59 b2 b3 be 56 73 50 18 ......q.Y...VsP.
0030 40 3f f8 75 00 00 00 00 00 68 ff 53 4d 42 25 00 @?.u.....h.SMB%.
0040 00 00 00 98 07 c8 00 00 ed 87 65 6f a3 2a 01 52 ..........eo.*.R
0050 00 00 00 08 d4 00 00 08 00 05 0a 00 00 30 00 00 .............0..
0060 00 00 00 38 00 00 00 30 00 38 00 00 00 00 00 31 ...8...0.8.....1
0070 00 00 05 00 02 03 10 00 00 00 30 00 00 00 01 00 ..........0.....
0080 00 00 18 00 00 00 00 00 00 00 00 00 00 00 c3 00 ................
0090 40 18 c4 a0 d6 11 8c ed 00 50 56 09 ab 12 00 00 @........PV.....
00a0 00 00 ..
Frame 13 (162 on wire, 162 captured)
NT Create AndX Request (0xa2)
File Name: \NETLOGON
0000 00 50 56 09 ab 12 00 50 56 75 43 ca 08 00 45 00 .PV....PVuC...E.
0010 00 94 00 8d 40 00 80 06 3b 1b 0a 4e d5 13 0a 4e .... at ...;..N...N
0020 d5 0c 04 0e 01 bd b3 be 5f 5f 71 2e 5e fd 50 18 ........__q.^.P.
0030 3f 91 b2 90 00 00 00 00 00 68 ff 53 4d 42 a2 00 ?........h.SMB..
0040 00 00 00 18 07 c8 00 00 c5 54 f1 4f 88 c2 81 16 .........T.O....
0050 00 00 00 08 d4 00 00 08 80 08 18 ff 00 de de 00 ................
0060 12 00 16 00 00 00 00 00 00 00 9f 01 02 00 00 00 ................
0070 00 00 00 00 00 00 00 00 00 00 03 00 00 00 01 00 ................
0080 00 00 40 00 40 00 02 00 00 00 01 15 00 00 5c 00 .. at .@.........\.
0090 4e 00 45 00 54 00 4c 00 4f 00 47 00 4f 00 4e 00 N.E.T.L.O.G.O.N.
00a0 00 00 ..
Frame 14 (193 on wire, 193 captured)
SMB (Server Message Block Protocol)
SMB Header
Server Component: SMB
Response to: 13
SMB Command: NT Create AndX (0xa2)
NT Status: STATUS_SUCCESS (0x00000000)
0000 00 50 56 75 43 ca 00 50 56 09 ab 12 08 00 45 00 .PVuC..PV.....E.
0010 00 b3 03 e7 40 00 80 06 37 a2 0a 4e d5 0c 0a 4e .... at ...7..N...N
0020 d5 13 01 bd 04 0e 71 2e 5e fd b3 be 5f cb 50 18 ......q.^..._.P.
0030 42 cf 35 2b 00 00 00 00 00 87 ff 53 4d 42 a2 00 B.5+.......SMB..
0040 00 00 00 98 07 c8 00 00 83 a8 6f b9 06 da 12 86 ..........o.....
0050 00 00 00 08 d4 00 00 08 80 08 2a ff 00 87 00 00 ..........*.....
0060 03 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 . at ..............
0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0080 00 00 00 00 00 00 80 00 00 00 00 10 00 00 00 00 ................
0090 00 00 00 00 00 00 00 00 00 00 02 00 ff 05 00 00 ................
00a0 00 00 00 00 01 00 00 00 00 00 c3 00 40 18 c4 a0 ............ at ...
00b0 d6 11 8c ed 00 50 56 ff 01 1f 00 9b 01 12 00 00 .....PV.........
00c0 00 .
Frame 15 (214 on wire, 214 captured)
DCE RPC
Opnum: 40
0000 00 50 56 09 ab 12 00 50 56 75 43 ca 08 00 45 00 .PV....PVuC...E.
0010 00 c8 00 8f 40 00 80 06 3a e5 0a 4e d5 13 0a 4e .... at ...:..N...N
0020 d5 0c 04 0e 01 bd b3 be 60 6b 71 2e 60 08 50 18 ........`kq.`.P.
