2.2.31 SMB2 IOCTL Request

The SMB2 IOCTL Request packet is sent by a client to issue an implementation-specific file system control or device control (FSCTL/IOCTL) command across the network. For a list of IOCTL operations, see section 3.2.4.20 and [MS-FSCC] section 2.3. This request is composed of an SMB2 header, as specified in section 2.2.1, followed by this request structure.


0


1


2


3


4


5


6


7


8


9

1
0


1


2


3


4


5


6


7


8


9

2
0


1


2


3


4


5


6


7


8


9

3
0


1

StructureSize

Reserved

CtlCode

FileId

...

...

...

InputOffset

InputCount

MaxInputResponse

OutputOffset

OutputCount

MaxOutputResponse

Flags

Reserved2

Buffer (variable)

...

StructureSize (2 bytes): The client MUST set this field to 57, indicating the size of the request structure, not including the header. The client MUST set this field to this value regardless of how long Buffer[] actually is in the request being sent.

Reserved (2 bytes): This field MUST NOT be used and MUST be reserved. The client MUST set this field to 0, and the server MUST ignore it on receipt.

CtlCode (4 bytes): The control code of the FSCTL/IOCTL method. The values are listed in subsequent sections, and in [MS-FSCC] section 2.3. The following values indicate SMB2-specific processing as specified in sections 3.2.4.20 and 3.3.5.15.

Name

Value

FSCTL_DFS_GET_REFERRALS

0x00060194

FSCTL_PIPE_PEEK

0x0011400C

FSCTL_PIPE_WAIT

0x00110018

FSCTL_PIPE_TRANSCEIVE

0x0011C017

FSCTL_SRV_COPYCHUNK

0x001440F2

FSCTL_SRV_ENUMERATE_SNAPSHOTS

0x00144064

FSCTL_SRV_REQUEST_RESUME_KEY

0x00140078

FSCTL_SRV_READ_HASH

0x001441bb

FSCTL_SRV_COPYCHUNK_WRITE

0x001480F2

FSCTL_LMR_REQUEST_RESILIENCY

0x001401D4

FSCTL_QUERY_NETWORK_INTERFACE_INFO

0x001401FC

FSCTL_SET_REPARSE_POINT

0x000900A4

FSCTL_DFS_GET_REFERRALS_EX

0x000601B0

FSCTL_FILE_LEVEL_TRIM

0x00098208

FSCTL_VALIDATE_NEGOTIATE_INFO

0x00140204

FSCTL_PIPE_TRANSCEIVE is valid only on a named pipe with mode set to FILE_PIPE_MESSAGE_MODE as specified in [MS-FSCC] section 2.4.32.

FSCTL_SRV_COPYCHUNK and FSCTL_SRV_COPYCHUNK_WRITE FSCTL codes are used for performing server side copy operations. These FSCTLs are issued by the application against an open handle to the target file. FSCTL_SRV_COPYCHUNK is issued when a handle has FILE_READ_DATA and FILE_WRITE_DATA access to the file; FSCTL_SRV_COPYCHUNK_WRITE is issued when a handle only has FILE_WRITE_DATA access.

FileId (16 bytes): An SMB2_FILEID identifier of the file on which to perform the command.

InputOffset (4 bytes): The offset, in bytes, from the beginning of the SMB2 header to the input data buffer. If no input data is required for the FSCTL/IOCTL command being issued, this field can be set to any value by the client and MUST be ignored by the server.

InputCount (4 bytes): The size, in bytes, of the input data.

MaxInputResponse (4 bytes): The maximum number of bytes that the server can return for the input data in the SMB2 IOCTL Response.

OutputOffset (4 bytes): The client SHOULD set this to 0.<64>

OutputCount (4 bytes): The client MUST set this to 0.

MaxOutputResponse (4 bytes): The maximum number of bytes that the server can return for the output data in the SMB2 IOCTL Response.

Flags (4 bytes): A Flags field indicating how to process the operation. This field MUST be constructed using one of the following values.

Value

Meaning

0x00000000

If Flags is set to this value, the request is an IOCTL request.

SMB2_0_IOCTL_IS_FSCTL

0x00000001

If Flags is set to this value, the request is an FSCTL request.

Reserved2 (4 bytes): This field MUST NOT be used and MUST be reserved. The client MUST set this field to 0, and the server MUST ignore it on receipt.

Buffer (variable): A variable-length buffer that contains the input and output data buffer for the request, as described by the InputOffset, InputCount, OutputOffset, and OutputCount. There is no minimum size restriction for this field as there can be FSCTLs with no input or output buffers. The format of this buffer for FSCTLs is specified in subsequent sections of 3.2.4.20.

The following FSCTL requests do not provide an input buffer:

  • FSCTL_PIPE_PEEK

  • FSCTL_SRV_ENUMERATE_SNAPSHOTS

  • FSCTL_SRV_REQUEST_RESUME_KEY

  • FSCTL_QUERY_NETWORK_INTERFACE_INFO