Hi, I have seen an SMB/CIFS capture from an EMC filer with some interesting characteristics. The EMC CIFS guy here at Connectathon says that it is a configuration issue.
However. What we are seeing is in a NegProt response. LanMan2.1 or better, type 17. The Domain and Server name are clearly in UniCode. Flags2 says UNICODE is in use, while Capabilities says it is not! Clearly one confused filer :-) I think we should change dissect_negprot_reply to look at the flags2 field rather than the capabilities field, or in addition to the capabilities field. However, it might be that there are other equally confused filers out there that get it the other way around. Regards ----- Richard Sharpe, rsharpe[at]ns.aus.com, rsharpe[at]samba.org, sharpe[at]ethereal.com, http://www.richardsharpe.com
