Wireshark
the world's foremost network protocol analyzer
Display Filter Reference: SMB (Server Message Block Protocol)
Protocol field name: smb
Versions: 1.0.0 to 1.6.5
Back to Display Filter Reference
| Field name | Type | Description | Versions |
|---|---|---|---|
| nt.access_mask | Unsigned integer, 4 bytes | Access required | 1.0.0 to 1.6.5 |
| nt.access_mask.access_sacl | Boolean | Access SACL | 1.0.0 to 1.6.5 |
| nt.access_mask.delete | Boolean | Delete | 1.0.0 to 1.6.5 |
| nt.access_mask.generic_all | Boolean | Generic all | 1.0.0 to 1.6.5 |
| nt.access_mask.generic_execute | Boolean | Generic execute | 1.0.0 to 1.6.5 |
| nt.access_mask.generic_read | Boolean | Generic read | 1.0.0 to 1.6.5 |
| nt.access_mask.generic_write | Boolean | Generic write | 1.0.0 to 1.6.5 |
| nt.access_mask.maximum_allowed | Boolean | Maximum allowed | 1.0.0 to 1.6.5 |
| nt.access_mask.read_control | Boolean | Read control | 1.0.0 to 1.6.5 |
| nt.access_mask.specific_0 | Boolean | Specific access, bit 0 | 1.0.0 to 1.6.5 |
| nt.access_mask.specific_1 | Boolean | Specific access, bit 1 | 1.0.0 to 1.6.5 |
| nt.access_mask.specific_10 | Boolean | Specific access, bit 10 | 1.0.0 to 1.6.5 |
| nt.access_mask.specific_11 | Boolean | Specific access, bit 11 | 1.0.0 to 1.6.5 |
| nt.access_mask.specific_12 | Boolean | Specific access, bit 12 | 1.0.0 to 1.6.5 |
| nt.access_mask.specific_13 | Boolean | Specific access, bit 13 | 1.0.0 to 1.6.5 |
| nt.access_mask.specific_14 | Boolean | Specific access, bit 14 | 1.0.0 to 1.6.5 |
| nt.access_mask.specific_15 | Boolean | Specific access, bit 15 | 1.0.0 to 1.6.5 |
| nt.access_mask.specific_2 | Boolean | Specific access, bit 2 | 1.0.0 to 1.6.5 |
| nt.access_mask.specific_3 | Boolean | Specific access, bit 3 | 1.0.0 to 1.6.5 |
| nt.access_mask.specific_4 | Boolean | Specific access, bit 4 | 1.0.0 to 1.6.5 |
| nt.access_mask.specific_5 | Boolean | Specific access, bit 5 | 1.0.0 to 1.6.5 |
| nt.access_mask.specific_6 | Boolean | Specific access, bit 6 | 1.0.0 to 1.6.5 |
| nt.access_mask.specific_7 | Boolean | Specific access, bit 7 | 1.0.0 to 1.6.5 |
| nt.access_mask.specific_8 | Boolean | Specific access, bit 8 | 1.0.0 to 1.6.5 |
| nt.access_mask.specific_9 | Boolean | Specific access, bit 9 | 1.0.0 to 1.6.5 |
| nt.access_mask.synchronise | Boolean | Synchronise | 1.0.0 to 1.6.5 |
| nt.access_mask.write_dac | Boolean | Write DAC | 1.0.0 to 1.6.5 |
| nt.access_mask.write_owner | Boolean | Write owner | 1.0.0 to 1.6.5 |
| nt.ace.flags.container_inherit | Boolean | Container Inherit | 1.0.0 to 1.6.5 |
| nt.ace.flags.failed_access | Boolean | Audit Failed Accesses | 1.0.0 to 1.6.5 |
| nt.ace.flags.inherit_only | Boolean | Inherit Only | 1.0.0 to 1.6.5 |
| nt.ace.flags.inherited_ace | Boolean | Inherited ACE | 1.0.0 to 1.6.5 |
| nt.ace.flags.non_propagate_inherit | Boolean | Non-Propagate Inherit | 1.0.0 to 1.6.5 |
| nt.ace.flags.object_inherit | Boolean | Object Inherit | 1.0.0 to 1.6.5 |
| nt.ace.flags.successful_access | Boolean | Audit Successful Accesses | 1.0.0 to 1.6.5 |
| nt.ace.object.flags.inherited_object_type_present | Boolean | Inherited Object Type Present | 1.0.0 to 1.6.5 |
| nt.ace.object.flags.object_type_present | Boolean | Object Type Present | 1.0.0 to 1.6.5 |
| nt.ace.object.guid | Globally Unique Identifier | GUID | 1.0.0 to 1.6.5 |
| nt.ace.object.inherited_guid | Globally Unique Identifier | Inherited GUID | 1.0.0 to 1.6.5 |
| nt.ace.size | Unsigned integer, 2 bytes | Size | 1.0.0 to 1.6.5 |
| nt.ace.type | Unsigned integer, 1 byte | Type | 1.0.0 to 1.6.5 |
| nt.acl.num_aces | Unsigned integer, 4 bytes | Num ACEs | 1.0.0 to 1.6.5 |
| nt.acl.revision | Unsigned integer, 2 bytes | Revision | 1.0.0 to 1.6.5 |
| nt.acl.size | Unsigned integer, 2 bytes | Size | 1.0.0 to 1.6.5 |
| nt.sec_desc.revision | Unsigned integer, 2 bytes | Revision | 1.0.0 to 1.6.5 |
| nt.sec_desc.type.dacl_auto_inherit_req | Boolean | DACL Auto Inherit Required | 1.0.0 to 1.6.5 |
| nt.sec_desc.type.dacl_auto_inherited | Boolean | DACL Auto Inherited | 1.0.0 to 1.6.5 |
| nt.sec_desc.type.dacl_defaulted | Boolean | DACL Defaulted | 1.0.0 to 1.6.5 |
| nt.sec_desc.type.dacl_present | Boolean | DACL Present | 1.0.0 to 1.6.5 |
| nt.sec_desc.type.dacl_protected | Boolean | DACL Protected | 1.0.0 to 1.6.5 |
| nt.sec_desc.type.dacl_trusted | Boolean | DACL Trusted | 1.0.0 to 1.6.5 |
| nt.sec_desc.type.group_defaulted | Boolean | Group Defaulted | 1.0.0 to 1.6.5 |
| nt.sec_desc.type.owner_defaulted | Boolean | Owner Defaulted | 1.0.0 to 1.6.5 |
| nt.sec_desc.type.rm_control_valid | Boolean | RM Control Valid | 1.0.0 to 1.6.5 |
| nt.sec_desc.type.sacl_auto_inherit_req | Boolean | SACL Auto Inherit Required | 1.0.0 to 1.6.5 |
| nt.sec_desc.type.sacl_auto_inherited | Boolean | SACL Auto Inherited | 1.0.0 to 1.6.5 |
| nt.sec_desc.type.sacl_defaulted | Boolean | SACL Defaulted | 1.0.0 to 1.6.5 |
| nt.sec_desc.type.sacl_present | Boolean | SACL Present | 1.0.0 to 1.6.5 |
| nt.sec_desc.type.sacl_protected | Boolean | SACL Protected | 1.0.0 to 1.6.5 |
| nt.sec_desc.type.self_relative | Boolean | Self Relative | 1.0.0 to 1.6.5 |
| nt.sec_desc.type.server_security | Boolean | Server Security | 1.0.0 to 1.6.5 |
| nt.sec_info.dacl | Boolean | DACL | 1.2.0 to 1.6.5 |
| nt.sec_info.group | Boolean | Group | 1.2.0 to 1.6.5 |
| nt.sec_info.owner | Boolean | Owner | 1.2.0 to 1.6.5 |
| nt.sec_info.sacl | Boolean | SACL | 1.2.0 to 1.6.5 |
| nt.sid | Character string | SID | 1.0.0 to 1.6.5 |
| nt.sid.auth | Unsigned integer, 8 bytes | Authority | 1.6.0 to 1.6.5 |
| nt.sid.domain | Character string | Domain: | 1.6.0 to 1.6.5 |
| nt.sid.num_auth | Unsigned integer, 1 byte | Num Auth | 1.0.0 to 1.6.5 |
| nt.sid.revision | Unsigned integer, 1 byte | Revision | 1.0.0 to 1.6.5 |
| nt.sid.rid | Unsigned integer, 4 bytes | RID | 1.6.0 to 1.6.5 |
| nt.sid.subauth | Character string | Subauthorities | 1.6.0 to 1.6.5 |
| nt.sid.wkwn | Character string | Well-known SID | 1.6.0 to 1.6.5 |
| smb.access.append | Boolean | Append | 1.0.0 to 1.6.5 |
| smb.access.caching | Boolean | Caching | 1.0.0 to 1.6.5 |
| smb.access.delete | Boolean | Delete | 1.0.0 to 1.6.5 |
