8 Index
A
Abstract data model
global (section 3.1.1.1, section 3.2.1.1)
overview (section 3.1.1, section 3.2.1)
RPC
overview (section 3.1.1, section 3.4.1)
SMB
unique
global (section 3.1.1.1, section 3.3.1.1)
overview (section 3.1.1, section 3.3.1)
RPC
overview (section 3.1.1, section 3.5.1)
SMB
unique
C
Client
global (section 3.1.1.1, section 3.2.1.1)
overview (section 3.1.1, section 3.2.1)
SMB
unique
higher-layer triggered events
cryptographic session key - querying
device
DFS
directory
file
attributes
named pipe
querying
reading (section 3.2.4.14, section 3.2.4.37)
writing (section 3.2.4.15, section 3.2.4.38)
number of opens on tree connect
operations - canceling pending
security descriptors
sending any message (section 3.1.4.1, section 3.2.4.1)
transport layer connection - testing
tree disconnect (unmount share)
initialization (section 3.1.3, section 3.2.3)
local events
message processing
algorithms for challenge/response authentication
OpLock
receiving any message (section 3.1.5.1, section 3.2.5.1)
SMB_COM_CREATE_TEMPORARY response
SMB_COM_LOCK_AND_READ response
SMB_COM_NT_CREATE_ANDX response
SMB_COM_NT_TRANSACT subcommand response
SMB_COM_OPEN_PRINT_FILE response
SMB_COM_QUERY_INFORMATION response
SMB_COM_QUERY_INFORMATION_DISK response
SMB_COM_QUERY_INFORMATION2 response
SMB_COM_SESSION_SETUP_ANDX response
SMB_COM_TRANSACTION subcommand response
SMB_COM_TRANSACTION2 subcommand response
SMB_COM_TREE_CONNECT_ANDX response
SMB_COM_TREE_DISCONNECT response
SMB_COM_WRITE_AND_CLOSE response
SMB_COM_WRITE_AND_UNLOCK response
RPC
abstract data model
overview (section 3.1.1, section 3.4.1)
higher-layer triggered events
extended DFS referral capability - querying
named pipe
session
initialization (section 3.1.3, section 3.4.3)
local events (section 3.1.7, section 3.4.7)
message processing
algorithms for challenge/response authentication
sequencing rules
algorithms for challenge/response authentication
timer events (section 3.1.6, section 3.4.6)
timers (section 3.1.2, section 3.4.2)
sequencing rules
algorithms for challenge/response authentication
OpLock
receiving any message (section 3.1.5.1, section 3.2.5.1)
SMB_COM_CREATE_TEMPORARY response
SMB_COM_LOCK_AND_READ response
SMB_COM_NT_CREATE_ANDX response
SMB_COM_NT_TRANSACT subcommand response
SMB_COM_OPEN_PRINT_FILE response
SMB_COM_QUERY_INFORMATION response
SMB_COM_QUERY_INFORMATION_DISK response
SMB_COM_QUERY_INFORMATION2 response
SMB_COM_SESSION_SETUP_ANDX response
SMB_COM_TRANSACTION subcommand response
SMB_COM_TRANSACTION2 subcommand response
SMB_COM_TREE_CONNECT_ANDX response
