Wireshark · Smb2-protocol: Re: [Smb2-protocol] extended attributes

[tridge@xxxxxxxxx]

Ronnie,

 > i have checked in to ethereal svn a change that implements decoding of
 > class:0x01 level:0x0f   Extended Attributes.
 > 
 > The structure is similar to but different to the similar construct in smb.

There are two EA list structures used in SMB, which Samba4 calls the
'chained' and 'non-chained' formats. The SMB2 protocol uses the
chained format.

The 'chained' format is also used in the old 'NTTRANS-Create' call,
which takes an optional ea-list in chained format. (this call also
takes an optional security descriptor).

see libcli/raw/raweas.c for code which parses the two formats. In
particular see ea_pull_list_chained().

Cheers, Tridge