This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

SMB INVALID DEVICE REQUEST

0

Getting a SMB error during a filetransfer that I don't understand. Anyone able to shed some light on this error? Here is the trace: https://www.cloudshark.org/captures/7b5be0802a2c alt text

asked 24 Apr '13, 12:56

mrEEde2's gravatar image

mrEEde2
336●4●6●14
accept rate: 20%

2 Answers:

2

Frame 28 is a response to frame 27, which is an FSCTL_REQUEST_FILTER_OPLOCK ioctl request on file \Eigene Dateien\ind$.txt (which had been opened earlier). According to Microsoft's documentation for FSCTL_REQUEST_FILTER_OPLOCK:

In Windows 8 and Windows Server 2012, this code is supported by the following technologies.
Technology                                  Supported
Server Message Block (SMB) 3.0 protocol     No
SMB 3.0 Transparent Failover (TFO)          No
SMB 3.0 with Scale-out File Shares (SO)     No
Cluster Shared Volume File System (CsvFS)   Yes
Resilient File System (ReFS)                Yes

so it sounds as if it's not supported by SMB 3 - which means it's almost certainly not supported by "SMB 1", which is the protocol being used here. You'll have to find out what operation is doing a DeviceIoControl() operation with that code, and fix it not to do so (or not to do so unless it's accessing a local file system that's CsvFS or ReFS.

answered 24 Apr '13, 13:14

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k●3●35●196
accept rate: 19%

1

based on the TTL of frame 27 (TTL == 59), I believe the server could be a *NIX or *BSD system running Samba (see default TTL values of several systems) - could be a kind of NAS system. Maybe OPLOCKs are not enabled on that system (Samba config).

Regards
Kurt

answered 24 Apr '13, 15:14

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

edited 24 Apr '13, 15:40

@mrEEde2: What type of system is that server?

(25 Apr '13, 05:53) Kurt Knochner ♦

Don't know for sure but looks like a Linux flavor

(25 Apr '13, 07:09) mrEEde2

O.K. did you check the Samba config?

(25 Apr '13, 07:20) Kurt Knochner ♦

I don't have access to the server's admins, sorry, I'm looking at this from the client's perspective only But I guess from the information I received so far here "I'm off the hook" ;-)

(25 Apr '13, 11:25) mrEEde2