Wireshark
the world's foremost network protocol analyzer
Display Filter Reference: SMB (Server Message Block Protocol)
Protocol field name: smb
Versions: 1.0.0 to 1.4.0
Back to Display Filter Reference
| Field name | Type | Description | Versions |
|---|---|---|---|
| nt.access_mask | Unsigned 32-bit integer | Access required | 1.0.0 to 1.4.0 |
| nt.access_mask.access_sacl | Boolean | Access SACL | 1.0.0 to 1.4.0 |
| nt.access_mask.delete | Boolean | Delete | 1.0.0 to 1.4.0 |
| nt.access_mask.generic_all | Boolean | Generic all | 1.0.0 to 1.4.0 |
| nt.access_mask.generic_execute | Boolean | Generic execute | 1.0.0 to 1.4.0 |
| nt.access_mask.generic_read | Boolean | Generic read | 1.0.0 to 1.4.0 |
| nt.access_mask.generic_write | Boolean | Generic write | 1.0.0 to 1.4.0 |
| nt.access_mask.maximum_allowed | Boolean | Maximum allowed | 1.0.0 to 1.4.0 |
| nt.access_mask.read_control | Boolean | Read control | 1.0.0 to 1.4.0 |
| nt.access_mask.specific_0 | Boolean | Specific access, bit 0 | 1.0.0 to 1.4.0 |
| nt.access_mask.specific_1 | Boolean | Specific access, bit 1 | 1.0.0 to 1.4.0 |
| nt.access_mask.specific_10 | Boolean | Specific access, bit 10 | 1.0.0 to 1.4.0 |
| nt.access_mask.specific_11 | Boolean | Specific access, bit 11 | 1.0.0 to 1.4.0 |
| nt.access_mask.specific_12 | Boolean | Specific access, bit 12 | 1.0.0 to 1.4.0 |
| nt.access_mask.specific_13 | Boolean | Specific access, bit 13 | 1.0.0 to 1.4.0 |
| nt.access_mask.specific_14 | Boolean | Specific access, bit 14 | 1.0.0 to 1.4.0 |
| nt.access_mask.specific_15 | Boolean | Specific access, bit 15 | 1.0.0 to 1.4.0 |
| nt.access_mask.specific_2 | Boolean | Specific access, bit 2 | 1.0.0 to 1.4.0 |
| nt.access_mask.specific_3 | Boolean | Specific access, bit 3 | 1.0.0 to 1.4.0 |
| nt.access_mask.specific_4 | Boolean | Specific access, bit 4 | 1.0.0 to 1.4.0 |
| nt.access_mask.specific_5 | Boolean | Specific access, bit 5 | 1.0.0 to 1.4.0 |
| nt.access_mask.specific_6 | Boolean | Specific access, bit 6 | 1.0.0 to 1.4.0 |
| nt.access_mask.specific_7 | Boolean | Specific access, bit 7 | 1.0.0 to 1.4.0 |
| nt.access_mask.specific_8 | Boolean | Specific access, bit 8 | 1.0.0 to 1.4.0 |
| nt.access_mask.specific_9 | Boolean | Specific access, bit 9 | 1.0.0 to 1.4.0 |
| nt.access_mask.synchronise | Boolean | Synchronise | 1.0.0 to 1.4.0 |
| nt.access_mask.write_dac | Boolean | Write DAC | 1.0.0 to 1.4.0 |
| nt.access_mask.write_owner | Boolean | Write owner | 1.0.0 to 1.4.0 |
| nt.ace.flags.container_inherit | Boolean | Container Inherit | 1.0.0 to 1.4.0 |
| nt.ace.flags.failed_access | Boolean | Audit Failed Accesses | 1.0.0 to 1.4.0 |
| nt.ace.flags.inherit_only | Boolean | Inherit Only | 1.0.0 to 1.4.0 |
| nt.ace.flags.inherited_ace | Boolean | Inherited ACE | 1.0.0 to 1.4.0 |
| nt.ace.flags.non_propagate_inherit | Boolean | Non-Propagate Inherit | 1.0.0 to 1.4.0 |
| nt.ace.flags.object_inherit | Boolean | Object Inherit | 1.0.0 to 1.4.0 |
| nt.ace.flags.successful_access | Boolean | Audit Successful Accesses | 1.0.0 to 1.4.0 |
| nt.ace.object.flags.inherited_object_type_present | Boolean | Inherited Object Type Present | 1.0.0 to 1.4.0 |
| nt.ace.object.flags.object_type_present | Boolean | Object Type Present | 1.0.0 to 1.4.0 |
| nt.ace.object.guid | GUID or UUID | GUID | 1.0.0 to 1.4.0 |
| nt.ace.object.inherited_guid | GUID or UUID | Inherited GUID | 1.0.0 to 1.4.0 |
| nt.ace.size | Unsigned 16-bit integer | Size | 1.0.0 to 1.4.0 |
| nt.ace.type | Unsigned 8-bit integer | Type | 1.0.0 to 1.4.0 |
| nt.acl.num_aces | Unsigned 32-bit integer | Num ACEs | 1.0.0 to 1.4.0 |
| nt.acl.revision | Unsigned 16-bit integer | Revision | 1.0.0 to 1.4.0 |
| nt.acl.size | Unsigned 16-bit integer | Size | 1.0.0 to 1.4.0 |
| nt.sec_desc.revision | Unsigned 16-bit integer | Revision | 1.0.0 to 1.4.0 |
| nt.sec_desc.type.dacl_auto_inherit_req | Boolean | DACL Auto Inherit Required | 1.0.0 to 1.4.0 |
| nt.sec_desc.type.dacl_auto_inherited | Boolean | DACL Auto Inherited | 1.0.0 to 1.4.0 |
| nt.sec_desc.type.dacl_defaulted | Boolean | DACL Defaulted | 1.0.0 to 1.4.0 |
| nt.sec_desc.type.dacl_present | Boolean | DACL Present | 1.0.0 to 1.4.0 |
| nt.sec_desc.type.dacl_protected | Boolean | DACL Protected | 1.0.0 to 1.4.0 |
| nt.sec_desc.type.dacl_trusted | Boolean | DACL Trusted | 1.0.0 to 1.4.0 |
| nt.sec_desc.type.group_defaulted | Boolean | Group Defaulted | 1.0.0 to 1.4.0 |
| nt.sec_desc.type.owner_defaulted | Boolean | Owner Defaulted | 1.0.0 to 1.4.0 |
| nt.sec_desc.type.rm_control_valid | Boolean | RM Control Valid | 1.0.0 to 1.4.0 |
| nt.sec_desc.type.sacl_auto_inherit_req | Boolean | SACL Auto Inherit Required | 1.0.0 to 1.4.0 |
| nt.sec_desc.type.sacl_auto_inherited | Boolean | SACL Auto Inherited | 1.0.0 to 1.4.0 |
| nt.sec_desc.type.sacl_defaulted | Boolean | SACL Defaulted | 1.0.0 to 1.4.0 |
| nt.sec_desc.type.sacl_present | Boolean | SACL Present | 1.0.0 to 1.4.0 |
| nt.sec_desc.type.sacl_protected | Boolean | SACL Protected | 1.0.0 to 1.4.0 |
| nt.sec_desc.type.self_relative | Boolean | Self Relative | 1.0.0 to 1.4.0 |
| nt.sec_desc.type.server_security | Boolean | Server Security | 1.0.0 to 1.4.0 |
| nt.sec_info.dacl | Boolean | DACL | 1.2.0 to 1.4.0 |
| nt.sec_info.group | Boolean | Group | 1.2.0 to 1.4.0 |
| nt.sec_info.owner | Boolean | Owner | 1.2.0 to 1.4.0 |
| nt.sec_info.sacl | Boolean | SACL | 1.2.0 to 1.4.0 |
| nt.sid | String | SID | 1.0.0 to 1.4.0 |
| nt.sid.num_auth | Unsigned 8-bit integer | Num Auth | 1.0.0 to 1.4.0 |
| nt.sid.revision | Unsigned 8-bit integer | Revision | 1.0.0 to 1.4.0 |
| smb.access.append | Boolean | Append | 1.0.0 to 1.4.0 |
| smb.access.caching | Boolean | Caching | 1.0.0 to 1.4.0 |
| smb.access.delete | Boolean | Delete | 1.0.0 to 1.4.0 |
| smb.access.delete_child | Boolean | Delete Child | 1.0.0 to 1.4.0 |
