[SMB] NTCreateANDX quesiotn
mikeyredmoon at gmail.com
Mon Jun 11 03:09:38 GMT 2007
Thanks your reply and time.
I am sorry that can not send any packet file to you, because you know, I am
But this packet is not any special I think. just a very common NTCreateAndX
packet(smb.command == 0xA2), if
you login into a server with share folder and make some file operations such
as delete or create
a new file, you shall see the packet in etheral.
2007/6/9, Michael B Allen <mba2000 at ioplex.com>:
> Is it ok to send me your capture file?
> I'm always interested in seeing mutant packets.
> On Fri, 8 Jun 2007 11:11:21 +0900
> "yang mikey" <mikeyredmoon at gmail.com> wrote:
> > hi, everybody
> > I found a interesting thing,
> > when I see the header of NTCreateANCX[0xA2] via Ethereal
> > I found the value of WORD COUNT is 42, but the position of BYTE COUNT is
> > at
> > (offset of WORD COUNT) + (value of WORD COUNT) *2.
> > Why it happened, and How Ethereal knows the correct position of BYTE
> > thanks a lot
> > Mikey
> Michael B Allen
> PHP Active Directory Kerberos SSO
More information about the samba-technical