SMB_COM_TREE_DISCONNECT response
SMB_COM_WRITE_AND_CLOSE response
SMB_COM_WRITE_AND_UNLOCK response
timer events
timers
Codes
Commands - SMB
SMB_COM_CHECK_DIRECTORY (0x10)
SMB_COM_CLOSE_AND_TREE_DISC (0x31)
SMB_COM_CLOSE_PRINT_FILE (0xC2)
SMB_COM_CREATE_DIRECTORY (0x00)
SMB_COM_CREATE_TEMPORARY (0x0E)
SMB_COM_DELETE_DIRECTORY (0x01)
SMB_COM_FIND_NOTIFY_CLOSE (0x35)
SMB_COM_GET_PRINT_QUEUE (0xC3)
SMB_COM_IOCTL_SECONDARY (0x28)
SMB_COM_LOCK_BYTE_RANGE (0x0C)
SMB_COM_NO_ANDX_COMMAND (0xFF)
SMB_COM_NT_TRANSACT_SECONDARY (0xA1)
SMB_COM_OPEN_PRINT_FILE (0xC0)
SMB_COM_QUERY_INFORMATION (0x08)
SMB_COM_QUERY_INFORMATION_DISK (0x80)
SMB_COM_QUERY_INFORMATION2 (0x23)
SMB_COM_READ_MPX_SECONDARY (0x1C)
SMB_COM_SECURITY_PACKAGE_ANDX (0x7E)
SMB_COM_SESSION_SETUP_ANDX (0x73)
SMB_COM_SET_INFORMATION (0x09)
SMB_COM_SET_INFORMATION2 (0x22)
SMB_COM_TRANSACTION_SECONDARY (0x26)
SMB_COM_TRANSACTION2_SECONDARY (0x33)
SMB_COM_TREE_CONNECT_ANDX (0x75)
SMB_COM_TREE_DISCONNECT (0x71)
SMB_COM_UNLOCK_BYTE_RANGE (0x0D)
SMB_COM_WRITE_AND_CLOSE (0x2C)
SMB_COM_WRITE_AND_UNLOCK (0x14)
SMB_COM_WRITE_BULK_DATA (0xDA)
SMB_COM_WRITE_MPX_SECONDARY (0x1F)
SMB_COM_WRITE_PRINT_FILE (0xC1)
Copy file
D
Data model - abstract
global (section 3.1.1.1, section 3.2.1.1)
overview (section 3.1.1, section 3.2.1)
RPC
overview (section 3.1.1, section 3.4.1)
SMB
unique
global (section 3.1.1.1, section 3.3.1.1)
overview (section 3.1.1, section 3.3.1)
RPC
overview (section 3.1.1, section 3.5.1)
SMB
unique
Data types
E
Events
local
client
RPC (section 3.1.7, section 3.4.7)
server
handling
RPC (section 3.1.7, section 3.5.7)
timer
client
RPC (section 3.1.6, section 3.4.6)
server
RPC (section 3.1.6, section 3.5.6)
Examples
copy file
F
G
H
Higher-layer triggered events
client
cryptographic session key - querying
device
DFS
directory
file
attributes
named pipe
querying
reading (section 3.2.4.14, section 3.2.4.37)
writing (section 3.2.4.15, section 3.2.4.38)
number of opens on tree connect
operations - canceling pending
RPC
extended DFS referral capability - querying
named pipe
session
security descriptors
sending any message (section 3.1.4.1, section 3.2.4.1)
transport layer connection - testing
tree disconnect (unmount share)
server
client session
DFS subsystem
open
RPC
named pipe
sending any message (section 3.1.4.1, section 3.3.4.1)
session
share
I
Implementer - security considerations
Information level
Initialization
overview (section 3.1.3, section 3.2.3)
RPC (section 3.1.3, section 3.4.3)
overview (section 3.1.3, section 3.3.3)
RPC (section 3.1.3, section 3.5.3)
