GET_DFS_REFERRALS and IPC$

[Richard Sharpe]

On Mon, Nov 30, 2015 at 2:59 PM, Richard Sharpe
<realrichardsharpe at gmail.com> wrote:
> Hi folks,
>
> my copy of [MS-SMB].pdf contains these words WRT DFS referrals:
>
> -----------------------------------------------
> 3.2.4.20.3 Application Requests DFS Referral Information
> ...
>
> The client MUST search for an existing Session and TreeConnect to any
> share on the server identified by ServerName for the user identified
> by UserCredentials. If no Session and TreeConnect are found, the
> client MUST establish a new Session and TreeConnect to IPC$ on the
> target server as described in section 3.2.4.2 using the supplied
> ServerName and UserCredentials.
> ...
> -------------------------------------------------
>
> However, Windows clients seem not to do that and always seem to use
> IPC$ for DFS referrals even when they have connections open on the
> target server.
>
> Has anyone seen any cases where Windows clients use shares other than IPC$?

Following up from this, I have seen claims from Load Dynamics
(formerly, SwiftTest) that they have test cases where they send
GET_DFS_REFERRALS to Windows servers on normal shares and it works.

I have asked for a capture.

Samba does not like it, however, and sends back
NT_STATUS_INVALID_DEVICE_REQUEST.

-- 
Regards,
Richard Sharpe
(何以解憂？唯有杜康。--曹操)