| smb.access.execute | Boolean | Execute | 1.0.0 to 1.4.0 |
| smb.access.generic_all | Boolean | Generic All | 1.0.0 to 1.4.0 |
| smb.access.generic_execute | Boolean | Generic Execute | 1.0.0 to 1.4.0 |
| smb.access.generic_read | Boolean | Generic Read | 1.0.0 to 1.4.0 |
| smb.access.generic_write | Boolean | Generic Write | 1.0.0 to 1.4.0 |
| smb.access.locality | Unsigned 16-bit integer | Locality | 1.0.0 to 1.4.0 |
| smb.access.maximum_allowed | Boolean | Maximum Allowed | 1.0.0 to 1.4.0 |
| smb.access.mode | Unsigned 16-bit integer | Access Mode | 1.0.0 to 1.4.0 |
| smb.access.read | Boolean | Read | 1.0.0 to 1.4.0 |
| smb.access.read_attributes | Boolean | Read Attributes | 1.0.0 to 1.4.0 |
| smb.access.read_control | Boolean | Read Control | 1.0.0 to 1.4.0 |
| smb.access.read_ea | Boolean | Read EA | 1.0.0 to 1.4.0 |
| smb.access.sharing | Unsigned 16-bit integer | Sharing Mode | 1.0.0 to 1.4.0 |
| smb.access.smb.date | Unsigned 16-bit integer | Last Access Date | 1.0.0 to 1.4.0 |
| smb.access.smb.time | Unsigned 16-bit integer | Last Access Time | 1.0.0 to 1.4.0 |
| smb.access.synchronize | Boolean | Synchronize | 1.0.0 to 1.4.0 |
| smb.access.system_security | Boolean | System Security | 1.0.0 to 1.4.0 |
| smb.access.time | Date/Time stamp | Last Access | 1.0.0 to 1.4.0 |
| smb.access.write | Boolean | Write | 1.0.0 to 1.4.0 |
| smb.access.write_attributes | Boolean | Write Attributes | 1.0.0 to 1.4.0 |
| smb.access.write_dac | Boolean | Write DAC | 1.0.0 to 1.4.0 |
| smb.access.write_ea | Boolean | Write EA | 1.0.0 to 1.4.0 |
| smb.access.write_owner | Boolean | Write Owner | 1.0.0 to 1.4.0 |
| smb.access.writethrough | Boolean | Writethrough | 1.0.0 to 1.4.0 |
| smb.access_mask | Unsigned 32-bit integer | Access Mask | 1.0.0 to 1.4.0 |
| smb.account | String | Account | 1.0.0 to 1.4.0 |
| smb.actual_free_alloc_units | Unsigned 64-bit integer | Actual Free Units | 1.0.0 to 1.4.0 |
| smb.alignment | Unsigned 32-bit integer | Alignment | 1.0.0 to 1.4.0 |
| smb.alloc.count | Unsigned 32-bit integer | Allocation Block Count | 1.0.0 to 1.4.0 |
| smb.alloc.size | Unsigned 32-bit integer | Allocation Block Count | 1.0.0 to 1.4.0 |
| smb.alloc_size | Unsigned 32-bit integer | Allocation Size | 1.0.0 to 1.4.0 |
| smb.andxoffset | Unsigned 16-bit integer | AndXOffset | 1.0.0 to 1.4.0 |
| smb.ansi_password | Byte array | ANSI Password | 1.0.0 to 1.4.0 |
| smb.ansi_pwlen | Unsigned 16-bit integer | ANSI Password Length | 1.0.0 to 1.4.0 |
| smb.attribute | Unsigned 32-bit integer | Attribute | 1.0.0 to 1.4.0 |
| smb.avail.units | Unsigned 32-bit integer | Available Units | 1.0.0 to 1.4.0 |
| smb.backup.time | Date/Time stamp | Backed-up | 1.0.0 to 1.4.0 |
| smb.bcc | Unsigned 16-bit integer | Byte Count (BCC) | 1.0.0 to 1.4.0 |
| smb.blocksize | Unsigned 16-bit integer | Block Size | 1.0.0 to 1.4.0 |
| smb.bpu | Unsigned 16-bit integer | Blocks Per Unit | 1.0.0 to 1.4.0 |
| smb.buffer_format | Unsigned 8-bit integer | Buffer Format | 1.0.0 to 1.4.0 |
| smb.caller_free_alloc_units | Unsigned 64-bit integer | Caller Free Units | 1.0.0 to 1.4.0 |
| smb.cancel_to | Frame number | Cancel to | 1.0.0 to 1.4.0 |
| smb.change.time | Date/Time stamp | Change | 1.0.0 to 1.4.0 |
| smb.change_count | Unsigned 16-bit integer | Change Count | 1.0.0 to 1.4.0 |
| smb.cmd | Unsigned 8-bit integer | SMB Command | 1.0.0 to 1.4.0 |
| smb.compressed.chunk_shift | Unsigned 8-bit integer | Chunk Shift | 1.0.0 to 1.4.0 |
| smb.compressed.cluster_shift | Unsigned 8-bit integer | Cluster Shift | 1.0.0 to 1.4.0 |
| smb.compressed.file_size | Unsigned 64-bit integer | Compressed Size | 1.0.0 to 1.4.0 |
| smb.compressed.format | Unsigned 16-bit integer | Compression Format | 1.0.0 to 1.4.0 |
| smb.compressed.unit_shift | Unsigned 8-bit integer | Unit Shift | 1.0.0 to 1.4.0 |
| smb.connect.flags.dtid | Boolean | Disconnect TID | 1.0.0 to 1.4.0 |
| smb.connect.support.dfs | Boolean | In Dfs | 1.0.0 to 1.4.0 |
| smb.connect.support.search | Boolean | Search Bits | 1.0.0 to 1.4.0 |
| smb.continuation_to | Frame number | Continuation to | 1.0.0 to 1.4.0 |
| smb.copy.flags.dest_mode | Boolean | Destination mode | 1.0.0 to 1.4.0 |
| smb.copy.flags.dir | Boolean | Must be directory | 1.0.0 to 1.4.0 |
| smb.copy.flags.ea_action | Boolean | EA action if EAs not supported on dest | 1.0.0 to 1.4.0 |
| smb.copy.flags.file | Boolean | Must be file | 1.0.0 to 1.4.0 |
| smb.copy.flags.source_mode | Boolean | Source mode | 1.0.0 to 1.4.0 |
| smb.copy.flags.tree_copy | Boolean | Tree copy | 1.0.0 to 1.4.0 |
| smb.copy.flags.verify | Boolean | Verify writes | 1.0.0 to 1.4.0 |
| smb.count | Unsigned 32-bit integer | Count | 1.0.0 to 1.4.0 |
| smb.count_high | Unsigned 16-bit integer | Count High (multiply with 64K) | 1.0.0 to 1.4.0 |
| smb.count_low | Unsigned 16-bit integer | Count Low | 1.0.0 to 1.4.0 |
| smb.create.action | Unsigned 32-bit integer | Create action | 1.0.0 to 1.4.0 |
| smb.create.disposition | Unsigned 32-bit integer | Disposition | 1.0.0 to 1.4.0 |
| smb.create.file_id | Unsigned 32-bit integer | Server unique file ID | 1.0.0 to 1.4.0 |
| smb.create.smb.date | Unsigned 16-bit integer | Create Date | 1.0.0 to 1.4.0 |
| smb.create.smb.time | Unsigned 16-bit integer | Create Time | 1.0.0 to 1.4.0 |
| smb.create.time | Date/Time stamp | Created | 1.0.0 to 1.4.0 |
| smb.create_flags | Unsigned 32-bit integer | Create Flags | 1.0.0 to 1.4.0 |
| smb.create_options | Unsigned 32-bit integer | Create Options | 1.0.0 to 1.4.0 |
| smb.data_disp | Unsigned 16-bit integer | Data Displacement | 1.0.0 to 1.4.0 |
| smb.data_len | Unsigned 16-bit integer | Data Length | 1.0.0 to 1.4.0 |
| smb.data_len_high | Unsigned 16-bit integer | Data Length High (multiply with 64K) | 1.0.0 to 1.4.0 |
| smb.data_len_low | Unsigned 16-bit integer | Data Length Low | 1.0.0 to 1.4.0 |