| smb.access.delete_child | Boolean | Delete Child | 1.0.0 to 1.6.5 |
| smb.access.execute | Boolean | Execute | 1.0.0 to 1.6.5 |
| smb.access.generic_all | Boolean | Generic All | 1.0.0 to 1.6.5 |
| smb.access.generic_execute | Boolean | Generic Execute | 1.0.0 to 1.6.5 |
| smb.access.generic_read | Boolean | Generic Read | 1.0.0 to 1.6.5 |
| smb.access.generic_write | Boolean | Generic Write | 1.0.0 to 1.6.5 |
| smb.access.locality | Unsigned integer, 2 bytes | Locality | 1.0.0 to 1.6.5 |
| smb.access.maximum_allowed | Boolean | Maximum Allowed | 1.0.0 to 1.6.5 |
| smb.access.mode | Unsigned integer, 2 bytes | Access Mode | 1.0.0 to 1.6.5 |
| smb.access.read | Boolean | Read | 1.0.0 to 1.6.5 |
| smb.access.read_attributes | Boolean | Read Attributes | 1.0.0 to 1.6.5 |
| smb.access.read_control | Boolean | Read Control | 1.0.0 to 1.6.5 |
| smb.access.read_ea | Boolean | Read EA | 1.0.0 to 1.6.5 |
| smb.access.sharing | Unsigned integer, 2 bytes | Sharing Mode | 1.0.0 to 1.6.5 |
| smb.access.smb.date | Unsigned integer, 2 bytes | Last Access Date | 1.0.0 to 1.6.5 |
| smb.access.smb.time | Unsigned integer, 2 bytes | Last Access Time | 1.0.0 to 1.6.5 |
| smb.access.synchronize | Boolean | Synchronize | 1.0.0 to 1.6.5 |
| smb.access.system_security | Boolean | System Security | 1.0.0 to 1.6.5 |
| smb.access.time | Date and time | Last Access | 1.0.0 to 1.6.5 |
| smb.access.write | Boolean | Write | 1.0.0 to 1.6.5 |
| smb.access.write_attributes | Boolean | Write Attributes | 1.0.0 to 1.6.5 |
| smb.access.write_dac | Boolean | Write DAC | 1.0.0 to 1.6.5 |
| smb.access.write_ea | Boolean | Write EA | 1.0.0 to 1.6.5 |
| smb.access.write_owner | Boolean | Write Owner | 1.0.0 to 1.6.5 |
| smb.access.writethrough | Boolean | Writethrough | 1.0.0 to 1.6.5 |
| smb.access_mask | Unsigned integer, 4 bytes | Access Mask | 1.0.0 to 1.6.5 |
| smb.account | Character string | Account | 1.0.0 to 1.6.5 |
| smb.actual_free_alloc_units | Unsigned integer, 8 bytes | Actual Free Units | 1.0.0 to 1.6.5 |
| smb.alignment | Unsigned integer, 4 bytes | Alignment | 1.0.0 to 1.6.5 |
| smb.alloc.count | Unsigned integer, 4 bytes | Allocation Block Count | 1.0.0 to 1.6.5 |
| smb.alloc.size | Unsigned integer, 4 bytes | Allocation Block Count | 1.0.0 to 1.6.5 |
| smb.alloc_size | Unsigned integer, 4 bytes | Allocation Size | 1.0.0 to 1.6.5 |
| smb.andxoffset | Unsigned integer, 2 bytes | AndXOffset | 1.0.0 to 1.6.5 |
| smb.ansi_password | Sequence of bytes | ANSI Password | 1.0.0 to 1.6.5 |
| smb.ansi_pwlen | Unsigned integer, 2 bytes | ANSI Password Length | 1.0.0 to 1.6.5 |
| smb.attribute | Unsigned integer, 4 bytes | Attribute | 1.0.0 to 1.6.5 |
| smb.avail.units | Unsigned integer, 4 bytes | Available Units | 1.0.0 to 1.6.5 |
| smb.backup.time | Date and time | Backed-up | 1.0.0 to 1.6.5 |
| smb.bcc | Unsigned integer, 2 bytes | Byte Count (BCC) | 1.0.0 to 1.6.5 |
| smb.blocksize | Unsigned integer, 2 bytes | Block Size | 1.0.0 to 1.6.5 |
| smb.bpu | Unsigned integer, 2 bytes | Blocks Per Unit | 1.0.0 to 1.6.5 |
| smb.buffer_format | Unsigned integer, 1 byte | Buffer Format | 1.0.0 to 1.6.5 |
| smb.caller_free_alloc_units | Unsigned integer, 8 bytes | Caller Free Units | 1.0.0 to 1.6.5 |
| smb.cancel_to | Frame number | Cancel to | 1.0.0 to 1.6.5 |
| smb.change.time | Date and time | Change | 1.0.0 to 1.6.5 |
| smb.change_count | Unsigned integer, 2 bytes | Change Count | 1.0.0 to 1.6.5 |
| smb.cmd | Unsigned integer, 1 byte | SMB Command | 1.0.0 to 1.6.5 |
| smb.compressed.chunk_shift | Unsigned integer, 1 byte | Chunk Shift | 1.0.0 to 1.6.5 |
| smb.compressed.cluster_shift | Unsigned integer, 1 byte | Cluster Shift | 1.0.0 to 1.6.5 |
| smb.compressed.file_size | Unsigned integer, 8 bytes | Compressed Size | 1.0.0 to 1.6.5 |
| smb.compressed.format | Unsigned integer, 2 bytes | Compression Format | 1.0.0 to 1.6.5 |
| smb.compressed.unit_shift | Unsigned integer, 1 byte | Unit Shift | 1.0.0 to 1.6.5 |
| smb.connect.flags.dtid | Boolean | Disconnect TID | 1.0.0 to 1.6.5 |
| smb.connect.flags.extendedresp | Boolean | Extended Response | 1.6.0 to 1.6.5 |
| smb.connect.flags.extendedsig | Boolean | Extended Signature | 1.6.0 to 1.6.5 |
| smb.connect.support.cscmask | Unsigned integer, 2 bytes | CSC Mask | 1.6.0 to 1.6.5 |
| smb.connect.support.dfs | Boolean | In Dfs | 1.0.0 to 1.6.5 |
| smb.connect.support.extendedsig | Boolean | Extended Signatures | 1.6.0 to 1.6.5 |
| smb.connect.support.search | Boolean | Search Bits | 1.0.0 to 1.6.5 |
| smb.connect.support.uniqfilename | Boolean | Unique File Name | 1.6.0 to 1.6.5 |
| smb.continuation_to | Frame number | Continuation to | 1.0.0 to 1.6.5 |
| smb.copy.flags.dest_mode | Boolean | Destination mode | 1.0.0 to 1.6.5 |
| smb.copy.flags.dir | Boolean | Must be directory | 1.0.0 to 1.6.5 |
| smb.copy.flags.ea_action | Boolean | EA action if EAs not supported on dest | 1.0.0 to 1.6.5 |
| smb.copy.flags.file | Boolean | Must be file | 1.0.0 to 1.6.5 |
| smb.copy.flags.source_mode | Boolean | Source mode | 1.0.0 to 1.6.5 |
| smb.copy.flags.tree_copy | Boolean | Tree copy | 1.0.0 to 1.6.5 |
| smb.copy.flags.verify | Boolean | Verify writes | 1.0.0 to 1.6.5 |
| smb.count | Unsigned integer, 4 bytes | Count | 1.0.0 to 1.6.5 |
| smb.count_high | Unsigned integer, 2 bytes | Count High (multiply with 64K) | 1.0.0 to 1.6.5 |
| smb.count_low | Unsigned integer, 2 bytes | Count Low | 1.0.0 to 1.6.5 |
| smb.create.action | Unsigned integer, 4 bytes | Create action | 1.0.0 to 1.6.5 |
| smb.create.disposition | Unsigned integer, 4 bytes | Disposition | 1.0.0 to 1.6.5 |
| smb.create.file_id | Unsigned integer, 4 bytes | Server unique file ID | 1.0.0 to 1.6.5 |
| smb.create.smb.date | Unsigned integer, 2 bytes | Create Date | 1.0.0 to 1.6.5 |
| smb.create.smb.time | Unsigned integer, 2 bytes | Create Time | 1.0.0 to 1.6.5 |
| smb.create.time | Date and time | Created | 1.0.0 to 1.6.5 |
| smb.create_flags | Unsigned integer, 4 bytes | Create Flags | 1.0.0 to 1.6.5 |
| smb.create_options | Unsigned integer, 4 bytes | Create Options | 1.0.0 to 1.6.5 |
| smb.data_disp | Unsigned integer, 2 bytes | Data Displacement | 1.0.0 to 1.6.5 |
| smb.data_len | Unsigned integer, 2 bytes | Data Length | 1.0.0 to 1.6.5 |
