Slow CIFS navigation due to excessive use of QUERY_PATH_INFO
"pourquoi.hugo" <[email protected]> Wed, 24 Mar 2010 10:11:13 +0100 (CET)
| Newsgroups | gmane.linux.file-systems.cifs |
|---|---|
| Message-ID | <23035415.24089.1269421873507.JavaMail.www@wwinf8402> |
------=_Part_24088_25931338.1269421873506 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Going from kernel (x86) 2.6.27-8 (I am not sure which version of mount.cifs) to 2.6.31-19 with mount.cifs version: 1.12-3.4.0, I noticed an important decrease of performance while navigating CIFS shares on a Windows 2003 server. Navigating means here either using midnight commander, ls -l (with ls unaliased first...), rsync, etc.. I added noserverino,nolinux to the mount command, but it does not make much difference. The kind of performance degradation I am talking about is in the order of times ten or so. An rsync which takes less that 2 minutes on old hardware, now takes over 15 minutes on newer hardware! Doing a bit of investigation with tcpdump, we can see a lot QUERY_PATH_INFO requests happening which are not necessary as all the information is already returned by FIND_FIRST2 requests. A trivial example will illustrate it. Lets have a directory with 3 files inside. ls -l with my old machine, it gives: Protocol Info SMB Trans2 Request, QUERY_PATH_INFO, Query File All Info, Path: \Temp SMB Trans2 Response, QUERY_PATH_INFO SMB Trans2 Request, FIND_FIRST2, Pattern: \Temp\* SMB Trans2 Response, FIND_FIRST2, Files: . .. file1 file2 file3 With the new one, it gives: Protocol Info SMB Trans2 Request, QUERY_PATH_INFO, Query File All Info, Path: \Temp SMB Trans2 Response, QUERY_PATH_INFO SMB Trans2 Request, FIND_FIRST2, Pattern: \Temp\* SMB Trans2 Response, FIND_FIRST2, Files: . .. file1 file2 file3 SMB Trans2 Request, QUERY_PATH_INFO, Query File All Info, Path: \Temp\file1 SMB Trans2 Response, QUERY_PATH_INFO SMB Trans2 Request, QUERY_PATH_INFO, Query File All Info, Path: \Temp\file2 SMB Trans2 Response, QUERY_PATH_INFO SMB Trans2 Request, QUERY_PATH_INFO, Query File All Info, Path: \Temp\file3 SMB Trans2 Response, QUERY_PATH_INFO So for every file in the directory, as returned by the FIRST_FIND2 response, it does a QUERY_PATH_INFO, which does not bring any new information, all the attributes were already returned by FIRST_FIND2. I attached to the email the tcpdump so you can really double check by yourself that the QUERY_PATH info does not bring anything new. That is the cause of the slowness I notice. Is that a known issue? Thanks for your help, Seb. Laposte.net, Messager Officiel du Rallye des Gazelles 2010, Pour suivre le Rallye Aicha des Gazelles et soutenir les participantes, cliquez ici http://www.laposte.net/rallye-des-gazelles ------=_Part_24088_25931338.1269421873506 Content-Type: text/plain; name=seblap-ls-l.txt content-transfer-encoding: quoted-printable Content-Disposition: attachment; size=85029; filename=seblap-ls-l.txt No. Time Source Destination Protocol In= fo =09 1 0.000000 172.30.33.11 172.19.71.71 SMB Tra= ns2 Request, QUERY_PATH_INFO, Query File All Info, Path: \Temp Frame 1 (154 bytes on wire, 154 bytes captured) =09Arrival Time: Mar 1, 2010 15:05:49.498621000 =09[Time delta from previous captured frame: 0.000000000 seconds] =09[Time delta from previous displayed frame: 