| smb.data_offset | Unsigned 16-bit integer | Data Offset | 1.0.0 to 1.4.0 |
| smb.data_size | Unsigned 32-bit integer | Data Size | 1.0.0 to 1.4.0 |
| smb.dc | Unsigned 16-bit integer | Data Count | 1.0.0 to 1.4.0 |
| smb.dcm | Unsigned 16-bit integer | Data Compaction Mode | 1.0.0 to 1.4.0 |
| smb.delete_pending | Unsigned 16-bit integer | Delete Pending | 1.0.0 to 1.4.0 |
| smb.destination_name | String | Destination Name | 1.0.0 to 1.4.0 |
| smb.device.floppy | Boolean | Floppy | 1.0.0 to 1.4.0 |
| smb.device.mounted | Boolean | Mounted | 1.0.0 to 1.4.0 |
| smb.device.read_only | Boolean | Read Only | 1.0.0 to 1.4.0 |
| smb.device.remote | Boolean | Remote | 1.0.0 to 1.4.0 |
| smb.device.removable | Boolean | Removable | 1.0.0 to 1.4.0 |
| smb.device.type | Unsigned 32-bit integer | Device Type | 1.0.0 to 1.4.0 |
| smb.device.virtual | Boolean | Virtual | 1.0.0 to 1.4.0 |
| smb.device.write_once | Boolean | Write Once | 1.0.0 to 1.4.0 |
| smb.dfs.flags.fielding | Boolean | Fielding | 1.0.0 to 1.4.0 |
| smb.dfs.flags.server_hold_storage | Boolean | Hold Storage | 1.0.0 to 1.4.0 |
| smb.dfs.num_referrals | Unsigned 16-bit integer | Num Referrals | 1.0.0 to 1.4.0 |
| smb.dfs.path_consumed | Unsigned 16-bit integer | Path Consumed | 1.0.0 to 1.4.0 |
| smb.dfs.referral.alt_path | String | Alt Path | 1.0.0 to 1.4.0 |
| smb.dfs.referral.alt_path_offset | Unsigned 16-bit integer | Alt Path Offset | 1.0.0 to 1.4.0 |
| smb.dfs.referral.domain_name | String | Domain Name | 1.2.3 to 1.4.0 |
| smb.dfs.referral.domain_offset | Unsigned 16-bit integer | Domain Offset | 1.2.3 to 1.4.0 |
| smb.dfs.referral.expname | String | Expanded Name | 1.2.3 to 1.4.0 |
| smb.dfs.referral.expnames_offset | Unsigned 16-bit integer | Expanded Names Offset | 1.2.3 to 1.4.0 |
| smb.dfs.referral.flags.name_list_referral | Boolean | NameListReferral | 1.2.3 to 1.4.0 |
| smb.dfs.referral.flags.strip | Boolean | Strip | 1.0.0 to 1.2.3 |
| smb.dfs.referral.flags.target_set_boundary | Boolean | TargetSetBoundary | 1.2.3 to 1.4.0 |
| smb.dfs.referral.node | String | Node | 1.0.0 to 1.4.0 |
| smb.dfs.referral.node_offset | Unsigned 16-bit integer | Node Offset | 1.0.0 to 1.4.0 |
| smb.dfs.referral.number_of_expnames | Unsigned 16-bit integer | Number of Expanded Names | 1.2.3 to 1.4.0 |
| smb.dfs.referral.path | String | Path | 1.0.0 to 1.4.0 |
| smb.dfs.referral.path_offset | Unsigned 16-bit integer | Path Offset | 1.0.0 to 1.4.0 |
| smb.dfs.referral.proximity | Unsigned 32-bit integer | Proximity | 1.0.0 to 1.4.0 |
| smb.dfs.referral.server.type | Unsigned 16-bit integer | Server Type | 1.0.0 to 1.4.0 |
| smb.dfs.referral.server_guid | Byte array | Server GUID | 1.2.3 to 1.4.0 |
| smb.dfs.referral.size | Unsigned 16-bit integer | Size | 1.0.0 to 1.4.0 |
| smb.dfs.referral.ttl | Unsigned 32-bit integer | TTL | 1.0.0 to 1.4.0 |
| smb.dfs.referral.version | Unsigned 16-bit integer | Version | 1.0.0 to 1.4.0 |
| smb.dialect.index | Unsigned 16-bit integer | Selected Index | 1.0.0 to 1.4.0 |
| smb.dialect.name | String | Name | 1.0.0 to 1.4.0 |
| smb.dir.accessmask.add_file | Boolean | Add File | 1.0.0 to 1.4.0 |
| smb.dir.accessmask.add_subdir | Boolean | Add Subdir | 1.0.0 to 1.4.0 |
| smb.dir.accessmask.delete_child | Boolean | Delete Child | 1.0.0 to 1.4.0 |
| smb.dir.accessmask.list | Boolean | List | 1.0.0 to 1.4.0 |
| smb.dir.accessmask.read_attribute | Boolean | Read Attribute | 1.0.0 to 1.4.0 |
| smb.dir.accessmask.read_ea | Boolean | Read EA | 1.0.0 to 1.4.0 |
| smb.dir.accessmask.traverse | Boolean | Traverse | 1.0.0 to 1.4.0 |
| smb.dir.accessmask.write_attribute | Boolean | Write Attribute | 1.0.0 to 1.4.0 |
| smb.dir.accessmask.write_ea | Boolean | Write EA | 1.0.0 to 1.4.0 |
| smb.dir.count | Unsigned 32-bit integer | Root Directory Count | 1.0.0 to 1.4.0 |
| smb.dir_name | String | Directory | 1.0.0 to 1.4.0 |
| smb.disposition.delete_on_close | Boolean | Delete on close | 1.0.0 to 1.4.0 |
| smb.ea.data | Byte array | EA Data | 1.0.0 to 1.4.0 |
| smb.ea.data_length | Unsigned 16-bit integer | EA Data Length | 1.0.0 to 1.4.0 |
| smb.ea.error_offset | Unsigned 32-bit integer | EA Error offset | 1.0.0 to 1.4.0 |
| smb.ea.flags | Unsigned 8-bit integer | EA Flags | 1.0.0 to 1.4.0 |
| smb.ea.list_length | Unsigned 32-bit integer | EA List Length | 1.0.0 to 1.4.0 |
| smb.ea.name | String | EA Name | 1.0.0 to 1.4.0 |
| smb.ea.name_length | Unsigned 8-bit integer | EA Name Length | 1.0.0 to 1.4.0 |
| smb.echo.count | Unsigned 16-bit integer | Echo Count | 1.0.0 to 1.4.0 |
| smb.echo.data | Byte array | Echo Data | 1.0.0 to 1.4.0 |
| smb.echo.seq_num | Unsigned 16-bit integer | Echo Seq Num | 1.0.0 to 1.4.0 |
| smb.encryption_key | Byte array | Encryption Key | 1.0.0 to 1.4.0 |
| smb.encryption_key_length | Unsigned 16-bit integer | Key Length | 1.0.0 to 1.4.0 |
| smb.end_of_file | Unsigned 64-bit integer | End Of File | 1.0.0 to 1.4.0 |
| smb.end_of_search | Unsigned 16-bit integer | End Of Search | 1.0.0 to 1.4.0 |
| smb.error_class | Unsigned 8-bit integer | Error Class | 1.0.0 to 1.4.0 |
| smb.error_code | Unsigned 16-bit integer | Error Code | 1.0.0 to 1.4.0 |
| smb.ext_attr | Byte array | Extended Attributes | 1.0.0 to 1.4.0 |
| smb.ff2_loi | Unsigned 16-bit integer | Level of Interest | 1.0.0 to 1.4.0 |
| smb.fid | Unsigned 16-bit integer | FID | 1.0.0 to 1.4.0 |
| smb.fid.closed_in | Frame number | Closed in | 1.0.0 to 1.4.0 |
| smb.fid.mapped_in | Frame number | Mapped in | 1.0.0 to 1.4.0 |
| smb.fid.opened_in | Frame number | Opened in | 1.0.0 to 1.4.0 |
| smb.fid.unmapped_in | Frame number | Unmapped in | 1.0.0 to 1.4.0 |
| smb.file | String | File Name | 1.0.0 to 1.4.0 |
| smb.file.accessmask.append_data | Boolean | Append Data | 1.0.0 to 1.4.0 |