| smb.data_len_high | Unsigned integer, 2 bytes | Data Length High (multiply with 64K) | 1.0.0 to 1.6.5 |
| smb.data_len_low | Unsigned integer, 2 bytes | Data Length Low | 1.0.0 to 1.6.5 |
| smb.data_offset | Unsigned integer, 2 bytes | Data Offset | 1.0.0 to 1.6.5 |
| smb.data_size | Unsigned integer, 4 bytes | Data Size | 1.0.0 to 1.6.5 |
| smb.dc | Unsigned integer, 2 bytes | Data Count | 1.0.0 to 1.6.5 |
| smb.dcm | Unsigned integer, 2 bytes | Data Compaction Mode | 1.0.0 to 1.6.5 |
| smb.delete_pending | Unsigned integer, 2 bytes | Delete Pending | 1.0.0 to 1.6.5 |
| smb.destination_name | Character string | Destination Name | 1.0.0 to 1.6.5 |
| smb.device.floppy | Boolean | Floppy | 1.0.0 to 1.6.5 |
| smb.device.mounted | Boolean | Mounted | 1.0.0 to 1.6.5 |
| smb.device.read_only | Boolean | Read Only | 1.0.0 to 1.6.5 |
| smb.device.remote | Boolean | Remote | 1.0.0 to 1.6.5 |
| smb.device.removable | Boolean | Removable | 1.0.0 to 1.6.5 |
| smb.device.type | Unsigned integer, 4 bytes | Device Type | 1.0.0 to 1.6.5 |
| smb.device.virtual | Boolean | Virtual | 1.0.0 to 1.6.5 |
| smb.device.write_once | Boolean | Write Once | 1.0.0 to 1.6.5 |
| smb.dfs.flags.fielding | Boolean | Fielding | 1.0.0 to 1.6.5 |
| smb.dfs.flags.server_hold_storage | Boolean | Hold Storage | 1.0.0 to 1.6.5 |
| smb.dfs.num_referrals | Unsigned integer, 2 bytes | Num Referrals | 1.0.0 to 1.6.5 |
| smb.dfs.path_consumed | Unsigned integer, 2 bytes | Path Consumed | 1.0.0 to 1.6.5 |
| smb.dfs.referral.alt_path | Character string | Alt Path | 1.0.0 to 1.6.5 |
| smb.dfs.referral.alt_path_offset | Unsigned integer, 2 bytes | Alt Path Offset | 1.0.0 to 1.6.5 |
| smb.dfs.referral.domain_name | Character string | Domain Name | 1.2.3 to 1.6.5 |
| smb.dfs.referral.domain_offset | Unsigned integer, 2 bytes | Domain Offset | 1.2.3 to 1.6.5 |
| smb.dfs.referral.expname | Character string | Expanded Name | 1.2.3 to 1.6.5 |
| smb.dfs.referral.expnames_offset | Unsigned integer, 2 bytes | Expanded Names Offset | 1.2.3 to 1.6.5 |
| smb.dfs.referral.flags.name_list_referral | Boolean | NameListReferral | 1.2.3 to 1.6.5 |
| smb.dfs.referral.flags.strip | Boolean | Strip | 1.0.0 to 1.2.2 |
| smb.dfs.referral.flags.target_set_boundary | Boolean | TargetSetBoundary | 1.2.3 to 1.6.5 |
| smb.dfs.referral.node | Character string | Node | 1.0.0 to 1.6.5 |
| smb.dfs.referral.node_offset | Unsigned integer, 2 bytes | Node Offset | 1.0.0 to 1.6.5 |
| smb.dfs.referral.number_of_expnames | Unsigned integer, 2 bytes | Number of Expanded Names | 1.2.3 to 1.6.5 |
| smb.dfs.referral.path | Character string | Path | 1.0.0 to 1.6.5 |
| smb.dfs.referral.path_offset | Unsigned integer, 2 bytes | Path Offset | 1.0.0 to 1.6.5 |
| smb.dfs.referral.proximity | Unsigned integer, 4 bytes | Proximity | 1.0.0 to 1.6.5 |
| smb.dfs.referral.server.type | Unsigned integer, 2 bytes | Server Type | 1.0.0 to 1.6.5 |
| smb.dfs.referral.server_guid | Sequence of bytes | Server GUID | 1.2.3 to 1.6.5 |
| smb.dfs.referral.size | Unsigned integer, 2 bytes | Size | 1.0.0 to 1.6.5 |
| smb.dfs.referral.ttl | Unsigned integer, 4 bytes | TTL | 1.0.0 to 1.6.5 |
| smb.dfs.referral.version | Unsigned integer, 2 bytes | Version | 1.0.0 to 1.6.5 |
| smb.dialect.index | Unsigned integer, 2 bytes | Selected Index | 1.0.0 to 1.6.5 |
| smb.dialect.name | Character string | Name | 1.0.0 to 1.6.5 |
| smb.dir.accessmask.add_file | Boolean | Add File | 1.0.0 to 1.6.5 |
| smb.dir.accessmask.add_subdir | Boolean | Add Subdir | 1.0.0 to 1.6.5 |
| smb.dir.accessmask.delete_child | Boolean | Delete Child | 1.0.0 to 1.6.5 |
| smb.dir.accessmask.list | Boolean | List | 1.0.0 to 1.6.5 |
| smb.dir.accessmask.read_attribute | Boolean | Read Attribute | 1.0.0 to 1.6.5 |
| smb.dir.accessmask.read_ea | Boolean | Read EA | 1.0.0 to 1.6.5 |
| smb.dir.accessmask.traverse | Boolean | Traverse | 1.0.0 to 1.6.5 |
| smb.dir.accessmask.write_attribute | Boolean | Write Attribute | 1.0.0 to 1.6.5 |
| smb.dir.accessmask.write_ea | Boolean | Write EA | 1.0.0 to 1.6.5 |
| smb.dir.count | Unsigned integer, 4 bytes | Root Directory Count | 1.0.0 to 1.6.5 |
| smb.dir_name | Character string | Directory | 1.0.0 to 1.6.5 |
| smb.disposition.delete_on_close | Boolean | Delete on close | 1.0.0 to 1.6.5 |
| smb.ea.data | Sequence of bytes | EA Data | 1.0.0 to 1.6.5 |
| smb.ea.data_length | Unsigned integer, 2 bytes | EA Data Length | 1.0.0 to 1.6.5 |
| smb.ea.error_offset | Unsigned integer, 4 bytes | EA Error offset | 1.0.0 to 1.6.5 |
| smb.ea.flags | Unsigned integer, 1 byte | EA Flags | 1.0.0 to 1.6.5 |
| smb.ea.list_length | Unsigned integer, 4 bytes | EA List Length | 1.0.0 to 1.6.5 |
| smb.ea.name | Character string | EA Name | 1.0.0 to 1.6.5 |
| smb.ea.name_length | Unsigned integer, 1 byte | EA Name Length | 1.0.0 to 1.6.5 |
| smb.echo.count | Unsigned integer, 2 bytes | Echo Count | 1.0.0 to 1.6.5 |
| smb.echo.data | Sequence of bytes | Echo Data | 1.0.0 to 1.6.5 |
| smb.echo.seq_num | Unsigned integer, 2 bytes | Echo Seq Num | 1.0.0 to 1.6.5 |
| smb.encryption_key | Sequence of bytes | Encryption Key | 1.0.0 to 1.6.5 |
| smb.encryption_key_length | Unsigned integer, 2 bytes | Key Length | 1.0.0 to 1.6.5 |
| smb.end_of_file | Unsigned integer, 8 bytes | End Of File | 1.0.0 to 1.6.5 |
| smb.end_of_search | Unsigned integer, 2 bytes | End Of Search | 1.0.0 to 1.6.5 |
| smb.error_class | Unsigned integer, 1 byte | Error Class | 1.0.0 to 1.6.5 |
| smb.error_code | Unsigned integer, 2 bytes | Error Code | 1.0.0 to 1.6.5 |
| smb.ext_attr | Sequence of bytes | Extended Attributes | 1.0.0 to 1.6.5 |
| smb.ff2_loi | Unsigned integer, 2 bytes | Level of Interest | 1.0.0 to 1.6.5 |
| smb.fid | Unsigned integer, 2 bytes | FID | 1.0.0 to 1.6.5 |
| smb.fid.closed_in | Frame number | Closed in | 1.0.0 to 1.6.5 |
| smb.fid.mapped_in | Frame number | Mapped in | 1.0.0 to 1.6.5 |
| smb.fid.opened_in | Frame number | Opened in | 1.0.0 to 1.6.5 |
| smb.fid.unmapped_in | Frame number | Unmapped in | 1.0.0 to 1.6.5 |
| smb.file | Character string | File Name | 1.0.0 to 1.6.5 |
| smb.file.accessmask.append_data | Boolean | Append Data | 1.0.0 to 1.6.5 |
