Wireshark · Smb2-protocol: [Smb2-protocol] opcode 0x0b

[ronnie sahlberg <ronniesahlberg@xxxxxxxxx>]

opcode 0x0b is not a secondary treedissconnect    i dont even think it is associated with shares at all.

it appears that this function can be used on shares   but it can be used on other things as well.


It takes bytes 8-23   a FID
and also a name further down in the packet.


in the trace dir-then-open...

there are a lot of these calls   and successful replies.
Look at 1455/1456   the reply contains things like the strings "BUILTIN"
A SID in text form  and a fe account names.