| smb.file.accessmask.execute | Boolean | Execute | 1.0.0 to 1.4.0 |
| smb.file.accessmask.read_attribute | Boolean | Read Attribute | 1.0.0 to 1.4.0 |
| smb.file.accessmask.read_data | Boolean | Read Data | 1.0.0 to 1.4.0 |
| smb.file.accessmask.read_ea | Boolean | Read EA | 1.0.0 to 1.4.0 |
| smb.file.accessmask.write_attribute | Boolean | Write Attribute | 1.0.0 to 1.4.0 |
| smb.file.accessmask.write_data | Boolean | Write Data | 1.0.0 to 1.4.0 |
| smb.file.accessmask.write_ea | Boolean | Write EA | 1.0.0 to 1.4.0 |
| smb.file.count | Unsigned 32-bit integer | Root File Count | 1.0.0 to 1.4.0 |
| smb.file.rw.length | Unsigned 32-bit integer | File RW Length | 1.0.0 to 1.4.0 |
| smb.file.rw.offset | Unsigned 32-bit integer | File Offset | 1.0.0 to 1.4.0 |
| smb.file_attribute.archive | Boolean | Archive | 1.0.0 to 1.4.0 |
| smb.file_attribute.compressed | Boolean | Compressed | 1.0.0 to 1.4.0 |
| smb.file_attribute.device | Boolean | Device | 1.0.0 to 1.4.0 |
| smb.file_attribute.directory | Boolean | Directory | 1.0.0 to 1.4.0 |
| smb.file_attribute.encrypted | Boolean | Encrypted | 1.0.0 to 1.4.0 |
| smb.file_attribute.hidden | Boolean | Hidden | 1.0.0 to 1.4.0 |
| smb.file_attribute.normal | Boolean | Normal | 1.0.0 to 1.4.0 |
| smb.file_attribute.not_content_indexed | Boolean | Content Indexed | 1.0.0 to 1.4.0 |
| smb.file_attribute.offline | Boolean | Offline | 1.0.0 to 1.4.0 |
| smb.file_attribute.read_only | Boolean | Read Only | 1.0.0 to 1.4.0 |
| smb.file_attribute.reparse | Boolean | Reparse Point | 1.0.0 to 1.4.0 |
| smb.file_attribute.sparse | Boolean | Sparse | 1.0.0 to 1.4.0 |
| smb.file_attribute.system | Boolean | System | 1.0.0 to 1.4.0 |
| smb.file_attribute.temporary | Boolean | Temporary | 1.0.0 to 1.4.0 |
| smb.file_attribute.volume | Boolean | Volume ID | 1.0.0 to 1.4.0 |
| smb.file_data | Byte array | File Data | 1.0.0 to 1.4.0 |
| smb.file_index | Unsigned 32-bit integer | File Index | 1.0.0 to 1.4.0 |
| smb.file_name_len | Unsigned 32-bit integer | File Name Len | 1.0.0 to 1.4.0 |
| smb.file_size | Unsigned 32-bit integer | File Size | 1.0.0 to 1.4.0 |
| smb.file_type | Unsigned 16-bit integer | File Type | 1.0.0 to 1.4.0 |
| smb.files_moved | Unsigned 16-bit integer | Files Moved | 1.0.0 to 1.4.0 |
| smb.find_first2.flags.backup | Boolean | Backup Intent | 1.0.0 to 1.4.0 |
| smb.find_first2.flags.close | Boolean | Close | 1.0.0 to 1.4.0 |
| smb.find_first2.flags.continue | Boolean | Continue | 1.0.0 to 1.4.0 |
| smb.find_first2.flags.eos | Boolean | Close on EOS | 1.0.0 to 1.4.0 |
| smb.find_first2.flags.resume | Boolean | Resume | 1.0.0 to 1.4.0 |
| smb.flags.canon | Boolean | Canonicalized Pathnames | 1.0.0 to 1.4.0 |
| smb.flags.caseless | Boolean | Case Sensitivity | 1.0.0 to 1.4.0 |
| smb.flags.lock | Boolean | Lock and Read | 1.0.0 to 1.4.0 |
| smb.flags.notify | Boolean | Notify | 1.0.0 to 1.4.0 |
| smb.flags.oplock | Boolean | Oplocks | 1.0.0 to 1.4.0 |
| smb.flags.receive_buffer | Boolean | Receive Buffer Posted | 1.0.0 to 1.4.0 |
| smb.flags.response | Boolean | Request/Response | 1.0.0 to 1.4.0 |
| smb.flags2.dfs | Boolean | Dfs | 1.0.0 to 1.4.0 |
| smb.flags2.ea | Boolean | Extended Attributes | 1.0.0 to 1.4.0 |
| smb.flags2.esn | Boolean | Extended Security Negotiation | 1.0.0 to 1.4.0 |
| smb.flags2.long_names_allowed | Boolean | Long Names Allowed | 1.0.0 to 1.4.0 |
| smb.flags2.long_names_used | Boolean | Long Names Used | 1.0.0 to 1.4.0 |
| smb.flags2.nt_error | Boolean | Error Code Type | 1.0.0 to 1.4.0 |
| smb.flags2.roe | Boolean | Execute-only Reads | 1.0.0 to 1.4.0 |
| smb.flags2.sec_sig | Boolean | Security Signatures | 1.0.0 to 1.4.0 |
| smb.flags2.string | Boolean | Unicode Strings | 1.0.0 to 1.4.0 |
| smb.fn_loi | Unsigned 16-bit integer | Level of Interest | 1.0.0 to 1.4.0 |
| smb.forwarded_name | String | Forwarded Name | 1.0.0 to 1.4.0 |
| smb.free_alloc_units | Unsigned 64-bit integer | Free Units | 1.0.0 to 1.4.0 |
| smb.free_block.count | Unsigned 32-bit integer | Free Block Count | 1.0.0 to 1.4.0 |
| smb.free_units | Unsigned 16-bit integer | Free Units | 1.0.0 to 1.4.0 |
| smb.fs_attr.cpn | Boolean | Case Preserving | 1.0.0 to 1.4.0 |
| smb.fs_attr.css | Boolean | Case Sensitive Search | 1.0.0 to 1.4.0 |
| smb.fs_attr.fc | Boolean | Compression | 1.0.0 to 1.4.0 |
| smb.fs_attr.ns | Boolean | Named Streams | 1.0.0 to 1.4.0 |
| smb.fs_attr.pacls | Boolean | Persistent ACLs | 1.0.0 to 1.4.0 |
| smb.fs_attr.rov | Boolean | Read Only Volume | 1.0.0 to 1.4.0 |
| smb.fs_attr.se | Boolean | Supports Encryption | 1.0.0 to 1.4.0 |
| smb.fs_attr.sla | Boolean | LFN APIs | 1.0.0 to 1.4.0 |
| smb.fs_attr.soids | Boolean | Supports OIDs | 1.0.0 to 1.4.0 |
| smb.fs_attr.srp | Boolean | Reparse Points | 1.0.0 to 1.4.0 |
| smb.fs_attr.srs | Boolean | Remote Storage | 1.0.0 to 1.4.0 |
| smb.fs_attr.ssf | Boolean | Sparse Files | 1.0.0 to 1.4.0 |
| smb.fs_attr.uod | Boolean | Unicode On Disk | 1.0.0 to 1.4.0 |
| smb.fs_attr.vis | Boolean | Volume Is Compressed | 1.0.0 to 1.4.0 |
| smb.fs_attr.vq | Boolean | Volume Quotas | 1.0.0 to 1.4.0 |
| smb.fs_bytes_per_sector | Unsigned 32-bit integer | Bytes per Sector | 1.0.0 to 1.4.0 |
| smb.fs_id | Unsigned 32-bit integer | FS Id | 1.0.0 to 1.4.0 |
| smb.fs_max_name_len | Unsigned 32-bit integer | Max name length | 1.0.0 to 1.4.0 |
| smb.fs_name | String | FS Name | 1.0.0 to 1.4.0 |
| smb.fs_name.len | Unsigned 32-bit integer | Label Length | 1.0.0 to 1.4.0 |
| smb.fs_sector_per_unit | Unsigned 32-bit integer | Sectors/Unit | 1.0.0 to 1.4.0 |
| smb.fs_units | Unsigned 32-bit integer | Total Units | 1.0.0 to 1.4.0 |
| smb.group_id | Unsigned 16-bit integer | Group ID | 1.0.0 to 1.4.0 |
| smb.impersonation.level | Unsigned 32-bit integer | Impersonation | 1.0.0 to 1.4.0 |
| smb.index_number | Unsigned 64-bit integer | Index Number | 1.0.0 to 1.4.0 |