| smb.file.accessmask.execute | Boolean | Execute | 1.0.0 to 1.6.5 |
| smb.file.accessmask.read_attribute | Boolean | Read Attribute | 1.0.0 to 1.6.5 |
| smb.file.accessmask.read_data | Boolean | Read Data | 1.0.0 to 1.6.5 |
| smb.file.accessmask.read_ea | Boolean | Read EA | 1.0.0 to 1.6.5 |
| smb.file.accessmask.write_attribute | Boolean | Write Attribute | 1.0.0 to 1.6.5 |
| smb.file.accessmask.write_data | Boolean | Write Data | 1.0.0 to 1.6.5 |
| smb.file.accessmask.write_ea | Boolean | Write EA | 1.0.0 to 1.6.5 |
| smb.file.count | Unsigned integer, 4 bytes | Root File Count | 1.0.0 to 1.6.5 |
| smb.file.rw.length | Unsigned integer, 4 bytes | File RW Length | 1.0.0 to 1.6.5 |
| smb.file.rw.offset | Unsigned integer, 8 bytes | File Offset | 1.0.0 to 1.6.5 |
| smb.file_attribute.archive | Boolean | Archive | 1.0.0 to 1.6.5 |
| smb.file_attribute.compressed | Boolean | Compressed | 1.0.0 to 1.6.5 |
| smb.file_attribute.device | Boolean | Device | 1.0.0 to 1.6.5 |
| smb.file_attribute.directory | Boolean | Directory | 1.0.0 to 1.6.5 |
| smb.file_attribute.encrypted | Boolean | Encrypted | 1.0.0 to 1.6.5 |
| smb.file_attribute.hidden | Boolean | Hidden | 1.0.0 to 1.6.5 |
| smb.file_attribute.normal | Boolean | Normal | 1.0.0 to 1.6.5 |
| smb.file_attribute.not_content_indexed | Boolean | Content Indexed | 1.0.0 to 1.6.5 |
| smb.file_attribute.offline | Boolean | Offline | 1.0.0 to 1.6.5 |
| smb.file_attribute.read_only | Boolean | Read Only | 1.0.0 to 1.6.5 |
| smb.file_attribute.reparse | Boolean | Reparse Point | 1.0.0 to 1.6.5 |
| smb.file_attribute.sparse | Boolean | Sparse | 1.0.0 to 1.6.5 |
| smb.file_attribute.system | Boolean | System | 1.0.0 to 1.6.5 |
| smb.file_attribute.temporary | Boolean | Temporary | 1.0.0 to 1.6.5 |
| smb.file_attribute.volume | Boolean | Volume ID | 1.0.0 to 1.6.5 |
| smb.file_data | Sequence of bytes | File Data | 1.0.0 to 1.6.5 |
| smb.file_index | Unsigned integer, 4 bytes | File Index | 1.0.0 to 1.6.5 |
| smb.file_name_len | Unsigned integer, 4 bytes | File Name Len | 1.0.0 to 1.6.5 |
| smb.file_size | Unsigned integer, 4 bytes | File Size | 1.0.0 to 1.6.5 |
| smb.file_type | Unsigned integer, 2 bytes | File Type | 1.0.0 to 1.6.5 |
| smb.files_moved | Unsigned integer, 2 bytes | Files Moved | 1.0.0 to 1.6.5 |
| smb.find_first2.flags.backup | Boolean | Backup Intent | 1.0.0 to 1.6.5 |
| smb.find_first2.flags.close | Boolean | Close | 1.0.0 to 1.6.5 |
| smb.find_first2.flags.continue | Boolean | Continue | 1.0.0 to 1.6.5 |
| smb.find_first2.flags.eos | Boolean | Close on EOS | 1.0.0 to 1.6.5 |
| smb.find_first2.flags.resume | Boolean | Resume | 1.0.0 to 1.6.5 |
| smb.flags.canon | Boolean | Canonicalized Pathnames | 1.0.0 to 1.6.5 |
| smb.flags.caseless | Boolean | Case Sensitivity | 1.0.0 to 1.6.5 |
| smb.flags.lock | Boolean | Lock and Read | 1.0.0 to 1.6.5 |
| smb.flags.notify | Boolean | Notify | 1.0.0 to 1.6.5 |
| smb.flags.oplock | Boolean | Oplocks | 1.0.0 to 1.6.5 |
| smb.flags.receive_buffer | Boolean | Receive Buffer Posted | 1.0.0 to 1.6.5 |
| smb.flags.response | Boolean | Request/Response | 1.0.0 to 1.6.5 |
| smb.flags2.dfs | Boolean | Dfs | 1.0.0 to 1.6.5 |
| smb.flags2.ea | Boolean | Extended Attributes | 1.0.0 to 1.6.5 |
| smb.flags2.esn | Boolean | Extended Security Negotiation | 1.0.0 to 1.6.5 |
| smb.flags2.long_names_allowed | Boolean | Long Names Allowed | 1.0.0 to 1.6.5 |
| smb.flags2.long_names_used | Boolean | Long Names Used | 1.0.0 to 1.6.5 |
| smb.flags2.nt_error | Boolean | Error Code Type | 1.0.0 to 1.6.5 |
| smb.flags2.roe | Boolean | Execute-only Reads | 1.0.0 to 1.6.5 |
| smb.flags2.sec_sig | Boolean | Security Signatures | 1.0.0 to 1.6.5 |
| smb.flags2.string | Boolean | Unicode Strings | 1.0.0 to 1.6.5 |
| smb.fn_loi | Unsigned integer, 2 bytes | Level of Interest | 1.0.0 to 1.6.5 |
| smb.forwarded_name | Character string | Forwarded Name | 1.0.0 to 1.6.5 |
| smb.fragment.count | Unsigned integer, 4 bytes | Fragment count | 1.6.0 to 1.6.5 |
| smb.free_alloc_units | Unsigned integer, 8 bytes | Free Units | 1.0.0 to 1.6.5 |
| smb.free_block.count | Unsigned integer, 4 bytes | Free Block Count | 1.0.0 to 1.6.5 |
| smb.free_units | Unsigned integer, 2 bytes | Free Units | 1.0.0 to 1.6.5 |
| smb.fs_attr.cpn | Boolean | Case Preserving | 1.0.0 to 1.6.5 |
| smb.fs_attr.css | Boolean | Case Sensitive Search | 1.0.0 to 1.6.5 |
| smb.fs_attr.fc | Boolean | Compression | 1.0.0 to 1.6.5 |
| smb.fs_attr.ns | Boolean | Named Streams | 1.0.0 to 1.6.5 |
| smb.fs_attr.pacls | Boolean | Persistent ACLs | 1.0.0 to 1.6.5 |
| smb.fs_attr.rov | Boolean | Read Only Volume | 1.0.0 to 1.6.5 |
| smb.fs_attr.se | Boolean | Supports Encryption | 1.0.0 to 1.6.5 |
| smb.fs_attr.sla | Boolean | LFN APIs | 1.0.0 to 1.6.5 |
| smb.fs_attr.soids | Boolean | Supports OIDs | 1.0.0 to 1.6.5 |
| smb.fs_attr.srp | Boolean | Reparse Points | 1.0.0 to 1.6.5 |
| smb.fs_attr.srs | Boolean | Remote Storage | 1.0.0 to 1.6.5 |
| smb.fs_attr.ssf | Boolean | Sparse Files | 1.0.0 to 1.6.5 |
| smb.fs_attr.uod | Boolean | Unicode On Disk | 1.0.0 to 1.6.5 |
| smb.fs_attr.vis | Boolean | Volume Is Compressed | 1.0.0 to 1.6.5 |
| smb.fs_attr.vq | Boolean | Volume Quotas | 1.0.0 to 1.6.5 |
| smb.fs_bytes_per_sector | Unsigned integer, 4 bytes | Bytes per Sector | 1.0.0 to 1.6.5 |
| smb.fs_id | Unsigned integer, 4 bytes | FS Id | 1.0.0 to 1.6.5 |
| smb.fs_max_name_len | Unsigned integer, 4 bytes | Max name length | 1.0.0 to 1.6.5 |
| smb.fs_name | Character string | FS Name | 1.0.0 to 1.6.5 |
| smb.fs_name.len | Unsigned integer, 4 bytes | Label Length | 1.0.0 to 1.6.5 |
| smb.fs_sector_per_unit | Unsigned integer, 4 bytes | Sectors/Unit | 1.0.0 to 1.6.5 |
| smb.fs_units | Unsigned integer, 4 bytes | Total Units | 1.0.0 to 1.6.5 |
| smb.group_id | Unsigned integer, 2 bytes | Group ID | 1.0.0 to 1.6.5 |
| smb.impersonation.level | Unsigned integer, 4 bytes | Impersonation | 1.0.0 to 1.6.5 |
| smb.index_number | Unsigned integer, 8 bytes | Index Number | 1.0.0 to 1.6.5 |
| smb.ipc_state.endpoint | Unsigned integer, 2 bytes | Endpoint | 1.0.0 to 1.6.5 |
| smb.ipc_state.icount | Unsigned integer, 2 bytes | Icount | 1.0.0 to 1.6.5 |
