Wireshark · Wireshark-users: Re: [Wireshark-users] SMB Trans2 FILE_QUERY_INFO Query File Standard Info - what's going on?

[Guy Harris <guy@xxxxxxxxxxxx>]

Surlow, Jim wrote:

> Regarding #1 � Am guessing that the files were written on the unix end 
> and when read from the Windows side it just keeps searching for a Ctrl-Z 
> EOF rather than Ctrl-D EOF,

...which would be a bit bizarre given that both Windows and UN*X have a 
"the file is this many bytes long" EOF - i.e., the file system stores 
the length of the file, in bytes, as one of the file's properties.

There are no actual ^D's stored as end-of-file padding in UN*X files to 
pad the file out to a disk block or file system block boundary 
(control-D is handled by the tty driver, which treats it as an 
indication that, when running in cooked mode, a "line" should be 
constructed that contains everything typed since the last line but *not* 
including the ^D, so if you've typed nothing on the line, that looks 
like a zero-length line, and a read returning a byte count of 0 is 
generally treated as an end-of-file indication), and, unless you have a 
very crufty old application, I would hope that there are no actual ^Z's 
stored as end-of-file padding in Windows files to pad the file out to a 
disk block or file system block boundary.