Wireshark · Smb2-protocol: [Smb2-protocol] infolevels

[ronnie sahlberg <ronniesahlberg@xxxxxxxxx>]

I have updated the wiki with the obvious infolevels for get/setinfo

I have updated ethereal also but not yet added decode of info level 0x0f for extended attributes.


For the Find command   
I think that those two bytes that are Class/Level in GetInfo are just random uninitialized data in Find.
I have seen several Find commands with different values there but they always return the same structure.


In the InfoLevel scan :
I think there are several more infolevels not yet returned.
Looking at the response codes there are three different status codes returned for stuff the server does not understand.
class :0 and 3 always return INVALID_PARAMETER
class 1 and 2 sometimes also return NOT_SUPPORTED or INVALID_INFO_CLASS
Maybe there are some levels here that actually do exist   but the call fails due to
1,  being used on the wrong kind of object
2, not having the proper parameters specified in the 16 byte blob just
prior to the FID which appears to be class/level specific parameters?


Question:   the opcode named Break    i assume this is a pdu sent for an oplock break.
Could this not just be the "Lock" command  and alsu used to lock/unlock files
just as LockingAndX is used both for locking/unlocking but also breaking oplocks ?