0.000000000 seconds] =09[Time since reference or first frame: 0.000000000 seconds] =09Frame Number: 1 =09Frame Length: 154 bytes =09Capture Length: 154 bytes =09[Frame is marked: False] =09[Protocols in frame: eth:ip:tcp:nbss:smb] =09[Coloring Rule Name: SMB] =09[Coloring Rule String: smb || nbss || nbns || nbipx || ipxsap || netbios= ] Ethernet II, Src: Inventec_dd:63:6b (00:1e:33:dd:63:6b), Dst: JuniperN_f8:1= 3:8b (b0:c6:9a:f8:13:8b) =09Destination: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b) =09=09Address: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b) =09=09.... ...0 .... .... .... .... =3D IG bit: Individual address (unicast= ) =09=09.... ..0. .... .... .... .... =3D LG bit: Globally unique address (fa= ctory default) =09Source: Inventec_dd:63:6b (00:1e:33:dd:63:6b) =09=09Address: Inventec_dd:63:6b (00:1e:33:dd:63:6b) =09=09.... ...0 .... .... .... .... =3D IG bit: Individual address (unicast= ) =09=09.... ..0. .... .... .... .... =3D LG bit: Globally unique address (fa= ctory default) =09Type: IP (0x0800) Internet Protocol, Src: 172.30.33.11 (172.30.33.11), Dst: 172.19.71.71 (172= .19.71.71) =09Version: 4 =09Header length: 20 bytes =09Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) =09=090000 00.. =3D Differentiated Services Codepoint: Default (0x00) =09=09.... ..0. =3D ECN-Capable Transport (ECT): 0 =09=09.... ...0 =3D ECN-CE: 0 =09Total Length: 140 =09Identification: 0x73b9 (29625) =09Flags: 0x04 (Don't Fragment) =09=090... =3D Reserved bit: Not set =09=09.1.. =3D Don't fragment: Set =09=09..0. =3D More fragments: Not set =09Fragment offset: 0 =09Time to live: 64 =09Protocol: TCP (0x06) =09Header checksum: 0x062f [correct] =09=09[Good: True] =09=09[Bad : False] =09Source: 172.30.33.11 (172.30.33.11) =09Destination: 172.19.71.71 (172.19.71.71) Transmission Control Protocol, Src Port: 55075 (55075), Dst Port: microsoft= -ds (445), Seq: 1, Ack: 1, Len: 88 =09Source port: 55075 (55075) =09Destination port: microsoft-ds (445) =09[Stream index: 0] =09Sequence number: 1 (relative sequence number) =09[Next sequence number: 89 (relative sequence number)] =09Acknowledgement number: 1 (relative ack number) =09Header length: 32 bytes =09Flags: 0x18 (PSH, ACK) =09=090... .... =3D Congestion Window Reduced (CWR): Not set =09=09.0.. .... =3D ECN-Echo: Not set =09=09..0. .... =3D Urgent: Not set =09=09...1 .... =3D Acknowledgement: Set =09=09.... 1... =3D Push: Set =09=09.... .0.. =3D Reset: Not set =09=09.... ..0. =3D Syn: Not set =09=09.... ...0 =3D Fin: Not set =09Window size: 1002 =09Checksum: 0xbfff [validation disabled] =09=09[Good Checksum: False] =09=09[Bad Checksum: False] =09Options: (12 bytes) =09=09NOP =09=09NOP =09=09Timestamps: TSval 6591837, TSecr 62822017 =09[SEQ/ACK analysis] =09=09[Number of bytes in flight: 88] NetBIOS Session Service =09Message Type: Session message =09Length: 84 SMB (Server Message Block Protocol) =09SMB Header =09=09Server Component: SMB =09=09[Response in: 2] =09=09SMB Command: Trans2 (0x32) =09=09NT Status: STATUS_SUCCESS (0x00000000) =09=09Flags: 0x00 =09=09=090... .... =3D Request/Response: Message is a request to the server =09=09=09.0.. .... =3D Notify: Notify client only on open =09=09=09..0. .... =3D Oplocks: OpLock not requested/granted =09=09=09...0 .... =3D Canonicalized Pathnames: Pathnames are not canonical= ized =09=09=09.... 