| smb.ipc_state.endpoint | Unsigned 16-bit integer | Endpoint | 1.0.0 to 1.4.0 |
| smb.ipc_state.icount | Unsigned 16-bit integer | Icount | 1.0.0 to 1.4.0 |
| smb.ipc_state.nonblocking | Boolean | Nonblocking | 1.0.0 to 1.4.0 |
| smb.ipc_state.pipe_type | Unsigned 16-bit integer | Pipe Type | 1.0.0 to 1.4.0 |
| smb.ipc_state.read_mode | Unsigned 16-bit integer | Read Mode | 1.0.0 to 1.4.0 |
| smb.is_directory | Unsigned 8-bit integer | Is Directory | 1.0.0 to 1.4.0 |
| smb.key | Unsigned 32-bit integer | Key | 1.0.0 to 1.4.0 |
| smb.last_name_offset | Unsigned 16-bit integer | Last Name Offset | 1.0.0 to 1.4.0 |
| smb.last_write.smb.date | Unsigned 16-bit integer | Last Write Date | 1.0.0 to 1.4.0 |
| smb.last_write.smb.time | Unsigned 16-bit integer | Last Write Time | 1.0.0 to 1.4.0 |
| smb.last_write.time | Date/Time stamp | Last Write | 1.0.0 to 1.4.0 |
| smb.link_count | Unsigned 32-bit integer | Link Count | 1.0.0 to 1.4.0 |
| smb.lock.length | Unsigned 64-bit integer | Length | 1.0.0 to 1.4.0 |
| smb.lock.offset | Unsigned 64-bit integer | Offset | 1.0.0 to 1.4.0 |
| smb.lock.type.cancel | Boolean | Cancel | 1.0.0 to 1.4.0 |
| smb.lock.type.change | Boolean | Change | 1.0.0 to 1.4.0 |
| smb.lock.type.large | Boolean | Large Files | 1.0.0 to 1.4.0 |
| smb.lock.type.oplock_release | Boolean | Oplock Break | 1.0.0 to 1.4.0 |
| smb.lock.type.shared | Boolean | Shared | 1.0.0 to 1.4.0 |
| smb.locking.num_locks | Unsigned 16-bit integer | Number of Locks | 1.0.0 to 1.4.0 |
| smb.locking.num_unlocks | Unsigned 16-bit integer | Number of Unlocks | 1.0.0 to 1.4.0 |
| smb.locking.oplock.level | Unsigned 8-bit integer | Oplock Level | 1.0.0 to 1.4.0 |
| smb.logged_in | Frame number | Logged In | 1.0.0 to 1.4.0 |
| smb.logged_out | Frame number | Logged Out | 1.0.0 to 1.4.0 |
| smb.mac.access_control | Boolean | Mac Access Control | 1.0.0 to 1.4.0 |
| smb.mac.desktop_db_calls | Boolean | Desktop DB Calls | 1.0.0 to 1.4.0 |
| smb.mac.finderinfo | Byte array | Finder Info | 1.0.0 to 1.4.0 |
| smb.mac.get_set_comments | Boolean | Get Set Comments | 1.0.0 to 1.4.0 |
| smb.mac.streams_support | Boolean | Mac Streams | 1.0.0 to 1.4.0 |
| smb.mac.support.flags | Unsigned 32-bit integer | Mac Support Flags | 1.0.0 to 1.4.0 |
| smb.mac.uids | Boolean | Macintosh Unique IDs | 1.0.0 to 1.4.0 |
| smb.machine_name | String | Machine Name | 1.0.0 to 1.4.0 |
| smb.marked_for_deletion | Boolean | Marked for Deletion | 1.0.0 to 1.4.0 |
| smb.max_buf | Unsigned 16-bit integer | Max Buffer | 1.0.0 to 1.4.0 |
| smb.max_bufsize | Unsigned 32-bit integer | Max Buffer Size | 1.0.0 to 1.4.0 |
| smb.max_mpx_count | Unsigned 16-bit integer | Max Mpx Count | 1.0.0 to 1.4.0 |
| smb.max_raw | Unsigned 32-bit integer | Max Raw Buffer | 1.0.0 to 1.4.0 |
| smb.max_referral_level | Unsigned 16-bit integer | Max Referral Level | 1.0.0 to 1.4.0 |
| smb.max_vcs | Unsigned 16-bit integer | Max VCs | 1.0.0 to 1.4.0 |
| smb.maxcount | Unsigned 16-bit integer | Max Count | 1.0.0 to 1.4.0 |
| smb.maxcount_high | Unsigned 16-bit integer | Max Count High (multiply with 64K) | 1.0.0 to 1.4.0 |
| smb.maxcount_low | Unsigned 16-bit integer | Max Count Low | 1.0.0 to 1.4.0 |
| smb.mdc | Unsigned 32-bit integer | Max Data Count | 1.0.0 to 1.4.0 |
| smb.message | String | Message | 1.0.0 to 1.4.0 |
| smb.message.len | Unsigned 16-bit integer | Message Len | 1.0.0 to 1.4.0 |
| smb.mgid | Unsigned 16-bit integer | Message Group ID | 1.0.0 to 1.4.0 |
| smb.mid | Unsigned 16-bit integer | Multiplex ID | 1.0.0 to 1.4.0 |
| smb.mincount | Unsigned 16-bit integer | Min Count | 1.0.0 to 1.4.0 |
| smb.mode | Unsigned 32-bit integer | Mode | 1.0.0 to 1.4.0 |
| smb.modify.time | Date/Time stamp | Modified | 1.0.0 to 1.4.0 |
| smb.monitor_handle | Unsigned 16-bit integer | Monitor Handle | 1.0.0 to 1.4.0 |
| smb.move.flags.dir | Boolean | Must be directory | 1.0.0 to 1.4.0 |
| smb.move.flags.file | Boolean | Must be file | 1.0.0 to 1.4.0 |
| smb.move.flags.verify | Boolean | Verify writes | 1.0.0 to 1.4.0 |
| smb.mpc | Unsigned 32-bit integer | Max Parameter Count | 1.0.0 to 1.4.0 |
| smb.msc | Unsigned 8-bit integer | Max Setup Count | 1.0.0 to 1.4.0 |
| smb.native_fs | String | Native File System | 1.0.0 to 1.4.0 |
| smb.native_lanman | String | Native LAN Manager | 1.0.0 to 1.4.0 |
| smb.native_os | String | Native OS | 1.0.0 to 1.4.0 |
| smb.next_entry_offset | Unsigned 32-bit integer | Next Entry Offset | 1.0.0 to 1.4.0 |
| smb.nt.create.batch_oplock | Boolean | Batch Oplock | 1.0.0 to 1.4.0 |
| smb.nt.create.dir | Boolean | Create Directory | 1.0.0 to 1.4.0 |
| smb.nt.create.ext | Boolean | Extended Response | 1.0.0 to 1.4.0 |
| smb.nt.create.oplock | Boolean | Exclusive Oplock | 1.0.0 to 1.4.0 |
| smb.nt.create_options.backup_intent | Boolean | Backup Intent | 1.0.0 to 1.4.0 |
| smb.nt.create_options.complete_if_oplocked | Boolean | Complete If Oplocked | 1.0.0 to 1.4.0 |
| smb.nt.create_options.create_tree_connection | Boolean | Create Tree Connection | 1.0.0 to 1.4.0 |
| smb.nt.create_options.delete_on_close | Boolean | Delete On Close | 1.0.0 to 1.4.0 |
| smb.nt.create_options.directory | Boolean | Directory | 1.0.0 to 1.4.0 |
| smb.nt.create_options.eight_dot_three_only | Boolean | 8.3 Only | 1.0.0 to 1.4.0 |
| smb.nt.create_options.intermediate_buffering | Boolean | Intermediate Buffering | 1.0.0 to 1.4.0 |
| smb.nt.create_options.no_compression | Boolean | No Compression | 1.0.0 to 1.4.0 |
| smb.nt.create_options.no_ea_knowledge | Boolean | No EA Knowledge | 1.0.0 to 1.4.0 |
| smb.nt.create_options.non_directory | Boolean | Non-Directory | 1.0.0 to 1.4.0 |
| smb.nt.create_options.open_by_fileid | Boolean | Open By FileID | 1.0.0 to 1.4.0 |
| smb.nt.create_options.open_for_free_space_query | Boolean | Open For Free Space query | 1.0.0 to 1.4.0 |
