This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

SMB2 Successful Create of a Blank File?

0

Below is the SMB2 header for a successful Create from a client to a server. The next packet in the trace says the Create was successful. How do I figure out what file was created and where? There is nothing in the Filename and nothing under the Tree Id.

alt text

asked 18 Aug '14, 10:13

Tom%20Fury's gravatar image

Tom Fury
1232
accept rate: 0%


One Answer:

0

Hi Tom,

I've often seen this in SMB2 traces. I think the answer is that the client is opening the root directory relative to the current share. The share is identified by the Tree ID value, and if you've captured the connection to the share you'll see the Tree Connect request which will contain the share name.

I've noticed a typical scenario is the client opens the directory with a Create Request (Disposition - Open), issues a Find Request looking for a particular file (sometimes with wildcard values) and then you see a Close Request for the directory.

Some information that may help:

Best regards...Paul

answered 19 Aug '14, 13:05

PaulOfford's gravatar image

PaulOfford
131283237
accept rate: 11%