| smb.ipc_state.nonblocking | Boolean | Nonblocking | 1.0.0 to 1.6.5 |
| smb.ipc_state.pipe_type | Unsigned integer, 2 bytes | Pipe Type | 1.0.0 to 1.6.5 |
| smb.ipc_state.read_mode | Unsigned integer, 2 bytes | Read Mode | 1.0.0 to 1.6.5 |
| smb.is_directory | Unsigned integer, 1 byte | Is Directory | 1.0.0 to 1.6.5 |
| smb.key | Unsigned integer, 4 bytes | Key | 1.0.0 to 1.6.5 |
| smb.last_name_offset | Unsigned integer, 2 bytes | Last Name Offset | 1.0.0 to 1.6.5 |
| smb.last_write.smb.date | Unsigned integer, 2 bytes | Last Write Date | 1.0.0 to 1.6.5 |
| smb.last_write.smb.time | Unsigned integer, 2 bytes | Last Write Time | 1.0.0 to 1.6.5 |
| smb.last_write.time | Date and time | Last Write | 1.0.0 to 1.6.5 |
| smb.link_count | Unsigned integer, 4 bytes | Link Count | 1.0.0 to 1.6.5 |
| smb.lock.length | Unsigned integer, 8 bytes | Length | 1.0.0 to 1.6.5 |
| smb.lock.offset | Unsigned integer, 8 bytes | Offset | 1.0.0 to 1.6.5 |
| smb.lock.type.cancel | Boolean | Cancel | 1.0.0 to 1.6.5 |
| smb.lock.type.change | Boolean | Change | 1.0.0 to 1.6.5 |
| smb.lock.type.large | Boolean | Large Files | 1.0.0 to 1.6.5 |
| smb.lock.type.oplock_release | Boolean | Oplock Break | 1.0.0 to 1.6.5 |
| smb.lock.type.shared | Boolean | Shared | 1.0.0 to 1.6.5 |
| smb.locking.num_locks | Unsigned integer, 2 bytes | Number of Locks | 1.0.0 to 1.6.5 |
| smb.locking.num_unlocks | Unsigned integer, 2 bytes | Number of Unlocks | 1.0.0 to 1.6.5 |
| smb.locking.oplock.level | Unsigned integer, 1 byte | Oplock Level | 1.0.0 to 1.6.5 |
| smb.logged_in | Frame number | Logged In | 1.0.0 to 1.6.5 |
| smb.logged_out | Frame number | Logged Out | 1.0.0 to 1.6.5 |
| smb.mac.access_control | Boolean | Mac Access Control | 1.0.0 to 1.6.5 |
| smb.mac.desktop_db_calls | Boolean | Desktop DB Calls | 1.0.0 to 1.6.5 |
| smb.mac.finderinfo | Sequence of bytes | Finder Info | 1.0.0 to 1.6.5 |
| smb.mac.get_set_comments | Boolean | Get Set Comments | 1.0.0 to 1.6.5 |
| smb.mac.streams_support | Boolean | Mac Streams | 1.0.0 to 1.6.5 |
| smb.mac.support.flags | Unsigned integer, 4 bytes | Mac Support Flags | 1.0.0 to 1.6.5 |
| smb.mac.uids | Boolean | Macintosh Unique IDs | 1.0.0 to 1.6.5 |
| smb.machine_name | Character string | Machine Name | 1.0.0 to 1.6.5 |
| smb.marked_for_deletion | Boolean | Marked for Deletion | 1.0.0 to 1.6.5 |
| smb.max_buf | Unsigned integer, 2 bytes | Max Buffer | 1.0.0 to 1.6.5 |
| smb.max_bufsize | Unsigned integer, 4 bytes | Max Buffer Size | 1.0.0 to 1.6.5 |
| smb.max_mpx_count | Unsigned integer, 2 bytes | Max Mpx Count | 1.0.0 to 1.6.5 |
| smb.max_raw | Unsigned integer, 4 bytes | Max Raw Buffer | 1.0.0 to 1.6.5 |
| smb.max_referral_level | Unsigned integer, 2 bytes | Max Referral Level | 1.0.0 to 1.6.5 |
| smb.max_vcs | Unsigned integer, 2 bytes | Max VCs | 1.0.0 to 1.6.5 |
| smb.maxcount | Unsigned integer, 2 bytes | Max Count | 1.0.0 to 1.6.5 |
| smb.maxcount_high | Unsigned integer, 2 bytes | Max Count High (multiply with 64K) | 1.0.0 to 1.6.5 |
| smb.maxcount_low | Unsigned integer, 2 bytes | Max Count Low | 1.0.0 to 1.6.5 |
| smb.mdc | Unsigned integer, 4 bytes | Max Data Count | 1.0.0 to 1.6.5 |
| smb.message | Character string | Message | 1.0.0 to 1.6.5 |
| smb.message.len | Unsigned integer, 2 bytes | Message Len | 1.0.0 to 1.6.5 |
| smb.mgid | Unsigned integer, 2 bytes | Message Group ID | 1.0.0 to 1.6.5 |
| smb.mid | Unsigned integer, 2 bytes | Multiplex ID | 1.0.0 to 1.6.5 |
| smb.mincount | Unsigned integer, 2 bytes | Min Count | 1.0.0 to 1.6.5 |
| smb.mode | Unsigned integer, 4 bytes | Mode | 1.0.0 to 1.6.5 |
| smb.modify.time | Date and time | Modified | 1.0.0 to 1.6.5 |
| smb.monitor_handle | Unsigned integer, 2 bytes | Monitor Handle | 1.0.0 to 1.6.5 |
| smb.move.flags.dir | Boolean | Must be directory | 1.0.0 to 1.6.5 |
| smb.move.flags.file | Boolean | Must be file | 1.0.0 to 1.6.5 |
| smb.move.flags.verify | Boolean | Verify writes | 1.0.0 to 1.6.5 |
| smb.mpc | Unsigned integer, 4 bytes | Max Parameter Count | 1.0.0 to 1.6.5 |
| smb.msc | Unsigned integer, 1 byte | Max Setup Count | 1.0.0 to 1.6.5 |
| smb.native_fs | Character string | Native File System | 1.0.0 to 1.6.5 |
| smb.native_lanman | Character string | Native LAN Manager | 1.0.0 to 1.6.5 |
| smb.native_os | Character string | Native OS | 1.0.0 to 1.6.5 |
| smb.next_entry_offset | Unsigned integer, 4 bytes | Next Entry Offset | 1.0.0 to 1.6.5 |
| smb.nt.create.batch_oplock | Boolean | Batch Oplock | 1.0.0 to 1.6.5 |
| smb.nt.create.dir | Boolean | Create Directory | 1.0.0 to 1.6.5 |
| smb.nt.create.ext | Boolean | Extended Response | 1.0.0 to 1.6.5 |
| smb.nt.create.oplock | Boolean | Exclusive Oplock | 1.0.0 to 1.6.5 |
| smb.nt.create_options.backup_intent | Boolean | Backup Intent | 1.0.0 to 1.6.5 |
| smb.nt.create_options.complete_if_oplocked | Boolean | Complete If Oplocked | 1.0.0 to 1.6.5 |
| smb.nt.create_options.create_tree_connection | Boolean | Create Tree Connection | 1.0.0 to 1.6.5 |
| smb.nt.create_options.delete_on_close | Boolean | Delete On Close | 1.0.0 to 1.6.5 |
| smb.nt.create_options.directory | Boolean | Directory | 1.0.0 to 1.6.5 |
| smb.nt.create_options.eight_dot_three_only | Boolean | 8.3 Only | 1.0.0 to 1.6.5 |
| smb.nt.create_options.intermediate_buffering | Boolean | Intermediate Buffering | 1.0.0 to 1.6.5 |
| smb.nt.create_options.no_compression | Boolean | No Compression | 1.0.0 to 1.6.5 |
| smb.nt.create_options.no_ea_knowledge | Boolean | No EA Knowledge | 1.0.0 to 1.6.5 |
| smb.nt.create_options.non_directory | Boolean | Non-Directory | 1.0.0 to 1.6.5 |
| smb.nt.create_options.open_by_fileid | Boolean | Open By FileID | 1.0.0 to 1.6.5 |
| smb.nt.create_options.open_for_free_space_query | Boolean | Open For Free Space query | 1.0.0 to 1.6.5 |
| smb.nt.create_options.open_no_recall | Boolean | Open No Recall | 1.0.0 to 1.6.5 |
| smb.nt.create_options.open_reparse_point | Boolean | Open Reparse Point | 1.0.0 to 1.6.5 |
| smb.nt.create_options.random_access | Boolean | Random Access | 1.0.0 to 1.6.5 |
| smb.nt.create_options.reserve_opfilter | Boolean | Reserve Opfilter | 1.0.0 to 1.6.5 |
| smb.nt.create_options.sequential_only | Boolean | Sequential Only | 1.0.0 to 1.6.5 |