Interim_Server_Response packet
L
Local events
client
RPC (section 3.1.7, section 3.4.7)
server
handling
RPC (section 3.1.7, section 3.5.7)
M
Message processing
client
algorithms for challenge/response authentication
OpLock
receiving any message (section 3.1.5.1, section 3.2.5.1)
RPC
algorithms for challenge/response authentication
SMB_COM_CREATE_TEMPORARY response
SMB_COM_LOCK_AND_READ response
SMB_COM_NT_CREATE_ANDX response
SMB_COM_NT_TRANSACT subcommand response
SMB_COM_OPEN_PRINT_FILE response
SMB_COM_QUERY_INFORMATION response
SMB_COM_QUERY_INFORMATION_DISK response
SMB_COM_QUERY_INFORMATION2 response
SMB_COM_SESSION_SETUP_ANDX response
SMB_COM_TRANSACTION subcommand response
SMB_COM_TRANSACTION2 subcommand response
SMB_COM_TREE_CONNECT_ANDX response
SMB_COM_TREE_DISCONNECT response
SMB_COM_WRITE_AND_CLOSE response
SMB_COM_WRITE_AND_UNLOCK response
server
algorithms for challenge/response authentication
receiving any message (section 3.1.5.1, section 3.3.5.2)
RPC
algorithms for challenge/response authentication
SMB_COM_CHECK_DIRECTORY request
SMB_COM_CLOSE_PRINT_FILE request
SMB_COM_CREATE_DIRECTORY request
SMB_COM_CREATE_TEMPORARY request
SMB_COM_DELETE_DIRECTORY request
SMB_COM_LOCK_BYTE_RANGE request
SMB_COM_NT_CREATE_ANDX request
SMB_COM_NT_TRANSACT subcommand request
SMB_COM_OPEN_PRINT_FILE request
SMB_COM_QUERY_INFORMATION request
SMB_COM_QUERY_INFORMATION_DISK request
SMB_COM_QUERY_INFORMATION2 request
SMB_COM_SESSION_SETUP_ANDX request
SMB_COM_SET_INFORMATION request
SMB_COM_SET_INFORMATION2 request
SMB_COM_TRANSACTION subcommand request
SMB_COM_TRANSACTION2 subcommand request
SMB_COM_TREE_CONNECT_ANDX request
SMB_COM_TREE_DISCONNECT request
SMB_COM_UNLOCK_BYTE_RANGE request
SMB_COM_WRITE_AND_CLOSE request
SMB_COM_WRITE_AND_UNLOCK request
SMB_COM_WRITE_PRINT_FILE request
Messages
information level
NT Transact subcommands
NT_TRANSACT_NOTIFY_CHANGE (0x0004)
NT_TRANSACT_QUERY_SECURITY_DESC (0x0006)
NT_TRANSACT_SET_SECURITY_DESC (0x0003)
SMB
commands
SMB_COM_CHECK_DIRECTORY (0x10)
SMB_COM_CLOSE_AND_TREE_DISC (0x31)
SMB_COM_CLOSE_PRINT_FILE (0xC2)
SMB_COM_CREATE_DIRECTORY (0x00)
SMB_COM_CREATE_TEMPORARY (0x0E)
SMB_COM_DELETE_DIRECTORY (0x01)
SMB_COM_FIND_NOTIFY_CLOSE (0x35)
SMB_COM_GET_PRINT_QUEUE (0xC3)
SMB_COM_IOCTL_SECONDARY (0x28)
SMB_COM_LOCK_BYTE_RANGE (0x0C)
SMB_COM_NO_ANDX_COMMAND (0xFF)
SMB_COM_NT_TRANSACT_SECONDARY (0xA1)
SMB_COM_OPEN_PRINT_FILE (0xC0)
SMB_COM_QUERY_INFORMATION (0x08)
SMB_COM_QUERY_INFORMATION_DISK (0x80)
SMB_COM_QUERY_INFORMATION2 (0x23)
SMB_COM_READ_MPX_SECONDARY (0x1C)
SMB_COM_SECURITY_PACKAGE_ANDX (0x7E)