0... =3D Case Sensitivity: Path names are case sensitive =09=09=09.... ..0. =3D Receive Buffer Posted: Receive buffer has not been p= osted =09=09=09.... ...0 =3D Lock and Read: Lock&Read, Write&Unlock are not suppo= rted =09=09Flags2: 0xc001 =09=09=091... .... .... .... =3D Unicode Strings: Strings are Unicode =09=09=09.1.. .... .... .... =3D Error Code Type: Error codes are NT error = codes =09=09=09..0. .... .... .... =3D Execute-only Reads: Don't permit reads if = execute-only =09=09=09...0 .... .... .... =3D Dfs: Don't resolve pathnames with Dfs =09=09=09.... 0... .... .... =3D Extended Security Negotiation: Extended se= curity negotiation is not supported =09=09=09.... .... .0.. .... =3D Long Names Used: Path names in request are= not long file names =09=09=09.... .... .... .0.. =3D Security Signatures: Security signatures a= re not supported =09=09=09.... .... .... ..0. =3D Extended Attributes: Extended attributes a= re not supported =09=09=09.... .... .... ...1 =3D Long Names Allowed: Long file names are al= lowed in the response =09=09Process ID High: 0 =09=09Signature: 0000000000000000 =09=09Reserved: 0000 =09=09Tree ID: 4106 =09=09Process ID: 5657 =09=09User ID: 10241 =09=09Multiplex ID: 631 =09Trans2 Request (0x32) =09=09Word Count (WCT): 15 =09=09Total Parameter Count: 18 =09=09Total Data Count: 0 =09=09Max Parameter Count: 2 =09=09Max Data Count: 4000 =09=09Max Setup Count: 0 =09=09Reserved: 00 =09=09Flags: 0x0000 =09=09=09.... .... .... ..0. =3D One Way Transaction: Two way transaction =09=09=09.... .... .... ...0 =3D Disconnect TID: Do NOT disconnect TID =09=09Timeout: Return immediately (0) =09=09Reserved: 0000 =09=09Parameter Count: 18 =09=09Parameter Offset: 66 =09=09Data Count: 0 =09=09Data Offset: 0 =09=09Setup Count: 1 =09=09Reserved: 00 =09=09Subcommand: QUERY_PATH_INFO (0x0005) =09=09Byte Count (BCC): 19 =09=09Padding: 00 =09=09QUERY_PATH_INFO Parameters =09=09=09Level of Interest: Query File All Info (263) =09=09=09Reserved: 00000000 =09=09=09File Name: \Temp No. Time Source Destination Protocol In= fo =09 2 0.056732 172.19.71.71 172.30.33.11 SMB Tra= ns2 Response, QUERY_PATH_INFO Frame 2 (266 bytes on wire, 266 bytes captured) =09Arrival Time: Mar 1, 2010 15:05:49.555353000 =09[Time delta from previous captured frame: 0.056732000 seconds] =09[Time delta from previous displayed frame: 0.056732000 seconds] =09[Time since reference or first frame: 0.056732000 seconds] =09Frame Number: 2 =09Frame Length: 266 bytes =09Capture Length: 266 bytes =09[Frame is marked: False] =09[Protocols in frame: eth:ip:tcp:nbss:smb] =09[Coloring Rule Name: SMB] =09[Coloring Rule String: smb || nbss || nbns || nbipx || ipxsap || netbios= ] Ethernet II, Src: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b), Dst: Inventec_dd:6= 3:6b (00:1e:33:dd:63:6b) =09Destination: Inventec_dd:63:6b (00:1e:33:dd:63:6b) =09=09Address: Inventec_dd:63:6b (00:1e:33:dd:63:6b) =09=09.... ...0 .... .... .... .... =3D IG bit: Individual address (unicast= ) =09=09.... ..0. .... .... .... .... =3D LG bit: Globally unique address (fa= ctory default) =09Source: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b) =09=09Address: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b) =09=09.... ...0 .... .... .... .... =3D IG bit: Individual address (unicast= ) =09=09.... ..0. .... .... .... .... =3D LG bit: Globally unique address (fa= ctory default) =09Type: IP (0x0800) Internet Protocol, Src: 172.19.71.71 (172.19.71.71), Dst: 172.30.33.11 (172= .30.33.11) =09Version: 4 =09Header length: 20 bytes =09Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) =09=090000 00.. =3D Differentiated Services Codepoint: Default (0x00) =09=09.... ..0. =3D ECN-Capable Transport (ECT): 0 =09=09.... ...0 =3D ECN-CE: 0 =09Total Length: 252 =09Identification: 0x5610 (22032) =09Flags: 0x04 (Don't Fragment) =09=090... =3D Reserved bit: Not set =09=09.1.. =3D Don't fragment: Set =09=09..0. =3D More fragments: Not set =09Fragment offset: 0 =09Time to live: 125 =09Protocol: TCP (0x06) =09Header checksum: 0xe667 [correct] =09=09[Good: True] =09=09[Bad : False] =09Source: 172.19.71.71 (172.19.71.71) =09Destination: 172.30.33.11 (172.30.33.11) Transmission Control Protocol, Src Port: microsoft-ds (445), Dst Port: 5507= 5 (55075), Seq: 1, Ack: 89, Len: 200 =09Source port: microsoft-ds (445) =09Destination port: 55075 (55075) =09[Stream index: 0] =09Sequence number: 1 (relative sequence number) =09[Next sequence number: 201 (relative sequence number)] =09Acknowledgement number: 89 (relative ack number) =09Header length: 32 bytes =09Flags: 0x18 (PSH, ACK) =09=090... .... =3D Congestion Window Reduced (CWR): Not set =09=09.0.. .... =3D ECN-Echo: Not set =09=09..0. .... =3D Urgent: Not set =09=09...1 .... =3D Acknowledgement: Set =09=09.... 1... =3D Push: Set =09=09.... .0.. =3D Reset: Not set =09=09.... ..0. =3D Syn: Not set =09=09.... ...0 =3D Fin: Not set =09Window size: 65129 =09Checksum: 0x1de1 [validation disabled] =09=09[Good Checksum: False] =09=09[Bad Checksum: False] =09Options: (12 bytes) =09=09NOP =09=09NOP =09=09Timestamps: TSval 62822120, TSecr 6591837 =09[SEQ/ACK analysis] =09=09[This is an ACK to the segment in frame: 1] =09=09[The RTT to ACK the segment was: 0.056732000 seconds] =09=09[Number of bytes in flight: 200] NetBIOS Session Service =09Message Type: Session message =09Length: 196 SMB (Server Message Block Protocol) =09SMB Header =09=09Server Component: SMB =09=09[Response to: 1] =09=09[Time from request: 0.056732000 seconds] =09=09SMB Command: Trans2 (0x32) =09=09NT Status: STATUS_SUCCESS (0x00000000) =09=09Flags: 0x80 =09=09=091... .... =3D Request/Response: Message is a response to the clien= t/redirector =09=09=09.0.. .... =3D Notify: Notify client only on open =09=09=09..0. .... =3D Oplocks: OpLock not requested/granted =09=09=09...0 .... =3D Canonicalized Pathnames: Pathnames are not canonical= ized =09=09=09.... 0... =3D Case Sensitivity: Path names are case sensitive =09=09=09.... ..0. =3D Receive Buffer Posted: Receive buffer has not been p= osted =09=09=09.... ...0 =3D Lock and Read: Lock&Read, Write&Unlock are not suppo= rted =09=09Flags2: 0xc001 =09=09=091... .... .... .... =3D Unicode Strings: Strings are Unicode =09=09=09.1.. .... .... .... =3D Error Code Type: Error codes are NT error = codes =09=09=09..0. .... .... .... =3D Execute-only Reads: Don't permit reads if = execute-only =09=09=09...0 .... .... .... =3D Dfs: Don't resolve pathnames with Dfs =09=09=09.... 