| smb.nt.create_options.sync_io_alert | Boolean | Sync I/O Alert | 1.0.0 to 1.6.5 |
| smb.nt.create_options.sync_io_nonalert | Boolean | Sync I/O Nonalert | 1.0.0 to 1.6.5 |
| smb.nt.create_options.write_through | Boolean | Write Through | 1.0.0 to 1.6.5 |
| smb.nt.function | Unsigned integer, 2 bytes | Function | 1.0.0 to 1.6.5 |
| smb.nt.ioctl.flags.root_handle | Boolean | Root Handle | 1.0.0 to 1.6.5 |
| smb.nt.ioctl.isfsctl | Unsigned integer, 1 byte | IsFSctl | 1.0.0 to 1.6.5 |
| smb.nt.notify.action | Unsigned integer, 4 bytes | Action | 1.0.0 to 1.6.5 |
| smb.nt.notify.attributes | Boolean | Attribute Change | 1.0.0 to 1.6.5 |
| smb.nt.notify.creation | Boolean | Created Change | 1.0.0 to 1.6.5 |
| smb.nt.notify.dir_name | Boolean | Directory Name Change | 1.0.0 to 1.6.5 |
| smb.nt.notify.ea | Boolean | EA Change | 1.0.0 to 1.6.5 |
| smb.nt.notify.file_name | Boolean | File Name Change | 1.0.0 to 1.6.5 |
| smb.nt.notify.last_access | Boolean | Last Access Change | 1.0.0 to 1.6.5 |
| smb.nt.notify.last_write | Boolean | Last Write Change | 1.0.0 to 1.6.5 |
| smb.nt.notify.security | Boolean | Security Change | 1.0.0 to 1.6.5 |
| smb.nt.notify.size | Boolean | Size Change | 1.0.0 to 1.6.5 |
| smb.nt.notify.stream_name | Boolean | Stream Name Change | 1.0.0 to 1.6.5 |
| smb.nt.notify.stream_size | Boolean | Stream Size Change | 1.0.0 to 1.6.5 |
| smb.nt.notify.stream_write | Boolean | Stream Write | 1.0.0 to 1.6.5 |
| smb.nt.notify.watch_tree | Unsigned integer, 1 byte | Watch Tree | 1.0.0 to 1.6.5 |
| smb.nt_qsd.dacl | Boolean | DACL | 1.0.0 to 1.6.5 |
| smb.nt_qsd.group | Boolean | Group | 1.0.0 to 1.6.5 |
| smb.nt_qsd.owner | Boolean | Owner | 1.0.0 to 1.6.5 |
| smb.nt_qsd.sacl | Boolean | SACL | 1.0.0 to 1.6.5 |
| smb.nt_status | Unsigned integer, 4 bytes | NT Status | 1.0.0 to 1.6.5 |
| smb.ntr_clu | Unsigned integer, 4 bytes | Cluster count | 1.0.0 to 1.6.5 |
| smb.ntr_loi | Unsigned integer, 2 bytes | Level of Interest | 1.0.0 to 1.6.5 |
| smb.offset | Unsigned integer, 4 bytes | Offset | 1.0.0 to 1.6.5 |
| smb.offset_high | Unsigned integer, 4 bytes | High Offset | 1.0.0 to 1.6.5 |
| smb.old_file | Character string | Old File Name | 1.0.0 to 1.6.5 |
| smb.open.action.lock | Boolean | Exclusive Open | 1.0.0 to 1.6.5 |
| smb.open.action.open | Unsigned integer, 2 bytes | Open Action | 1.0.0 to 1.6.5 |
| smb.open.flags.add_info | Boolean | Additional Info | 1.0.0 to 1.6.5 |
| smb.open.flags.batch_oplock | Boolean | Batch Oplock | 1.0.0 to 1.6.5 |
| smb.open.flags.ealen | Boolean | Total EA Len | 1.0.0 to 1.6.5 |
| smb.open.flags.ex_oplock | Boolean | Exclusive Oplock | 1.0.0 to 1.6.5 |
| smb.open.function.create | Boolean | Create | 1.0.0 to 1.6.5 |
| smb.open.function.open | Unsigned integer, 2 bytes | Open | 1.0.0 to 1.6.5 |
| smb.oplock.level | Unsigned integer, 1 byte | Oplock level | 1.0.0 to 1.6.5 |
| smb.originator_name | Character string | Originator Name | 1.0.0 to 1.6.5 |
| smb.padding | Sequence of bytes | Padding | 1.0.0 to 1.6.5 |
| smb.password | Sequence of bytes | Password | 1.0.0 to 1.6.5 |
| smb.path | Character string | Path | 1.0.0 to 1.6.5 |
| smb.pc | Unsigned integer, 2 bytes | Parameter Count | 1.0.0 to 1.6.5 |
| smb.pd | Unsigned integer, 2 bytes | Parameter Displacement | 1.0.0 to 1.6.5 |
| smb.pid | Unsigned integer, 2 bytes | Process ID | 1.0.0 to 1.6.5 |
| smb.pid.high | Unsigned integer, 2 bytes | Process ID High | 1.0.0 to 1.6.5 |
| smb.pipe.write_len | Unsigned integer, 2 bytes | Pipe Write Len | 1.0.0 to 1.6.5 |
| smb.pipe_info_flag | Boolean | Pipe Info | 1.0.0 to 1.6.5 |
| smb.po | Unsigned integer, 2 bytes | Parameter Offset | 1.0.0 to 1.6.5 |
| smb.position | Unsigned integer, 8 bytes | Position | 1.0.0 to 1.6.5 |
| smb.posix_acl.ace_perms | Unsigned integer, 1 byte | Permissions | 1.0.0 to 1.6.5 |
| smb.posix_acl.ace_perms.execute | Boolean | EXECUTE | 1.0.0 to 1.6.5 |
| smb.posix_acl.ace_perms.gid | Unsigned integer, 4 bytes | GID | 1.0.0 to 1.6.5 |
| smb.posix_acl.ace_perms.owner_gid | Unsigned integer, 4 bytes | Owner GID | 1.0.0 to 1.6.5 |
| smb.posix_acl.ace_perms.owner_uid | Unsigned integer, 4 bytes | Owner UID | 1.0.0 to 1.6.5 |
| smb.posix_acl.ace_perms.read | Boolean | READ | 1.0.0 to 1.6.5 |
| smb.posix_acl.ace_perms.uid | Unsigned integer, 4 bytes | UID | 1.0.0 to 1.6.5 |
| smb.posix_acl.ace_perms.write | Boolean | WRITE | 1.0.0 to 1.6.5 |
| smb.posix_acl.ace_type | Unsigned integer, 1 byte | ACE Type | 1.0.0 to 1.6.5 |
| smb.posix_acl.num_def_aces | Unsigned integer, 2 bytes | Number of default ACEs | 1.0.0 to 1.6.5 |
| smb.posix_acl.num_file_aces | Unsigned integer, 2 bytes | Number of file ACEs | 1.0.0 to 1.6.5 |
| smb.posix_acl.version | Unsigned integer, 2 bytes | Posix ACL version | 1.0.0 to 1.6.5 |
| smb.primary_domain | Character string | Primary Domain | 1.0.0 to 1.6.5 |
| smb.print.identifier | Character string | Identifier | 1.0.0 to 1.6.5 |
| smb.print.mode | Unsigned integer, 2 bytes | Mode | 1.0.0 to 1.6.5 |
| smb.print.queued.date | Date and time | Queued | 1.0.0 to 1.6.5 |
| smb.print.queued.smb.date | Unsigned integer, 2 bytes | Queued Date | 1.0.0 to 1.6.5 |
| smb.print.queued.smb.time | Unsigned integer, 2 bytes | Queued Time | 1.0.0 to 1.6.5 |
| smb.print.restart_index | Unsigned integer, 2 bytes | Restart Index | 1.0.0 to 1.6.5 |
| smb.print.setup.len | Unsigned integer, 2 bytes | Setup Len | 1.0.0 to 1.6.5 |
| smb.print.spool.file_number | Unsigned integer, 2 bytes | Spool File Number | 1.0.0 to 1.6.5 |
| smb.print.spool.file_size | Unsigned integer, 4 bytes | Spool File Size | 1.0.0 to 1.6.5 |
| smb.print.spool.name | Character string | Name | 1.0.0 to 1.6.5 |
| smb.print.start_index | Unsigned integer, 2 bytes | Start Index | 1.0.0 to 1.6.5 |
| smb.print.status | Unsigned integer, 1 byte | Status | 1.0.0 to 1.6.5 |
| smb.pwlen | Unsigned integer, 2 bytes | Password Length | 1.0.0 to 1.6.5 |
| smb.qfsi_loi | Unsigned integer, 2 bytes | Level of Interest | 1.0.0 to 1.6.5 |
| smb.qpi_loi | Unsigned integer, 2 bytes | Level of Interest | 1.0.0 to 1.6.5 |
| smb.quota.flags.deny_disk | Boolean | Deny Disk | 1.0.0 to 1.6.5 |
| smb.quota.flags.enabled | Boolean | Enabled | 1.0.0 to 1.6.5 |
