Wireshark · Smb2-protocol: [Smb2-protocol] negotiate protocol request

["ronnie sahlberg" <ronniesahlberg@xxxxxxxxx>]

the first two bytes after the buffer code in negotiate protocol
requests   seems to always use the value 0x01 0x00

this might be the version field that the client tries to negotiate.

i.e.  request smb2 version 1  (or earlier)

or it could be "i offer a list of 1 choices of dialects to use)
and then one of the 0 bytes in the rest of the pdu represents  version
0 of smb2.
but if it were a list of choices then i would have assumed that list
would be sent in the dynamic part of the response  and that would have
required the dynamic flag in the buffer code to be set?


i guess we have to wait until they add another, newer dialect of smb2
before we can tell conclusively.