| smb.nt.create_options.open_no_recall | Boolean | Open No Recall | 1.0.0 to 1.4.0 |
| smb.nt.create_options.open_reparse_point | Boolean | Open Reparse Point | 1.0.0 to 1.4.0 |
| smb.nt.create_options.random_access | Boolean | Random Access | 1.0.0 to 1.4.0 |
| smb.nt.create_options.reserve_opfilter | Boolean | Reserve Opfilter | 1.0.0 to 1.4.0 |
| smb.nt.create_options.sequential_only | Boolean | Sequential Only | 1.0.0 to 1.4.0 |
| smb.nt.create_options.sync_io_alert | Boolean | Sync I/O Alert | 1.0.0 to 1.4.0 |
| smb.nt.create_options.sync_io_nonalert | Boolean | Sync I/O Nonalert | 1.0.0 to 1.4.0 |
| smb.nt.create_options.write_through | Boolean | Write Through | 1.0.0 to 1.4.0 |
| smb.nt.function | Unsigned 16-bit integer | Function | 1.0.0 to 1.4.0 |
| smb.nt.ioctl.flags.root_handle | Boolean | Root Handle | 1.0.0 to 1.4.0 |
| smb.nt.ioctl.isfsctl | Unsigned 8-bit integer | IsFSctl | 1.0.0 to 1.4.0 |
| smb.nt.notify.action | Unsigned 32-bit integer | Action | 1.0.0 to 1.4.0 |
| smb.nt.notify.attributes | Boolean | Attribute Change | 1.0.0 to 1.4.0 |
| smb.nt.notify.creation | Boolean | Created Change | 1.0.0 to 1.4.0 |
| smb.nt.notify.dir_name | Boolean | Directory Name Change | 1.0.0 to 1.4.0 |
| smb.nt.notify.ea | Boolean | EA Change | 1.0.0 to 1.4.0 |
| smb.nt.notify.file_name | Boolean | File Name Change | 1.0.0 to 1.4.0 |
| smb.nt.notify.last_access | Boolean | Last Access Change | 1.0.0 to 1.4.0 |
| smb.nt.notify.last_write | Boolean | Last Write Change | 1.0.0 to 1.4.0 |
| smb.nt.notify.security | Boolean | Security Change | 1.0.0 to 1.4.0 |
| smb.nt.notify.size | Boolean | Size Change | 1.0.0 to 1.4.0 |
| smb.nt.notify.stream_name | Boolean | Stream Name Change | 1.0.0 to 1.4.0 |
| smb.nt.notify.stream_size | Boolean | Stream Size Change | 1.0.0 to 1.4.0 |
| smb.nt.notify.stream_write | Boolean | Stream Write | 1.0.0 to 1.4.0 |
| smb.nt.notify.watch_tree | Unsigned 8-bit integer | Watch Tree | 1.0.0 to 1.4.0 |
| smb.nt_qsd.dacl | Boolean | DACL | 1.0.0 to 1.4.0 |
| smb.nt_qsd.group | Boolean | Group | 1.0.0 to 1.4.0 |
| smb.nt_qsd.owner | Boolean | Owner | 1.0.0 to 1.4.0 |
| smb.nt_qsd.sacl | Boolean | SACL | 1.0.0 to 1.4.0 |
| smb.nt_status | Unsigned 32-bit integer | NT Status | 1.0.0 to 1.4.0 |
| smb.ntr_clu | Unsigned 32-bit integer | Cluster count | 1.0.0 to 1.4.0 |
| smb.ntr_loi | Unsigned 16-bit integer | Level of Interest | 1.0.0 to 1.4.0 |
| smb.offset | Unsigned 32-bit integer | Offset | 1.0.0 to 1.4.0 |
| smb.offset_high | Unsigned 32-bit integer | High Offset | 1.0.0 to 1.4.0 |
| smb.old_file | String | Old File Name | 1.0.0 to 1.4.0 |
| smb.open.action.lock | Boolean | Exclusive Open | 1.0.0 to 1.4.0 |
| smb.open.action.open | Unsigned 16-bit integer | Open Action | 1.0.0 to 1.4.0 |
| smb.open.flags.add_info | Boolean | Additional Info | 1.0.0 to 1.4.0 |
| smb.open.flags.batch_oplock | Boolean | Batch Oplock | 1.0.0 to 1.4.0 |
| smb.open.flags.ealen | Boolean | Total EA Len | 1.0.0 to 1.4.0 |
| smb.open.flags.ex_oplock | Boolean | Exclusive Oplock | 1.0.0 to 1.4.0 |
| smb.open.function.create | Boolean | Create | 1.0.0 to 1.4.0 |
| smb.open.function.open | Unsigned 16-bit integer | Open | 1.0.0 to 1.4.0 |
| smb.oplock.level | Unsigned 8-bit integer | Oplock level | 1.0.0 to 1.4.0 |
| smb.originator_name | String | Originator Name | 1.0.0 to 1.4.0 |
| smb.padding | Byte array | Padding | 1.0.0 to 1.4.0 |
| smb.password | Byte array | Password | 1.0.0 to 1.4.0 |
| smb.path | String | Path | 1.0.0 to 1.4.0 |
| smb.pc | Unsigned 16-bit integer | Parameter Count | 1.0.0 to 1.4.0 |
| smb.pd | Unsigned 16-bit integer | Parameter Displacement | 1.0.0 to 1.4.0 |
| smb.pid | Unsigned 16-bit integer | Process ID | 1.0.0 to 1.4.0 |
| smb.pid.high | Unsigned 16-bit integer | Process ID High | 1.0.0 to 1.4.0 |
| smb.pipe.write_len | Unsigned 16-bit integer | Pipe Write Len | 1.0.0 to 1.4.0 |
| smb.pipe_info_flag | Boolean | Pipe Info | 1.0.0 to 1.4.0 |
| smb.po | Unsigned 16-bit integer | Parameter Offset | 1.0.0 to 1.4.0 |
| smb.position | Unsigned 64-bit integer | Position | 1.0.0 to 1.4.0 |
| smb.posix_acl.ace_perms | Unsigned 8-bit integer | Permissions | 1.0.0 to 1.4.0 |
| smb.posix_acl.ace_perms.execute | Boolean | EXECUTE | 1.0.0 to 1.4.0 |
| smb.posix_acl.ace_perms.gid | Unsigned 32-bit integer | GID | 1.0.0 to 1.4.0 |
| smb.posix_acl.ace_perms.owner_gid | Unsigned 32-bit integer | Owner GID | 1.0.0 to 1.4.0 |
| smb.posix_acl.ace_perms.owner_uid | Unsigned 32-bit integer | Owner UID | 1.0.0 to 1.4.0 |
| smb.posix_acl.ace_perms.read | Boolean | READ | 1.0.0 to 1.4.0 |
| smb.posix_acl.ace_perms.uid | Unsigned 32-bit integer | UID | 1.0.0 to 1.4.0 |
| smb.posix_acl.ace_perms.write | Boolean | WRITE | 1.0.0 to 1.4.0 |
| smb.posix_acl.ace_type | Unsigned 8-bit integer | ACE Type | 1.0.0 to 1.4.0 |
| smb.posix_acl.num_def_aces | Unsigned 16-bit integer | Number of default ACEs | 1.0.0 to 1.4.0 |
| smb.posix_acl.num_file_aces | Unsigned 16-bit integer | Number of file ACEs | 1.0.0 to 1.4.0 |
| smb.posix_acl.version | Unsigned 16-bit integer | Posix ACL version | 1.0.0 to 1.4.0 |
| smb.primary_domain | String | Primary Domain | 1.0.0 to 1.4.0 |
| smb.print.identifier | String | Identifier | 1.0.0 to 1.4.0 |
| smb.print.mode | Unsigned 16-bit integer | Mode | 1.0.0 to 1.4.0 |
| smb.print.queued.date | Date/Time stamp | Queued | 1.0.0 to 1.4.0 |
| smb.print.queued.smb.date | Unsigned 16-bit integer | Queued Date | 1.0.0 to 1.4.0 |
| smb.print.queued.smb.time | Unsigned 16-bit integer | Queued Time | 1.0.0 to 1.4.0 |
| smb.print.restart_index | Unsigned 16-bit integer | Restart Index | 1.0.0 to 1.4.0 |
| smb.print.setup.len | Unsigned 16-bit integer | Setup Len | 1.0.0 to 1.4.0 |
| smb.print.spool.file_number | Unsigned 16-bit integer | Spool File Number | 1.0.0 to 1.4.0 |
