Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.
Wireshark logo

Smb2-protocol: [Smb2-protocol] Notify

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: ronnie sahlberg <ronniesahlberg@xxxxxxxxx>
Date: Sat, 26 Nov 2005 00:15:36 +0000
The first 4 bytes after the FID in Notify request looks like it is the
completion filter.

I see both 0x03 and 0x17 here which would be normal values to see for
a standard directory watch.

0x03:   watch filename, directoryname
0x17:   watch fileanme,dirname,attributes,lastwrite


looks the same as for Notify in SMB
Wireshark logo footer

© Wireshark Foundation · Privacy Policy

Facebook·Mastodon·Twitter·YouTube