[Samba] 1 byte writes

[Jeremy Allison]

On Wed, Mar 08, 2006 at 11:49:47PM +0100, Thomas Limoncelli wrote:
> Jeremy Allison wrote:
> >It's in the trans2 qfileinfo calls. Look at the SMB_INFO_STANDARD,
> >SMB_FILE_STANDARD_INFORMATION, SMB_QUERY_FILE_ALLOCATION_INFO
> >SMB_QUERY_FILE_ALL_INFO calls. 
> 
> Thanks, but still strange. I don't see the client getting/requesting any 
> such details before starting with the 1 byte writes. Is the client 
> expected to do so? May it be caching any of those? Just to make 
> absolutely sure I'm not overlooking something: can you suggest an 
> Ethereal display filter that'll make it easier to locate these details 
> in my hundred meg capture file? FWIW, filtering for smb.alloc_size 
> (which was may initial guess based on my understanding of Ethereal's 
> packet-smb.c) didn't turn up anything. (Ethereal's packet reassembly 
> options are turned on, mind you :-)).

You only need the start of the capture file from the negprot 
until the silly 1 byte writes start. How large is that ?

Jeremy.