| smb.print.spool.file_size | Unsigned 32-bit integer | Spool File Size | 1.0.0 to 1.4.0 |
| smb.print.spool.name | String | Name | 1.0.0 to 1.4.0 |
| smb.print.start_index | Unsigned 16-bit integer | Start Index | 1.0.0 to 1.4.0 |
| smb.print.status | Unsigned 8-bit integer | Status | 1.0.0 to 1.4.0 |
| smb.pwlen | Unsigned 16-bit integer | Password Length | 1.0.0 to 1.4.0 |
| smb.qfsi_loi | Unsigned 16-bit integer | Level of Interest | 1.0.0 to 1.4.0 |
| smb.qpi_loi | Unsigned 16-bit integer | Level of Interest | 1.0.0 to 1.4.0 |
| smb.quota.flags.deny_disk | Boolean | Deny Disk | 1.0.0 to 1.4.0 |
| smb.quota.flags.enabled | Boolean | Enabled | 1.0.0 to 1.4.0 |
| smb.quota.flags.log_limit | Boolean | Log Limit | 1.0.0 to 1.4.0 |
| smb.quota.flags.log_warning | Boolean | Log Warning | 1.0.0 to 1.4.0 |
| smb.quota.hard.default | Unsigned 64-bit integer | (Hard) Quota Limit | 1.0.0 to 1.4.0 |
| smb.quota.soft.default | Unsigned 64-bit integer | (Soft) Quota Treshold | 1.0.0 to 1.4.0 |
| smb.quota.used | Unsigned 64-bit integer | Quota Used | 1.0.0 to 1.4.0 |
| smb.quota.user.offset | Unsigned 32-bit integer | Next Offset | 1.0.0 to 1.4.0 |
| smb.reassembled.length | Unsigned 32-bit integer | Reassembled SMB length | 1.4.0 |
| smb.remaining | Unsigned 32-bit integer | Remaining | 1.0.0 to 1.4.0 |
| smb.reparse_tag | Unsigned 32-bit integer | Reparse Tag | 1.0.0 to 1.4.0 |
| smb.replace | Boolean | Replace | 1.0.0 to 1.4.0 |
| smb.request.mask | Unsigned 32-bit integer | Request Mask | 1.0.0 to 1.4.0 |
| smb.reserved | Byte array | Reserved | 1.0.0 to 1.4.0 |
| smb.response.mask | Unsigned 32-bit integer | Response Mask | 1.0.0 to 1.4.0 |
| smb.response_in | Frame number | Response in | 1.0.0 to 1.4.0 |
| smb.response_to | Frame number | Response to | 1.0.0 to 1.4.0 |
| smb.resume | Unsigned 32-bit integer | Resume Key | 1.0.0 to 1.4.0 |
| smb.resume.client.cookie | Byte array | Client Cookie | 1.0.0 to 1.4.0 |
| smb.resume.find_id | Unsigned 8-bit integer | Find ID | 1.0.0 to 1.4.0 |
| smb.resume.key_len | Unsigned 16-bit integer | Resume Key Length | 1.0.0 to 1.4.0 |
| smb.resume.server.cookie | Byte array | Server Cookie | 1.0.0 to 1.4.0 |
| smb.rfid | Unsigned 32-bit integer | Root FID | 1.0.0 to 1.4.0 |
| smb.rm.read | Boolean | Read Raw | 1.0.0 to 1.4.0 |
| smb.rm.write | Boolean | Write Raw | 1.0.0 to 1.4.0 |
| smb.root.dir.count | Unsigned 32-bit integer | Root Directory Count | 1.0.0 to 1.4.0 |
| smb.root.file.count | Unsigned 32-bit integer | Root File Count | 1.0.0 to 1.4.0 |
| smb.root_dir_handle | Unsigned 32-bit integer | Root Directory Handle | 1.0.0 to 1.4.0 |
| smb.sc | Unsigned 8-bit integer | Setup Count | 1.0.0 to 1.4.0 |
| smb.sd.length | Unsigned 32-bit integer | SD Length | 1.0.0 to 1.4.0 |
| smb.search.attribute.archive | Boolean | Archive | 1.0.0 to 1.4.0 |
| smb.search.attribute.directory | Boolean | Directory | 1.0.0 to 1.4.0 |
| smb.search.attribute.hidden | Boolean | Hidden | 1.0.0 to 1.4.0 |
| smb.search.attribute.read_only | Boolean | Read Only | 1.0.0 to 1.4.0 |
| smb.search.attribute.system | Boolean | System | 1.0.0 to 1.4.0 |
| smb.search.attribute.volume | Boolean | Volume ID | 1.0.0 to 1.4.0 |
| smb.search_count | Unsigned 16-bit integer | Search Count | 1.0.0 to 1.4.0 |
| smb.search_id | Unsigned 16-bit integer | Search ID | 1.0.0 to 1.4.0 |
| smb.search_pattern | String | Search Pattern | 1.0.0 to 1.4.0 |
| smb.sec_desc_len | Unsigned 32-bit integer | NT Security Descriptor Length | 1.0.0 to 1.4.0 |
| smb.security.flags.context_tracking | Boolean | Context Tracking | 1.0.0 to 1.4.0 |
| smb.security.flags.effective_only | Boolean | Effective Only | 1.0.0 to 1.4.0 |
| smb.security_blob | Byte array | Security Blob | 1.0.0 to 1.4.0 |
| smb.security_blob_len | Unsigned 16-bit integer | Security Blob Length | 1.0.0 to 1.4.0 |
| smb.seek_mode | Unsigned 16-bit integer | Seek Mode | 1.0.0 to 1.4.0 |
| smb.segment | Frame number | SMB Segment | 1.0.0 to 1.4.0 |
| smb.segment.error | Frame number | Defragmentation error | 1.0.0 to 1.4.0 |
| smb.segment.multipletails | Boolean | Multiple tail fragments found | 1.0.0 to 1.4.0 |
| smb.segment.overlap | Boolean | Fragment overlap | 1.0.0 to 1.4.0 |
| smb.segment.overlap.conflict | Boolean | Conflicting data in fragment overlap | 1.0.0 to 1.4.0 |
| smb.segment.segments | None | SMB Segments | 1.0.0 to 1.4.0 |
| smb.segment.toolongfragment | Boolean | Fragment too long | 1.0.0 to 1.4.0 |
| smb.sequence_num | Unsigned 16-bit integer | Sequence Number | 1.0.0 to 1.4.0 |
| smb.server | String | Server | 1.0.0 to 1.4.0 |
| smb.server_cap.bulk_transfer | Boolean | Bulk Transfer | 1.0.0 to 1.4.0 |
| smb.server_cap.compressed_data | Boolean | Compressed Data | 1.0.0 to 1.4.0 |
| smb.server_cap.dfs | Boolean | Dfs | 1.0.0 to 1.4.0 |
| smb.server_cap.extended_security | Boolean | Extended Security | 1.0.0 to 1.4.0 |
| smb.server_cap.infolevel_passthru | Boolean | Infolevel Passthru | 1.0.0 to 1.4.0 |
| smb.server_cap.large_files | Boolean | Large Files | 1.0.0 to 1.4.0 |
| smb.server_cap.large_readx | Boolean | Large ReadX | 1.0.0 to 1.4.0 |
| smb.server_cap.large_writex | Boolean | Large WriteX | 1.0.0 to 1.4.0 |
| smb.server_cap.level_2_oplocks | Boolean | Level 2 Oplocks | 1.0.0 to 1.4.0 |
| smb.server_cap.lock_and_read | Boolean | Lock and Read | 1.0.0 to 1.4.0 |
| smb.server_cap.mpx_mode | Boolean | MPX Mode | 1.0.0 to 1.4.0 |
| smb.server_cap.nt_find | Boolean | NT Find | 1.0.0 to 1.4.0 |
| smb.server_cap.nt_smbs | Boolean | NT SMBs | 1.0.0 to 1.4.0 |
| smb.server_cap.nt_status | Boolean | NT Status Codes | 1.0.0 to 1.4.0 |
| smb.server_cap.raw_mode | Boolean | Raw Mode | 1.0.0 to 1.4.0 |
| smb.server_cap.reserved | Boolean | Reserved | 1.0.0 to 1.4.0 |
| smb.server_cap.rpc_remote_apis | Boolean | RPC Remote APIs | 1.0.0 to 1.4.0 |