SMB_COM_SESSION_SETUP_ANDX (0x73)
SMB_COM_SET_INFORMATION (0x09)
SMB_COM_SET_INFORMATION2 (0x22)
SMB_COM_TRANSACTION_SECONDARY (0x26)
SMB_COM_TRANSACTION2_SECONDARY (0x33)
SMB_COM_TREE_CONNECT_ANDX (0x75)
SMB_COM_TREE_DISCONNECT (0x71)
SMB_COM_UNLOCK_BYTE_RANGE (0x0D)
SMB_COM_WRITE_AND_CLOSE (0x2C)
SMB_COM_WRITE_AND_UNLOCK (0x14)
SMB_COM_WRITE_BULK_DATA (0xDA)
SMB_COM_WRITE_MPX_SECONDARY (0x1F)
SMB_COM_WRITE_PRINT_FILE (0xC1)
structure
batched messages ("AndX" messages)
TRANS_QUERY_NMPIPE_INFO (0x0022)
TRANS_QUERY_NMPIPE_STATE (0x0021)
TRANS_RAW_READ_NMPIPE (0x0011)
TRANS_RAW_WRITE_NMPIPE (0x0031)
TRANS_SET_NMPIPE_STATE (0x0001)
TRANS_TRANSACT_NMPIPE (0x0026)
Transaction2 subcommands
TRANS2_CREATE_DIRECTORY (0x000D)
TRANS2_FIND_NOTIFY_FIRST (0x000B)
TRANS2_FIND_NOTIFY_NEXT (0x000C)
TRANS2_GET_DFS_REFERRAL (0x0010)
TRANS2_QUERY_FILE_INFORMATION (0x0007)
TRANS2_QUERY_FS_INFORMATION (0x0003)
TRANS2_QUERY_PATH_INFORMATION (0x0005)
TRANS2_REPORT_DFS_INCONSISTENCY (0x0011)
TRANS2_SET_FILE_INFORMATION (0x0008)
TRANS2_SET_FS_INFORMATION (0x0004)
TRANS2_SET_PATH_INFORMATION (0x0006)
NetBIOS
over
NetBIOS-based transports
N
Negotiate and tree connect example
NetBIOS
over
NetBIOS-based transports
NT Transact subcommands
NT_TRANSACT_NOTIFY_CHANGE (0x0004)
NT_TRANSACT_QUERY_SECURITY_DESC (0x0006)
NT_TRANSACT_SET_SECURITY_DESC (0x0003)
O
P
R
Relationship to other protocols
Request packet (section 2.2.4.2.1, section 2.2.4.3.1, section 2.2.4.4.1, section 2.2.4.5.1, section 2.2.4.6.1, section 2.2.4.7.1, section 2.2.4.8.1, section 2.2.4.9.1, section 2.2.4.10.1, section 2.2.4.11.1, section 2.2.4.12.1, section 2.2.4.13.1, section 2.2.4.14.1, section 2.2.4.15.1, section 2.2.4.16.1, section 2.2.4.17.1, section 2.2.4.18.1, section 2.2.4.19.1, section 2.2.4.20.1, section 2.2.4.21.1, section 2.2.4.22.1, section 2.2.4.23.1, section 2.2.4.25.1, section 2.2.4.26.1, section 2.2.4.30.1, section 2.2.4.31.1, section 2.2.4.32.1, section 2.2.4.33.1, section 2.2.4.34.1, section 2.2.4.35.1, section 2.2.4.39.1, section 2.2.4.40.1, section 2.2.4.41.1, section 2.2.4.42.1, section 2.2.4.43.1, section 2.2.4.46.1, section 2.2.4.47.1, section 2.2.4.48.1, section 2.2.4.50.1, section 2.2.4.51.1, section 2.2.4.52.1, section 2.2.4.53.1, section 2.2.4.54.1, section 2.2.4.55.1, section 2.2.4.57.1, section 2.2.4.58.1, section 2.2.4.59.1, section 2.2.4.60.1, section 2.2.4.61.1, section 2.2.4.62.1, section 2.2.4.63.1, section 2.2.4.64.1, section 2.2.4.65.1, section 2.2.4.66.1, section 2.2.4.67.1, section 2.2.4.68.1, section 2.2.4.69.1, section 2.2.5.1.1, section 2.2.5.4.1, section 2.2.5.6.1, section 2.2.5.7.1, section 2.2.5.9.1, section 2.2.5.11.1, section 2.2.6.8.1, section 2.2.6.9.1, section 2.2.7.1.1, section 2.2.7.2.1, section 2.2.7.3.1, section 2.2.7.4.1, section 2.2.7.6.1)
