[SMB] NTCreateANDX quesiotn

[yang mikey]

hi, Allen
Thanks your reply and time.
I am sorry that can not send any packet file to you, because you know, I am
in company.
But this packet is not any special I think. just a very common NTCreateAndX
packet(smb.command == 0xA2), if
you login into a server with share folder and make some file operations such
as delete or create
a new file, you shall see the packet in etheral.
                                                                  Mikey


2007/6/9, Michael B Allen <mba2000 at ioplex.com>:
>
> Mikey,
>
> Is it ok to send me your capture file?
>
> I'm always interested in seeing mutant packets.
>
> Mike
>
> On Fri, 8 Jun 2007 11:11:21 +0900
> "yang mikey" <mikeyredmoon at gmail.com> wrote:
>
> > hi, everybody
> > I found a interesting thing,
> >
> > when I see the header of NTCreateANCX[0xA2] via Ethereal
> > I found the value of WORD COUNT is 42, but the position of BYTE COUNT is
> not
> > at
> > (offset of WORD COUNT) +  (value of  WORD COUNT) *2.
> >
> > Why it happened, and How Ethereal knows  the correct position of BYTE
> COUNT.
> >
> > thanks a lot
> >                                                             Mikey
> >
>
>
> --
> Michael B Allen
> PHP Active Directory Kerberos SSO
> http://www.ioplex.com/
>