Wireshark · Smb2-protocol: Re: [Smb2-protocol] Re: Break response

["Stefan (metze) Metzmacher" <metze@xxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

ronnie sahlberg schrieb:
> Checked in with minor changes
> 
> there are 6 unknown bytes between the buffercode and the fid  not 4.
> (dissection till worked with 4 since it will auto align the fid to be
> on a 32bit boundary)

ah, ok, actually the fid is aligned to a 64bit boundary
and because of this, it would be also possible that all 6 bytes are
padding, but I'm not sure about this...

> shouldnt there be a flag or something in there as well that indicated
> whether the oplock is broken   or merely just being downgraded to a
> level 2 oplock ?

maybe, but we didn't know this details yet...

> I will update the wiki for the break command.
> Can i have your permission to upload the capture file to the wiki?

yep:-)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFENOH4m70gjA5TCD8RApv1AKC1yaBjr3LXTbQduK3Bl+oUpZclBACgwVap
/INboF4jKQGAT76ecrnykDU=
=unxT
-----END PGP SIGNATURE-----