IPC$

[Gerald Carter]

[moved to samba-technical.  Bcc'd to samba at samba.org]

Govinda Sharma wrote:
> 
> I am using a sniffer to observe the SMB packets.
> 
> I find that windows client makes multiple TREE_CONNECTS 
> to the IPC$ share prior to an actual TREE_CONNECT to 
> the mapped share and also prior to opening a file.
> Does anyone know what do these TREE_CONNECTS to the IPC$
> share achieve ?

The IPC$ share is a built in share for an SMB server which
clients can connect to in order to perform session level
validation.  This then allows other remote administration
commands (including the ability to support named pipes
over IPC$).

> Furthermore, Samba returns a DIFFERENT Tid for each TREE_CONNECT
> request to the IPC$ share. Is that required by the client ?

the Tree connection ID for each resouce connection should be
an ID used on a per session basis.





Cheers, jerry
----------------------------------------------------------------------
   /\  Gerald (Jerry) Carter                     Professional Services
 \/    http://www.valinux.com/  VA Linux Systems   gcarter at valinux.com
       http://www.samba.org/       SAMBA Team          jerry at samba.org
       http://www.plainjoe.org/                     jerry at plainjoe.org

       "...a hundred billion castaways looking for a home."
                                - Sting "Message in a Bottle" ( 1979 )