Wireshark · Smb2-protocol: [Smb2-protocol] Re: a first look at SMB2

[ronnie sahlberg <ronniesahlberg@xxxxxxxxx>]

On 11/25/05, tridge@xxxxxxxxx > We've also implemented all of the
above in libcli/smb2/ except for
> cancel, notify, break and lock.

I then assume you have discovered what the 4 bytes prior to the FID in
Transaction request is?

I belive this is a field that details what kind of transaction is used
and it is only dce/rpc if these four bytes are 17.c0.11.00 .
Can you verify if dcerpc breaks if you use a different value using your client?


Also for Notify I have guessed what most of the fields are.


Please see the Discussion section for SMB2/Transaction and SMB2/Notify
on the wiki where i have put the current guesswork