| smb.server_cap.unicode | Boolean | Unicode | 1.0.0 to 1.4.0 |
| smb.server_cap.unix | Boolean | UNIX | 1.0.0 to 1.4.0 |
| smb.server_date_time | Date/Time stamp | Server Date and Time | 1.0.0 to 1.4.0 |
| smb.server_date_time.smb_date | Unsigned 16-bit integer | Server Date | 1.0.0 to 1.4.0 |
| smb.server_date_time.smb_time | Unsigned 16-bit integer | Server Time | 1.0.0 to 1.4.0 |
| smb.server_fid | Unsigned 32-bit integer | Server FID | 1.0.0 to 1.4.0 |
| smb.server_guid | Byte array | Server GUID | 1.0.0 to 1.4.0 |
| smb.server_timezone | Signed 16-bit integer | Time Zone | 1.0.0 to 1.4.0 |
| smb.service | String | Service | 1.0.0 to 1.4.0 |
| smb.sessid | Unsigned 16-bit integer | Session ID | 1.0.0 to 1.4.0 |
| smb.session_key | Unsigned 32-bit integer | Session Key | 1.0.0 to 1.4.0 |
| smb.setup.action.guest | Boolean | Guest | 1.0.0 to 1.4.0 |
| smb.share.access.delete | Boolean | Delete | 1.0.0 to 1.4.0 |
| smb.share.access.read | Boolean | Read | 1.0.0 to 1.4.0 |
| smb.share.access.write | Boolean | Write | 1.0.0 to 1.4.0 |
| smb.share_access | Unsigned 32-bit integer | Share Access | 1.0.0 to 1.4.0 |
| smb.short_file | String | Short File Name | 1.0.0 to 1.4.0 |
| smb.short_file_name_len | Unsigned 32-bit integer | Short File Name Len | 1.0.0 to 1.4.0 |
| smb.signature | Byte array | Signature | 1.0.0 to 1.4.0 |
| smb.sm.mode | Boolean | Mode | 1.0.0 to 1.4.0 |
| smb.sm.password | Boolean | Password | 1.0.0 to 1.4.0 |
| smb.sm.sig_required | Boolean | Sig Req | 1.0.0 to 1.4.0 |
| smb.sm.signatures | Boolean | Signatures | 1.0.0 to 1.4.0 |
| smb.spi_loi | Unsigned 16-bit integer | Level of Interest | 1.0.0 to 1.4.0 |
| smb.storage_type | Unsigned 32-bit integer | Storage Type | 1.0.0 to 1.4.0 |
| smb.stream_name | String | Stream Name | 1.0.0 to 1.4.0 |
| smb.stream_name_len | Unsigned 32-bit integer | Stream Name Length | 1.0.0 to 1.4.0 |
| smb.stream_size | Unsigned 64-bit integer | Stream Size | 1.0.0 to 1.4.0 |
| smb.system.time | Date/Time stamp | System Time | 1.0.0 to 1.4.0 |
| smb.target_name | String | Target name | 1.0.0 to 1.4.0 |
| smb.target_name_len | Unsigned 32-bit integer | Target name length | 1.0.0 to 1.4.0 |
| smb.tdc | Unsigned 32-bit integer | Total Data Count | 1.0.0 to 1.4.0 |
| smb.tid | Unsigned 16-bit integer | Tree ID | 1.0.0 to 1.4.0 |
| smb.time | Time duration | Time from request | 1.0.0 to 1.4.0 |
| smb.timeout | Unsigned 32-bit integer | Timeout | 1.0.0 to 1.4.0 |
| smb.total_data_len | Unsigned 16-bit integer | Total Data Length | 1.0.0 to 1.4.0 |
| smb.tpc | Unsigned 32-bit integer | Total Parameter Count | 1.0.0 to 1.4.0 |
| smb.trans2.cmd | Unsigned 16-bit integer | Subcommand | 1.0.0 to 1.4.0 |
| smb.trans_name | String | Transaction Name | 1.0.0 to 1.4.0 |
| smb.transaction.flags.dtid | Boolean | Disconnect TID | 1.0.0 to 1.4.0 |
| smb.transaction.flags.owt | Boolean | One Way Transaction | 1.0.0 to 1.4.0 |
| smb.uid | Unsigned 16-bit integer | User ID | 1.0.0 to 1.4.0 |
| smb.unicode_password | Byte array | Unicode Password | 1.0.0 to 1.4.0 |
| smb.unicode_pwlen | Unsigned 16-bit integer | Unicode Password Length | 1.0.0 to 1.4.0 |
| smb.units | Unsigned 16-bit integer | Total Units | 1.0.0 to 1.4.0 |
| smb.unix.capability.fcntl | Boolean | FCNTL Capability | 1.0.0 to 1.4.0 |
| smb.unix.capability.posix_acl | Boolean | POSIX ACL Capability | 1.0.0 to 1.4.0 |
| smb.unix.file.atime | Date/Time stamp | Last access | 1.0.0 to 1.4.0 |
| smb.unix.file.dev_major | Unsigned 64-bit integer | Major device | 1.0.0 to 1.4.0 |
| smb.unix.file.dev_minor | Unsigned 64-bit integer | Minor device | 1.0.0 to 1.4.0 |
| smb.unix.file.file_type | Unsigned 32-bit integer | File type | 1.0.0 to 1.4.0 |
| smb.unix.file.gid | Unsigned 64-bit integer | GID | 1.0.0 to 1.4.0 |
| smb.unix.file.link_dest | String | Link destination | 1.0.0 to 1.4.0 |
| smb.unix.file.mtime | Date/Time stamp | Last modification | 1.0.0 to 1.4.0 |
| smb.unix.file.num_bytes | Unsigned 64-bit integer | Number of bytes | 1.0.0 to 1.4.0 |
| smb.unix.file.num_links | Unsigned 64-bit integer | Num links | 1.0.0 to 1.4.0 |
| smb.unix.file.perms | Unsigned 64-bit integer | File permissions | 1.0.0 to 1.4.0 |
| smb.unix.file.size | Unsigned 64-bit integer | File size | 1.0.0 to 1.4.0 |
| smb.unix.file.stime | Date/Time stamp | Last status change | 1.0.0 to 1.4.0 |
| smb.unix.file.uid | Unsigned 64-bit integer | UID | 1.0.0 to 1.4.0 |
| smb.unix.file.unique_id | Unsigned 64-bit integer | Unique ID | 1.0.0 to 1.4.0 |
| smb.unix.find_file.next_offset | Unsigned 32-bit integer | Next entry offset | 1.0.0 to 1.4.0 |
| smb.unix.find_file.resume_key | Unsigned 32-bit integer | Resume key | 1.0.0 to 1.4.0 |
| smb.unix.major_version | Unsigned 16-bit integer | Major Version | 1.0.0 to 1.4.0 |
| smb.unix.minor_version | Unsigned 16-bit integer | Minor Version | 1.0.0 to 1.4.0 |
| smb.unknown | Byte array | Unknown Data | 1.0.0 to 1.4.0 |
| smb.unknown_data | Byte array | Unknown Data | 1.4.0 |
| smb.unknown_field | Unsigned 32-bit integer | Unknown field | 1.4.0 |
| smb.vc | Unsigned 16-bit integer | VC Number | 1.0.0 to 1.4.0 |
| smb.volume.label | String | Label | 1.0.0 to 1.4.0 |
| smb.volume.label.len | Unsigned 32-bit integer | Label Length | 1.0.0 to 1.4.0 |
| smb.volume.serial | Unsigned 32-bit integer | Volume Serial Number | 1.0.0 to 1.4.0 |
| smb.wct | Unsigned 8-bit integer | Word Count (WCT) | 1.0.0 to 1.4.0 |
| smb.write.mode.connectionless | Boolean | Connectionless | 1.0.0 to 1.4.0 |
| smb.write.mode.message_start | Boolean | Message Start | 1.0.0 to 1.4.0 |
| smb.write.mode.raw | Boolean | Write Raw | 1.0.0 to 1.4.0 |
| smb.write.mode.return_remaining | Boolean | Return Remaining | 1.0.0 to 1.4.0 |
| smb.write.mode.write_through | Boolean | Write Through | 1.0.0 to 1.4.0 |