[SMB] NTCreateANDX quesiotn

[Michael B Allen]

Ahh, I see what you're talking about. In the response. The WordCount is
way too large. It should be more like 34 and not 42. Funny, I've written
multiple CIFS clients and never noticed.

Mike

On Mon, 11 Jun 2007 12:09:38 +0900
"yang mikey" <mikeyredmoon at gmail.com> wrote:

> hi, Allen
> Thanks your reply and time.
> I am sorry that can not send any packet file to you, because you know, I am
> in company.
> But this packet is not any special I think. just a very common NTCreateAndX
> packet(smb.command == 0xA2), if
> you login into a server with share folder and make some file operations such
> as delete or create
> a new file, you shall see the packet in etheral.
>                                                                   Mikey
> 
> 
> 2007/6/9, Michael B Allen <mba2000 at ioplex.com>:
> >
> > Mikey,
> >
> > Is it ok to send me your capture file?
> >
> > I'm always interested in seeing mutant packets.
> >
> > Mike
> >
> > On Fri, 8 Jun 2007 11:11:21 +0900
> > "yang mikey" <mikeyredmoon at gmail.com> wrote:
> >
> > > hi, everybody
> > > I found a interesting thing,
> > >
> > > when I see the header of NTCreateANCX[0xA2] via Ethereal
> > > I found the value of WORD COUNT is 42, but the position of BYTE COUNT is
> > not
> > > at
> > > (offset of WORD COUNT) +  (value of  WORD COUNT) *2.
> > >
> > > Why it happened, and How Ethereal knows  the correct position of BYTE
> > COUNT.
> > >
> > > thanks a lot
> > >                                                             Mikey
> > >
> >
> >
> > --
> > Michael B Allen
> > PHP Active Directory Kerberos SSO
> > http://www.ioplex.com/
> >
> 


-- 
Michael B Allen
PHP Active Directory Kerberos SSO
http://www.ioplex.com/