0030 44 70 81 7f 00 00 00 00 00 9c ff 53 4d 42 25 00 Dp.........SMB%.
0040 00 00 00 18 07 c8 00 00 04 68 f5 f6 a5 42 df e2 .........h...B..
0050 00 00 00 08 d4 00 00 08 00 09 10 00 00 48 00 00 .............H..
0060 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 54 ...............T
0070 00 48 00 54 00 02 00 26 00 03 40 59 00 00 5c 00 .H.T...&.. at Y..\.
0080 50 00 49 00 50 00 45 00 5c 00 00 00 00 00 05 00 P.I.P.E.\.......
0090 00 03 10 00 00 00 48 00 00 00 01 00 00 00 30 00 ......H.......0.
00a0 00 00 00 00 28 00 28 7e 08 00 0d 00 00 00 00 00 ....(.(~........
00b0 00 00 0d 00 00 00 5c 00 5c 00 50 00 53 00 46 00 ......\.\.P.S.F.
00c0 4c 00 49 00 4e 00 55 00 58 00 32 00 4b 00 00 00 L.I.N.U.X.2.K...
00d0 48 60 3f 00 00 00 H`?...
Frame 16 (390 on wire, 390 captured)
DCE RPC
0000 00 50 56 75 43 ca 00 50 56 09 ab 12 08 00 45 00 .PVuC..PV.....E.
0010 01 78 03 e9 40 00 80 06 36 db 0a 4e d5 0c 0a 4e .x.. at ...6..N...N
0020 d5 13 01 bd 04 0e 71 2e 60 08 b3 be 61 0b 50 18 ......q.`...a.P.
0030 41 8f 7a 48 00 00 00 00 01 4c ff 53 4d 42 25 00 A.zH.....L.SMB%.
0040 00 00 00 98 07 c8 00 00 a7 6f e0 a0 71 10 60 eb .........o..q.`.
0050 00 00 00 08 d4 00 00 08 00 09 0a 00 00 14 01 00 ................
0060 00 00 00 38 00 00 00 14 01 38 00 00 00 00 00 15 ...8.....8......
0070 01 00 05 00 02 03 10 00 00 00 14 01 00 00 01 00 ................
0080 00 00 fc 00 00 00 00 00 00 00 02 00 00 00 80 c3 ................
0090 12 00 02 00 00 00 f0 c3 12 00 00 00 00 00 22 00 ..............".
00a0 00 00 00 00 00 00 01 00 00 00 00 00 00 01 d8 c3 ................
00b0 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00c0 00 00 14 c4 12 00 1c c4 12 00 1d 00 00 00 00 00 ................
00d0 00 00 02 00 00 00 00 00 00 00 fc c3 12 00 0f 64 ...............d
00e0 ce f7 1d fe 30 45 8d f5 78 80 b3 a7 42 93 06 00 ....0E..x...B...
00f0 00 00 00 00 00 00 06 00 00 00 53 00 4d 00 42 00 ..........S.M.B.
0100 4e 00 54 00 00 00 04 00 00 00 01 04 00 00 00 00 N.T.............
0110 00 05 15 00 00 00 87 74 df 66 49 4b 52 44 e0 14 .......t.fIKRD..
0120 d9 1c 04 00 00 00 00 00 00 00 04 00 00 00 4d 00 ..............M.
0130 43 00 44 00 00 00 11 00 00 00 00 00 00 00 11 00 C.D.............
0140 00 00 6d 00 63 00 64 00 2e 00 6d 00 61 00 69 00 ..m.c.d...m.a.i.
0150 6e 00 65 00 2e 00 72 00 72 00 2e 00 63 00 6f 00 n.e...r.r...c.o.
0160 6d 00 00 00 28 00 04 00 00 00 01 04 00 00 00 00 m...(...........
0170 00 05 15 00 00 00 c2 e9 ba 17 c5 dd 9a a7 82 f7 ................
0180 23 e3 00 00 00 00 #.....
Steve French
Senior Software Engineer
Linux Technology Center - IBM Austin
phone: 512-838-2294
email: sfrench at us.ibm.com
More information about the samba-technical
mailing list