Ronnie,
> > I've worked out what the 16 bytes between the access_mask and filename
> > are in the all_info2 level for SMB2. The first 8 bytes are the
> > position (as set by the POSITION_INFORMATION level) and the 2nd 8
> > bytes are the mode (as set by the MODE_INFORMATION level).
>
>
> Neither me nor ethereal knows those levels.
>
> Can you point me to which file in samba you implement these levels and
> i will update the wiki and ethereal with dissection both for SMB and
> SMB2
sure. Full list of levels for trans2 are in:
http://samba.org/ftp/unpacked/samba4/source/include/trans2.h
structure definitions of all those levels is in:
http://samba.org/ftp/unpacked/samba4/source/include/smb_interfaces.h
parsing code for all the queryfileinfo levels is in:
http://samba.org/ftp/unpacked/samba4/source/libcli/raw/rawfileinfo.c
parsing code for all the setfileinfo levels is in:
http://samba.org/ftp/unpacked/samba4/source/libcli/raw/rawsetfileinfo.c
parsing code for all the queryfsinfo levels is in:
http://samba.org/ftp/unpacked/samba4/source/libcli/raw/rawfsinfo.c
pasrsing code for all the EA related blobs is in:
http://samba.org/ftp/unpacked/samba4/source/libcli/raw/raweas.c
Also see
http://wiki.ethereal.com/SMB?action=AttachFile&do=get&target=smbtorture.cap.gz
for a (large) capture I've just uploaded that gives you examples of
all the levels that Samba4 knows about, as well as examples of a wide
range of other SMB stuff.
Cheers, Tridge