Response packet (section 2.2.4.2.2, section 2.2.4.3.2, section 2.2.4.4.2, section 2.2.4.5.2, section 2.2.4.6.2, section 2.2.4.7.2, section 2.2.4.8.2, section 2.2.4.9.2, section 2.2.4.10.2, section 2.2.4.11.2, section 2.2.4.12.2, section 2.2.4.13.2, section 2.2.4.14.2, section 2.2.4.15.2, section 2.2.4.16.2, section 2.2.4.17.2, section 2.2.4.18.2, section 2.2.4.19.2, section 2.2.4.20.2, section 2.2.4.21.2, section 2.2.4.23.2, section 2.2.4.26.2, section 2.2.4.30.2, section 2.2.4.31.2, section 2.2.4.32.2, section 2.2.4.33.2, section 2.2.4.35.2, section 2.2.4.39.2, section 2.2.4.40.2, section 2.2.4.41.2, section 2.2.4.42.2, section 2.2.4.43.2, section 2.2.4.46.2, section 2.2.4.48.2, section 2.2.4.50.2, section 2.2.4.51.2, section 2.2.4.52.2, section 2.2.4.53.2, section 2.2.4.54.2, section 2.2.4.55.2, section 2.2.4.57.2, section 2.2.4.58.2, section 2.2.4.59.2, section 2.2.4.60.2, section 2.2.4.61.2, section 2.2.4.62.2, section 2.2.4.64.2, section 2.2.4.66.2, section 2.2.4.67.2, section 2.2.4.68.2, section 2.2.4.69.2, section 2.2.5.2.2, section 2.2.5.3.2, section 2.2.5.4.2, section 2.2.5.5.2, section 2.2.5.6.2, section 2.2.5.7.2, section 2.2.5.8.2, section 2.2.5.9.2, section 2.2.5.11.2, section 2.2.6.3.2, section 2.2.6.7.2, section 2.2.6.9.2, section 2.2.6.14.2, section 2.2.7.1.2, section 2.2.7.2.2, section 2.2.7.4.2, section 2.2.7.6.2)
S
Security
Sequencing rules
client
algorithms for challenge/response authentication
OpLock
receiving any message (section 3.1.5.1, section 3.2.5.1)
RPC
algorithms for challenge/response authentication
SMB_COM_CREATE_TEMPORARY response
SMB_COM_LOCK_AND_READ response
SMB_COM_NT_CREATE_ANDX response
SMB_COM_NT_TRANSACT subcommand response
SMB_COM_OPEN_PRINT_FILE response
SMB_COM_QUERY_INFORMATION response
SMB_COM_QUERY_INFORMATION_DISK response
SMB_COM_QUERY_INFORMATION2 response
SMB_COM_SESSION_SETUP_ANDX response
SMB_COM_TRANSACTION subcommand response
SMB_COM_TRANSACTION2 subcommand response
SMB_COM_TREE_CONNECT_ANDX response
SMB_COM_TREE_DISCONNECT response
SMB_COM_WRITE_AND_CLOSE response
SMB_COM_WRITE_AND_UNLOCK response
server
algorithms for challenge/response authentication
receiving any message (section 3.1.5.1, section 3.3.5.2)
RPC
algorithms for challenge/response authentication
SMB_COM_CHECK_DIRECTORY request
SMB_COM_CLOSE_PRINT_FILE request
SMB_COM_CREATE_DIRECTORY request
