hi, everybody I found a interesting thing, when I see the header of NTCreateANCX[0xA2] via Ethereal I found the value of WORD COUNT is 42, but the position of BYTE COUNT is not at (offset of WORD COUNT) + (value of WORD COUNT) *2. Why it happened, and How Ethereal knows the correct position of BYTE COUNT. thanks a lot Mikey