Hi, I'm searching info about two types of SMB packet. The first is about SMB_COM_TRANS (0x25) :
(Tcpdumps logs) SMB PACKET: SMBtrans (REQUEST) (DF) 0x0000 4500 0097 0054 4000 4006 3c0b 7f00 0001 E....T@.@.<..... 0x0010 7f00 0001 0401 008b 3a01 4fbd 3a5c d23a ........:.O.:\.: 0x0020 8018 7960 baf1 0000 0101 080a 0001 1cce ..y`............ 0x0030 0001 1cce 0000 005f ff53 4d42 2500 0000 ......._.SMB%... 0x0040 0008 0100 0000 0000 0000 0000 0000 0000 ................ 0x0050 0100 d101 6400 0100 0e13 0000 0000 04ff ....d........... 0x0060 ff00 0000 0000 0000 0000 0013 004c 0000 .............L.. 0x0070 005f 0000 0020 005c 5049 5045 5c4c 414e ._.....\PIPE\LAN 0x0080 4d41 4e00 0000 5772 4c65 6800 4231 3342 MAN...WrLeh.B13B 0x0090 577a 0001 00ff ff Wz..... I'm searching docs about all the parameters ("WrLeh.B....") for the several named pipes types : mailslot, lanman, srvsvc and how it works. The second is about SMB_COM_TRANSACTION2 (0x32) : I've checked the docs from Microsoft (CIFS drafts of 1997 and 2001) and there is not a lot of description of parameters for the TRANS2_QUERY_FS_INFORMATION, SMB_INFO_ALLOCATION, SMB_INFO_VOLUME, SMB_QUERY_FS_VOLUME_INFO, SMB_QUERY_FS_SIZE_INFO and SMB_QUERY_FS_DEVICE_INFO. How this commands works and what there are doing. I've got another problem : SMB PACKET: SMBtrans (REPLY) (DF) 0x0000 4500 00d0 0055 4000 4006 3bd1 7f00 0001 E....U@.@.;..... 0x0010 7f00 0001 008b 0401 3a5c d23a 3a01 5020 ........:\.::.P. 0x0020 8018 7960 7d3f 0000 0101 080a 0001 1ccf ..y`}?.......... 0x0030 0001 1cce 0000 0098 ff53 4d42 2500 0000 .........SMB%... 0x0040 0088 0100 0000 0000 0000 0000 0000 0000 ................ 0x0050 0100 d101 6400 0100 0a08 0058 0000 0008 ....d......X.... 0x0060 0038 0000 0058 0040 0000 0000 0061 0000 .8...X.@.....a.. 0x0070 0000 0000 0200 0200 746d 7000 0000 0000 ........tmp..... 0x0080 0000 0000 0000 0000 2800 0000 4950 4324 ........(...IPC$ 0x0090 0000 0000 0000 0000 0000 0300 3d00 0000 ............=... 0x00a0 5465 6d70 6f72 6172 7920 6669 6c65 2073 Temporary.file.s 0x00b0 7061 6365 0049 5043 2053 6572 7669 6365 pace.IPC.Service 0x00c0 2028 5361 6d62 6120 5365 7276 6572 2900 . (Samba.Server). How I decrypt this reponse to have a a good format for the information system and strings began and ended there is no description in SMB docs for this kind of response. A last question, I have configured a SMB server with samba and I have a public disk where everyone can write and read, I have used the sample example in smb.conf but I must give a password when I want to connect on. Why ? Thanks for your response ... _________________________________________________________ Envoyez des messages musicaux sur le portable de vos amis http://mobile.lycos.fr/mobile/local/sms_musicaux/