| smb.quota.flags.log_limit | Boolean | Log Limit | 1.0.0 to 1.6.5 |
| smb.quota.flags.log_warning | Boolean | Log Warning | 1.0.0 to 1.6.5 |
| smb.quota.hard.default | Unsigned integer, 8 bytes | (Hard) Quota Limit | 1.0.0 to 1.6.5 |
| smb.quota.soft.default | Unsigned integer, 8 bytes | (Soft) Quota Threshold | 1.0.0 to 1.6.5 |
| smb.quota.used | Unsigned integer, 8 bytes | Quota Used | 1.0.0 to 1.6.5 |
| smb.quota.user.offset | Unsigned integer, 4 bytes | Next Offset | 1.0.0 to 1.6.5 |
| smb.reassembled.length | Unsigned integer, 4 bytes | Reassembled SMB length | 1.4.0 to 1.6.5 |
| smb.remaining | Unsigned integer, 4 bytes | Remaining | 1.0.0 to 1.6.5 |
| smb.reparse_tag | Unsigned integer, 4 bytes | Reparse Tag | 1.0.0 to 1.6.5 |
| smb.replace | Boolean | Replace | 1.0.0 to 1.6.5 |
| smb.request.mask | Unsigned integer, 4 bytes | Request Mask | 1.0.0 to 1.6.5 |
| smb.reserved | Sequence of bytes | Reserved | 1.0.0 to 1.6.5 |
| smb.response.mask | Unsigned integer, 4 bytes | Response Mask | 1.0.0 to 1.6.5 |
| smb.response_in | Frame number | Response in | 1.0.0 to 1.6.5 |
| smb.response_to | Frame number | Response to | 1.0.0 to 1.6.5 |
| smb.resume | Unsigned integer, 4 bytes | Resume Key | 1.0.0 to 1.6.5 |
| smb.resume.client.cookie | Sequence of bytes | Client Cookie | 1.0.0 to 1.6.5 |
| smb.resume.find_id | Unsigned integer, 1 byte | Find ID | 1.0.0 to 1.6.5 |
| smb.resume.key_len | Unsigned integer, 2 bytes | Resume Key Length | 1.0.0 to 1.6.5 |
| smb.resume.server.cookie | Sequence of bytes | Server Cookie | 1.0.0 to 1.6.5 |
| smb.rfid | Unsigned integer, 4 bytes | Root FID | 1.0.0 to 1.6.5 |
| smb.rm.read | Boolean | Read Raw | 1.0.0 to 1.6.5 |
| smb.rm.write | Boolean | Write Raw | 1.0.0 to 1.6.5 |
| smb.root.dir.count | Unsigned integer, 4 bytes | Root Directory Count | 1.0.0 to 1.6.5 |
| smb.root.file.count | Unsigned integer, 4 bytes | Root File Count | 1.0.0 to 1.6.5 |
| smb.root_dir_handle | Unsigned integer, 4 bytes | Root Directory Handle | 1.0.0 to 1.6.5 |
| smb.sc | Unsigned integer, 1 byte | Setup Count | 1.0.0 to 1.6.5 |
| smb.sd.length | Unsigned integer, 4 bytes | SD Length | 1.0.0 to 1.6.5 |
| smb.search.attribute.archive | Boolean | Archive | 1.0.0 to 1.6.5 |
| smb.search.attribute.directory | Boolean | Directory | 1.0.0 to 1.6.5 |
| smb.search.attribute.hidden | Boolean | Hidden | 1.0.0 to 1.6.5 |
| smb.search.attribute.read_only | Boolean | Read Only | 1.0.0 to 1.6.5 |
| smb.search.attribute.system | Boolean | System | 1.0.0 to 1.6.5 |
| smb.search.attribute.volume | Boolean | Volume ID | 1.0.0 to 1.6.5 |
| smb.search_count | Unsigned integer, 2 bytes | Search Count | 1.0.0 to 1.6.5 |
| smb.search_id | Unsigned integer, 2 bytes | Search ID | 1.0.0 to 1.6.5 |
| smb.search_pattern | Character string | Search Pattern | 1.0.0 to 1.6.5 |
| smb.sec_desc_len | Unsigned integer, 4 bytes | NT Security Descriptor Length | 1.0.0 to 1.6.5 |
| smb.security.flags.context_tracking | Boolean | Context Tracking | 1.0.0 to 1.6.5 |
| smb.security.flags.effective_only | Boolean | Effective Only | 1.0.0 to 1.6.5 |
| smb.security_blob | Sequence of bytes | Security Blob | 1.0.0 to 1.6.5 |
| smb.security_blob_len | Unsigned integer, 2 bytes | Security Blob Length | 1.0.0 to 1.6.5 |
| smb.seek_mode | Unsigned integer, 2 bytes | Seek Mode | 1.0.0 to 1.6.5 |
| smb.segment | Frame number | SMB Segment | 1.0.0 to 1.6.5 |
| smb.segment.error | Frame number | Defragmentation error | 1.0.0 to 1.6.5 |
| smb.segment.multipletails | Boolean | Multiple tail fragments found | 1.0.0 to 1.6.5 |
| smb.segment.overlap | Boolean | Fragment overlap | 1.0.0 to 1.6.5 |
| smb.segment.overlap.conflict | Boolean | Conflicting data in fragment overlap | 1.0.0 to 1.6.5 |
| smb.segment.segments | Label | SMB Segments | 1.0.0 to 1.6.5 |
| smb.segment.toolongfragment | Boolean | Fragment too long | 1.0.0 to 1.6.5 |
| smb.sequence_num | Unsigned integer, 2 bytes | Sequence Number | 1.0.0 to 1.6.5 |
| smb.server | Character string | Server | 1.0.0 to 1.6.5 |
| smb.server_cap.bulk_transfer | Boolean | Bulk Transfer | 1.0.0 to 1.6.5 |
| smb.server_cap.compressed_data | Boolean | Compressed Data | 1.0.0 to 1.6.5 |
| smb.server_cap.dfs | Boolean | Dfs | 1.0.0 to 1.6.5 |
| smb.server_cap.extended_security | Boolean | Extended Security | 1.0.0 to 1.6.5 |
| smb.server_cap.infolevel_passthru | Boolean | Infolevel Passthru | 1.0.0 to 1.6.5 |
| smb.server_cap.large_files | Boolean | Large Files | 1.0.0 to 1.6.5 |
| smb.server_cap.large_readx | Boolean | Large ReadX | 1.0.0 to 1.6.5 |
| smb.server_cap.large_writex | Boolean | Large WriteX | 1.0.0 to 1.6.5 |
| smb.server_cap.level_2_oplocks | Boolean | Level 2 Oplocks | 1.0.0 to 1.6.5 |
| smb.server_cap.lock_and_read | Boolean | Lock and Read | 1.0.0 to 1.6.5 |
| smb.server_cap.mpx_mode | Boolean | MPX Mode | 1.0.0 to 1.6.5 |
| smb.server_cap.nt_find | Boolean | NT Find | 1.0.0 to 1.6.5 |
| smb.server_cap.nt_smbs | Boolean | NT SMBs | 1.0.0 to 1.6.5 |
| smb.server_cap.nt_status | Boolean | NT Status Codes | 1.0.0 to 1.6.5 |
| smb.server_cap.raw_mode | Boolean | Raw Mode | 1.0.0 to 1.6.5 |
| smb.server_cap.reserved | Boolean | Reserved | 1.0.0 to 1.6.5 |
| smb.server_cap.rpc_remote_apis | Boolean | RPC Remote APIs | 1.0.0 to 1.6.5 |
| smb.server_cap.unicode | Boolean | Unicode | 1.0.0 to 1.6.5 |
| smb.server_cap.unix | Boolean | UNIX | 1.0.0 to 1.6.5 |
| smb.server_date_time | Date and time | Server Date and Time | 1.0.0 to 1.6.5 |
| smb.server_date_time.smb_date | Unsigned integer, 2 bytes | Server Date | 1.0.0 to 1.6.5 |
| smb.server_date_time.smb_time | Unsigned integer, 2 bytes | Server Time | 1.0.0 to 1.6.5 |
| smb.server_fid | Unsigned integer, 4 bytes | Server FID | 1.0.0 to 1.6.5 |
| smb.server_guid | Sequence of bytes | Server GUID | 1.0.0 to 1.6.5 |
| smb.server_timezone | Signed integer, 2 bytes | Time Zone | 1.0.0 to 1.6.5 |
| smb.service | Character string | Service | 1.0.0 to 1.6.5 |
| smb.sessid | Unsigned integer, 2 bytes | Session ID | 1.0.0 to 1.6.5 |
| smb.session_key | Unsigned integer, 4 bytes | Session Key | 1.0.0 to 1.6.5 |
| smb.setup.action.guest | Boolean | Guest | 1.0.0 to 1.6.5 |