SMB_COM_CREATE_TEMPORARY request
SMB_COM_DELETE_DIRECTORY request
SMB_COM_LOCK_BYTE_RANGE request
SMB_COM_NT_CREATE_ANDX request
SMB_COM_NT_TRANSACT subcommand request
SMB_COM_OPEN_PRINT_FILE request
SMB_COM_QUERY_INFORMATION request
SMB_COM_QUERY_INFORMATION_DISK request
SMB_COM_QUERY_INFORMATION2 request
SMB_COM_SESSION_SETUP_ANDX request
SMB_COM_SET_INFORMATION request
SMB_COM_SET_INFORMATION2 request
SMB_COM_TRANSACTION subcommand request
SMB_COM_TRANSACTION2 subcommand request
SMB_COM_TREE_CONNECT_ANDX request
SMB_COM_TREE_DISCONNECT request
SMB_COM_UNLOCK_BYTE_RANGE request
SMB_COM_WRITE_AND_CLOSE request
SMB_COM_WRITE_AND_UNLOCK request
SMB_COM_WRITE_PRINT_FILE request
Server
global (section 3.1.1.1, section 3.3.1.1)
overview (section 3.1.1, section 3.3.1)
SMB
unique
higher-layer triggered events
client session
DFS subsystem
open
sending any message (section 3.1.4.1, section 3.3.4.1)
session
share
initialization (section 3.1.3, section 3.3.3)
local events
handling
message processing
algorithms for challenge/response authentication
receiving any message (section 3.1.5.1, section 3.3.5.2)
SMB_COM_CHECK_DIRECTORY request
SMB_COM_CLOSE_PRINT_FILE request
SMB_COM_CREATE_DIRECTORY request
SMB_COM_CREATE_TEMPORARY request
SMB_COM_DELETE_DIRECTORY request
SMB_COM_LOCK_BYTE_RANGE request
SMB_COM_NT_CREATE_ANDX request
SMB_COM_NT_TRANSACT subcommand request
SMB_COM_OPEN_PRINT_FILE request
SMB_COM_QUERY_INFORMATION request
SMB_COM_QUERY_INFORMATION_DISK request
SMB_COM_QUERY_INFORMATION2 request
SMB_COM_SESSION_SETUP_ANDX request
SMB_COM_SET_INFORMATION request
SMB_COM_SET_INFORMATION2 request
SMB_COM_TRANSACTION subcommand request
SMB_COM_TRANSACTION2 subcommand request
SMB_COM_TREE_CONNECT_ANDX request
SMB_COM_TREE_DISCONNECT request
SMB_COM_UNLOCK_BYTE_RANGE request
SMB_COM_WRITE_AND_CLOSE request
SMB_COM_WRITE_AND_UNLOCK request
SMB_COM_WRITE_PRINT_FILE request
RPC
abstract data model
overview (section 3.1.1, section 3.5.1)
higher-layer triggered events
named pipe
initialization (section 3.1.3, section 3.5.3)
local events (section 3.1.7, section 3.5.7)
message processing
algorithms for challenge/response authentication
sequencing rules
algorithms for challenge/response authentication
timer events (section 3.1.6, section 3.5.6)
timers (section 3.1.2, section 3.5.2)
sequencing rules
algorithms for challenge/response authentication
receiving any message (section 3.1.5.1, section 3.3.5.2)
SMB_COM_CHECK_DIRECTORY request
SMB_COM_CLOSE_PRINT_FILE request
SMB_COM_CREATE_DIRECTORY request
SMB_COM_CREATE_TEMPORARY request
SMB_COM_DELETE_DIRECTORY request
