18.104.22.168 SMB_COM_NT_TRANSACT (0xA0)
This command was introduced in the NT LAN Manager dialect.
SMB_COM_NT_TRANSACT subcommands extend the file system feature access offered by SMB_COM_TRANSACTION2 (section 22.214.171.124), and also allow for the transfer of very large parameter and data blocks.
SMB_COM_NT_TRANSACT messages MAY exceed the maximum size of a single SMB message (as determined by the value of the MaxBufferSize session parameter). In this case, the client will use one or more SMB_COM_NT_TRANSACT_SECONDARY messages to transfer transaction Data and Parameter bytes that did not fit in the initial message.
The client indicates that it has not sent all of the Data bytes by setting DataCount to a value less than TotalDataCount. Similarly, if ParameterCount is less than TotalParameterCount, then the client has more Parameter bytes to send. Parameter bytes SHOULD be sent before Data bytes, and clients SHOULD attempt to send as many bytes as possible in each message. Servers SHOULD be prepared, however, to accept Parameters and Data in any order, in large or small amounts.
For both the request and the response, the positions and lengths of the SMB_Data.NT_Trans_Parameters and SMB_Data.NT_Trans_Data fields are determined by the values of the SMB_Parameters.ParameterOffset, SMB_Parameters.ParameterCount, SMB_Parameters.DataOffset, and SMB_Parameters.DataCount fields. In addition, the SMB_Parameters.ParameterDisplacement and SMB_Parameters.DataDisplacement fields MAY be used to change the order in which subranges of bytes are transferred. Servers SHOULD transfer bytes in order and give precedence to SMB_Data.NT_Trans_Parameters bytes. Clients SHOULD be prepared to reconstruct transaction SMB_Data.NT_Trans_Parameters and SMB_Data.NT_Trans_Data, regardless of the order or locations in which they are delivered.