| smb.share.access.delete | Boolean | Delete | 1.0.0 to 1.6.5 |
| smb.share.access.read | Boolean | Read | 1.0.0 to 1.6.5 |
| smb.share.access.write | Boolean | Write | 1.0.0 to 1.6.5 |
| smb.share_access | Unsigned integer, 4 bytes | Share Access | 1.0.0 to 1.6.5 |
| smb.short_file | Character string | Short File Name | 1.0.0 to 1.6.5 |
| smb.short_file_name_len | Unsigned integer, 4 bytes | Short File Name Len | 1.0.0 to 1.6.5 |
| smb.signature | Sequence of bytes | Signature | 1.0.0 to 1.6.5 |
| smb.sm.mode | Boolean | Mode | 1.0.0 to 1.6.5 |
| smb.sm.password | Boolean | Password | 1.0.0 to 1.6.5 |
| smb.sm.sig_required | Boolean | Sig Req | 1.0.0 to 1.6.5 |
| smb.sm.signatures | Boolean | Signatures | 1.0.0 to 1.6.5 |
| smb.spi_loi | Unsigned integer, 2 bytes | Level of Interest | 1.0.0 to 1.6.5 |
| smb.storage_type | Unsigned integer, 4 bytes | Storage Type | 1.0.0 to 1.6.5 |
| smb.stream_name | Character string | Stream Name | 1.0.0 to 1.6.5 |
| smb.stream_name_len | Unsigned integer, 4 bytes | Stream Name Length | 1.0.0 to 1.6.5 |
| smb.stream_size | Unsigned integer, 8 bytes | Stream Size | 1.0.0 to 1.6.5 |
| smb.system.time | Date and time | System Time | 1.0.0 to 1.6.5 |
| smb.target_name | Character string | Target name | 1.0.0 to 1.6.5 |
| smb.target_name_len | Unsigned integer, 4 bytes | Target name length | 1.0.0 to 1.6.5 |
| smb.tdc | Unsigned integer, 4 bytes | Total Data Count | 1.0.0 to 1.6.5 |
| smb.tid | Unsigned integer, 2 bytes | Tree ID | 1.0.0 to 1.6.5 |
| smb.time | Time offset | Time from request | 1.0.0 to 1.6.5 |
| smb.timeout | Unsigned integer, 4 bytes | Timeout | 1.0.0 to 1.6.5 |
| smb.total_data_len | Unsigned integer, 2 bytes | Total Data Length | 1.0.0 to 1.6.5 |
| smb.tpc | Unsigned integer, 4 bytes | Total Parameter Count | 1.0.0 to 1.6.5 |
| smb.trans2.cmd | Unsigned integer, 2 bytes | Subcommand | 1.0.0 to 1.6.5 |
| smb.trans_name | Character string | Transaction Name | 1.0.0 to 1.6.5 |
| smb.transaction.flags.dtid | Boolean | Disconnect TID | 1.0.0 to 1.6.5 |
| smb.transaction.flags.owt | Boolean | One Way Transaction | 1.0.0 to 1.6.5 |
| smb.uid | Unsigned integer, 2 bytes | User ID | 1.0.0 to 1.6.5 |
| smb.unicode_password | Sequence of bytes | Unicode Password | 1.0.0 to 1.6.5 |
| smb.unicode_pwlen | Unsigned integer, 2 bytes | Unicode Password Length | 1.0.0 to 1.6.5 |
| smb.units | Unsigned integer, 2 bytes | Total Units | 1.0.0 to 1.6.5 |
| smb.unix.capability.fcntl | Boolean | FCNTL Capability | 1.0.0 to 1.6.5 |
| smb.unix.capability.posix_acl | Boolean | POSIX ACL Capability | 1.0.0 to 1.6.5 |
| smb.unix.file.atime | Date and time | Last access | 1.0.0 to 1.6.5 |
| smb.unix.file.crtime | Date and time | Creation time | 1.6.0 to 1.6.5 |
| smb.unix.file.dev_major | Unsigned integer, 8 bytes | Major device | 1.0.0 to 1.6.5 |
| smb.unix.file.dev_minor | Unsigned integer, 8 bytes | Minor device | 1.0.0 to 1.6.5 |
| smb.unix.file.file_type | Unsigned integer, 4 bytes | File type | 1.0.0 to 1.6.5 |
| smb.unix.file.gid | Unsigned integer, 8 bytes | GID | 1.0.0 to 1.6.5 |
| smb.unix.file.link_dest | Character string | Link destination | 1.0.0 to 1.6.5 |
| smb.unix.file.mtime | Date and time | Last modification | 1.0.0 to 1.6.5 |
| smb.unix.file.name | Character string | File name | 1.6.0 to 1.6.5 |
| smb.unix.file.name_length | Unsigned integer, 4 bytes | File name length | 1.6.0 to 1.6.5 |
| smb.unix.file.num_bytes | Unsigned integer, 8 bytes | Number of bytes | 1.0.0 to 1.6.5 |
| smb.unix.file.num_links | Unsigned integer, 8 bytes | Num links | 1.0.0 to 1.6.5 |
| smb.unix.file.perms | Unsigned integer, 8 bytes | File permissions | 1.0.0 to 1.6.5 |
| smb.unix.file.size | Unsigned integer, 8 bytes | File size | 1.0.0 to 1.6.5 |
| smb.unix.file.stime | Date and time | Last status change | 1.0.0 to 1.6.5 |
| smb.unix.file.uid | Unsigned integer, 8 bytes | UID | 1.0.0 to 1.6.5 |
| smb.unix.file.unique_id | Unsigned integer, 8 bytes | Unique ID | 1.0.0 to 1.6.5 |
| smb.unix.find_file.next_offset | Unsigned integer, 4 bytes | Next entry offset | 1.0.0 to 1.6.5 |
| smb.unix.find_file.resume_key | Unsigned integer, 4 bytes | Resume key | 1.0.0 to 1.6.5 |
| smb.unix.major_version | Unsigned integer, 2 bytes | Major Version | 1.0.0 to 1.6.5 |
| smb.unix.minor_version | Unsigned integer, 2 bytes | Minor Version | 1.0.0 to 1.6.5 |
| smb.unix_info2.file.flags | Unsigned integer, 4 bytes | Flags | 1.6.0 to 1.6.5 |
| smb.unix_info2.file.flags.append_only | Boolean | Append-only | 1.6.0 to 1.6.5 |
| smb.unix_info2.file.flags.do_not_backup | Boolean | Do not backup | 1.6.0 to 1.6.5 |
| smb.unix_info2.file.flags.enable_undelete | Boolean | Enable undelete | 1.6.0 to 1.6.5 |
| smb.unix_info2.file.flags.hidden | Boolean | Hidden | 1.6.0 to 1.6.5 |
| smb.unix_info2.file.flags.immutable | Boolean | Immutable | 1.6.0 to 1.6.5 |
| smb.unix_info2.file.flags.no_update_atime | Boolean | Don't update atime | 1.6.0 to 1.6.5 |
| smb.unix_info2.file.flags.secure_delete | Boolean | Secure delete | 1.6.0 to 1.6.5 |
| smb.unix_info2.file.flags.synchronous | Boolean | Synchronous | 1.6.0 to 1.6.5 |
| smb.unix_info2.file.flags_mask | Unsigned integer, 4 bytes | Flags mask | 1.6.0 to 1.6.5 |
| smb.unknown | Sequence of bytes | Unknown Data | 1.0.0 to 1.2.18 |
| smb.unknown_data | Sequence of bytes | Unknown Data | 1.4.0 to 1.6.5 |
| smb.unknown_field | Unsigned integer, 4 bytes | Unknown field | 1.4.0 to 1.6.5 |
| smb.vc | Unsigned integer, 2 bytes | VC Number | 1.0.0 to 1.6.5 |
| smb.volume.label | Character string | Label | 1.0.0 to 1.6.5 |
| smb.volume.label.len | Unsigned integer, 4 bytes | Label Length | 1.0.0 to 1.6.5 |
| smb.volume.serial | Unsigned integer, 4 bytes | Volume Serial Number | 1.0.0 to 1.6.5 |
| smb.wct | Unsigned integer, 1 byte | Word Count (WCT) | 1.0.0 to 1.6.5 |
| smb.write.mode.connectionless | Boolean | Connectionless | 1.0.0 to 1.6.5 |
| smb.write.mode.message_start | Boolean | Message Start | 1.0.0 to 1.6.5 |
| smb.write.mode.raw | Boolean | Write Raw | 1.0.0 to 1.6.5 |
| smb.write.mode.return_remaining | Boolean | Return Remaining | 1.0.0 to 1.6.5 |
| smb.write.mode.write_through | Boolean | Write Through | 1.0.0 to 1.6.5 |