SMB_COM_LOCK_BYTE_RANGE request
SMB_COM_NT_CREATE_ANDX request
SMB_COM_NT_TRANSACT subcommand request
SMB_COM_OPEN_PRINT_FILE request
SMB_COM_QUERY_INFORMATION request
SMB_COM_QUERY_INFORMATION_DISK request
SMB_COM_QUERY_INFORMATION2 request
SMB_COM_SESSION_SETUP_ANDX request
SMB_COM_SET_INFORMATION request
SMB_COM_SET_INFORMATION2 request
SMB_COM_TRANSACTION subcommand request
SMB_COM_TRANSACTION2 subcommand request
SMB_COM_TREE_CONNECT_ANDX request
SMB_COM_TREE_DISCONNECT request
SMB_COM_UNLOCK_BYTE_RANGE request
SMB_COM_WRITE_AND_CLOSE request
SMB_COM_WRITE_AND_UNLOCK request
SMB_COM_WRITE_PRINT_FILE request
timer events
SMB commands
SMB_COM_CHECK_DIRECTORY (0x10)
SMB_COM_CLOSE_AND_TREE_DISC (0x31)
SMB_COM_CLOSE_PRINT_FILE (0xC2)
SMB_COM_CREATE_DIRECTORY (0x00)
SMB_COM_CREATE_TEMPORARY (0x0E)
SMB_COM_DELETE_DIRECTORY (0x01)
SMB_COM_FIND_NOTIFY_CLOSE (0x35)
SMB_COM_GET_PRINT_QUEUE (0xC3)
SMB_COM_IOCTL_SECONDARY (0x28)
SMB_COM_LOCK_BYTE_RANGE (0x0C)
SMB_COM_NO_ANDX_COMMAND (0xFF)
SMB_COM_NT_TRANSACT_SECONDARY (0xA1)
SMB_COM_OPEN_PRINT_FILE (0xC0)
SMB_COM_QUERY_INFORMATION (0x08)
SMB_COM_QUERY_INFORMATION_DISK (0x80)
SMB_COM_QUERY_INFORMATION2 (0x23)
SMB_COM_READ_MPX_SECONDARY (0x1C)
SMB_COM_SECURITY_PACKAGE_ANDX (0x7E)
SMB_COM_SESSION_SETUP_ANDX (0x73)
SMB_COM_SET_INFORMATION (0x09)
SMB_COM_SET_INFORMATION2 (0x22)
SMB_COM_TRANSACTION_SECONDARY (0x26)
SMB_COM_TRANSACTION2_SECONDARY (0x33)
SMB_COM_TREE_CONNECT_ANDX (0x75)
SMB_COM_TREE_DISCONNECT (0x71)
SMB_COM_UNLOCK_BYTE_RANGE (0x0D)
SMB_COM_WRITE_AND_CLOSE (0x2C)
SMB_COM_WRITE_AND_UNLOCK (0x14)
SMB_COM_WRITE_BULK_DATA (0xDA)
SMB_COM_WRITE_MPX_SECONDARY (0x1F)
SMB_COM_WRITE_PRINT_FILE (0xC1)
SMB message structure
batched messages ("AndX" messages)
SMB_COM_CREATE_DIRECTORY_REQUEST packet
SMB_COM_CREATE_DIRECTORY_RESPONSE packet
SMB_FIND_FILE_BOTH_DIRECTORY_INFO packet
SMB_FIND_FILE_DIRECTORY_INFO packet
SMB_FIND_FILE_FULL_DIRECTORY_INFO packet
SMB_FIND_FILE_NAMES_INFO packet
SMB_INFO_QUERY_EA_SIZE packet (section 2.2.8.1.2, section 2.2.8.3.2)
SMB_INFO_QUERY_EAS_FROM_LIST packet (section 2.2.8.1.3, section 2.2.8.3.3)
SMB_INFO_STANDARD packet (section 2.2.8.1.1, section 2.2.8.3.1, section 2.2.8.4.1)
SMB_QUERY_FILE_ALL_INFO packet
SMB_QUERY_FILE_ALT_NAME_INFO packet
SMB_QUERY_FILE_BASIC_INFO packet
SMB_QUERY_FILE_COMRESSION_INFO packet
SMB_QUERY_FILE_NAME_INFO packet
SMB_QUERY_FILE_STANDARD_INFO packet
SMB_QUERY_FILE_STREAM_INFO packet
SMB_QUERY_FS_ATTRIBUTE_INFO packet
SMB_QUERY_FS_DEVICE_INFO packet
SMB_QUERY_FS_VOLUME_INFO packet
SMB_SEARCH_ATTRIBUTE_DIRECTORY
