Wireshark · Smb2-protocol: [Smb2-protocol] Re: Break response

["ronnie sahlberg" <ronniesahlberg@xxxxxxxxx>]

Checked in with minor changes

there are 6 unknown bytes between the buffercode and the fid  not 4.
(dissection till worked with 4 since it will auto align the fid to be
on a 32bit boundary)

i also marked commandsequencenumber == -1   in the header as
"(unsolicited response)"


--

shouldnt there be a flag or something in there as well that indicated
whether the oplock is broken   or merely just being downgraded to a
level 2 oplock ?


I will update the wiki for the break command.
Can i have your permission to upload the capture file to the wiki?


On 4/5/06, Stefan (metze) Metzmacher <metze@xxxxxxxxx> wrote:
> Hi Ronnie,
>
> can you apply this patch please,
> it adds dissecting of Oplock Breaks.
>
> thanks!
>
>