Below is the SMB2 header for a successful Create from a client to a server. The next packet in the trace says the Create was successful. How do I figure out what file was created and where? There is nothing in the Filename and nothing under the Tree Id.
asked 18 Aug '14, 10:13  Tom Fury |
One Answer:
Hi Tom, I've often seen this in SMB2 traces. I think the answer is that the client is opening the root directory relative to the current share. The share is identified by the Tree ID value, and if you've captured the connection to the share you'll see the Tree Connect request which will contain the share name. I've noticed a typical scenario is the client opens the directory with a Create Request (Disposition - Open), issues a Find Request looking for a particular file (sometimes with wildcard values) and then you see a Close Request for the directory. Some information that may help:
Best regards...Paul answered 19 Aug '14, 13:05  PaulOfford |