SMB_SET_FILE_ALLOCATION_INFO packet
SMB_SET_FILE_BASIC_INFO packet
SMB_SET_FILE_DISPOSITION_INFO packet
SMB_SET_FILE_END_OF_FILE_INFO packet
Structures - SMB message
batched messages ("AndX" messages)
Subcommand codes - transaction
Subcommands
NT Transact
NT_TRANSACT_NOTIFY_CHANGE (0x0004)
NT_TRANSACT_QUERY_SECURITY_DESC (0x0006)
NT_TRANSACT_SET_SECURITY_DESC (0x0003)
Transaction
TRANS_QUERY_NMPIPE_INFO (0x0022)
TRANS_QUERY_NMPIPE_STATE (0x0021)
TRANS_RAW_READ_NMPIPE (0x0011)
TRANS_RAW_WRITE_NMPIPE (0x0031)
TRANS_SET_NMPIPE_STATE (0x0001)
TRANS_TRANSACT_NMPIPE (0x0026)
Transaction2
TRANS2_CREATE_DIRECTORY (0x000D)
TRANS2_FIND_NOTIFY_FIRST (0x000B)
TRANS2_FIND_NOTIFY_NEXT (0x000C)
TRANS2_GET_DFS_REFERRAL (0x0010)
TRANS2_QUERY_FILE_INFORMATION (0x0007)
TRANS2_QUERY_FS_INFORMATION (0x0003)
TRANS2_QUERY_PATH_INFORMATION (0x0005)
TRANS2_REPORT_DFS_INCONSISTENCY (0x0011)
TRANS2_SET_FILE_INFORMATION (0x0008)
TRANS2_SET_FS_INFORMATION (0x0004)
TRANS2_SET_PATH_INFORMATION (0x0006)
T
Timer events
client
RPC (section 3.1.6, section 3.4.6)
server
RPC (section 3.1.6, section 3.5.6)
Timers
client
RPC (section 3.1.2, section 3.4.2)
server
RPC (section 3.1.2, section 3.5.2)
TRANS2_FIND_FIRST2_REQUEST packet
TRANS2_FIND_NEXT2_REQUEST packet
Transaction subcommands
TRANS_QUERY_NMPIPE_INFO (0x0022)
TRANS_QUERY_NMPIPE_STATE (0x0021)
TRANS_RAW_READ_NMPIPE (0x0011)
TRANS_RAW_WRITE_NMPIPE (0x0031)
TRANS_SET_NMPIPE_STATE (0x0001)
TRANS_TRANSACT_NMPIPE (0x0026)
Transaction Subcommands message
Transaction2 subcommands
TRANS2_CREATE_DIRECTORY (0x000D)
TRANS2_FIND_NOTIFY_FIRST (0x000B)
TRANS2_FIND_NOTIFY_NEXT (0x000C)
TRANS2_GET_DFS_REFERRAL (0x0010)
TRANS2_QUERY_FILE_INFORMATION (0x0007)
TRANS2_QUERY_FS_INFORMATION (0x0003)
TRANS2_QUERY_PATH_INFORMATION (0x0005)
TRANS2_REPORT_DFS_INCONSISTENCY (0x0011)
TRANS2_SET_FILE_INFORMATION (0x0008)
TRANS2_SET_FS_INFORMATION (0x0004)
TRANS2_SET_PATH_INFORMATION (0x0006)
NetBIOS
over
Transports
NetBIOS-based transports
Triggered events
client
cryptographic session key - querying
device
DFS
directory
file
attributes
named pipe
querying
reading (section 3.2.4.14, section 3.2.4.37)
writing (section 3.2.4.15, section 3.2.4.38)
number of opens on tree connect
operations - canceling pending
RPC
extended DFS referral capability - querying
named pipe
session
security descriptors
sending any message (section 3.1.4.1, section 3.2.4.1)
transport layer connection - testing
tree disconnect (unmount share)
server
client session
DFS subsystem
open
RPC
named pipe
sending any message (section 3.1.4.1, section 3.3.4.1)
session
share
U
V
Y