0... .... .... =3D Extended Security Negotiation: Extended se= curity negotiation is not supported =09=09=09.... .... .0.. .... =3D Long Names Used: Path names in request are= not long file names =09=09=09.... .... .... .0.. =3D Security Signatures: Security signatures a= re not supported =09=09=09.... .... .... ..0. =3D Extended Attributes: Extended attributes a= re not supported =09=09=09.... .... .... ...1 =3D Long Names Allowed: Long file names are al= lowed in the response =09=09Process ID High: 0 =09=09Signature: 0000000000000000 =09=09Reserved: 0000 =09=09Tree ID: 4106 =09=09Process ID: 5657 =09=09User ID: 10241 =09=09Multiplex ID: 631 =09Trans2 Response (0x32) =09=09Subcommand: QUERY_PATH_INFO (0x0005) =09=09[Level of Interest: Query File All Info (263)] =09=09[File Name: \Temp] =09=09Word Count (WCT): 10 =09=09Total Parameter Count: 2 =09=09Total Data Count: 136 =09=09Reserved: 0000 =09=09Parameter Count: 2 =09=09Parameter Offset: 56 =09=09Parameter Displacement: 0 =09=09Data Count: 136 =09=09Data Offset: 60 =09=09Data Displacement: 0 =09=09Setup Count: 0 =09=09Reserved: 00 =09=09Byte Count (BCC): 141 =09=09Padding: 00 =09=09QUERY_PATH_INFO Parameters =09=09=09EA Error offset: 0 =09=09Padding: 0000 =09=09QUERY_PATH_INFO Data =09=09=09Created: Apr 24, 2009 16:56:11.024191600 =09=09=09Last Access: Mar 1, 2010 15:02:05.606809700 =09=09=09Last Write: Mar 1, 2010 14:13:56.870541100 =09=09=09Change: Mar 1, 2010 14:13:56.870541100 =09=09=09File Attributes: 0x00000010 =09=09=09=09.0.. .... .... .... =3D Encrypted: This is NOT an encrypted fil= e =09=09=09=09..0. .... .... .... =3D Content Indexed: This file MAY be index= ed by the content indexing service =09=09=09=09...0 .... .... .... =3D Offline: This file is NOT offline =09=09=09=09.... 0... .... .... =3D Compressed: This is NOT a compressed fi= le =09=09=09=09.... .0.. .... .... =3D Reparse Point: This file does NOT have = an associated reparse point =09=09=09=09.... ..0. .... .... =3D Sparse: This is NOT a sparse file =09=09=09=09.... ...0 .... .... =3D Temporary: This is NOT a temporary file =09=09=09=09.... .... 0... .... =3D Normal: This file has some attribute se= t =09=09=09=09.... .... .0.. .... =3D Device: This is NOT a device =09=09=09=09.... .... ..0. .... =3D Archive: This file has NOT been modifie= d since last archive =09=09=09=09.... .... ...1 .... =3D Directory: This is a DIRECTORY =09=09=09=09.... .... .... 0... =3D Volume ID: This is NOT a volume ID =09=09=09=09.... .... .... .0.. =3D System: This is NOT a system file =09=09=09=09.... .... .... ..0. =3D Hidden: This is NOT a hidden file =09=09=09=09.... .... .... ...0 =3D Read Only: This file is NOT read only =09=09=09Allocation Size: 0 =09=09=09End Of File: 0 =09=09=09Link Count: 1 =09=09=09Delete Pending: Normal, no pending delete (0) =09=09=09Is Directory: This is a DIRECTORY (1) =09=09=09EA List Length: 0 =09=09=09File Name Len: 64 =09=09=09File Name: \SLP\Temp No. Time Source Destination Protocol In= fo =09 3 0.056787 172.30.33.11 172.19.71.71 TCP 550= 75 > microsoft-ds [ACK] Seq=3D89 Ack=3D201 Win=3D1002 Len=3D0 TSV=3D6591851= TSER=3D62822120 Frame 3 (66 bytes on wire, 66 bytes captured) =09Arrival Time: Mar 1, 2010 15:05:49.555408000 =09[Time delta from previous captured frame: 0.000055000 seconds] =09[Time delta from previous displayed frame: 0.000055000 seconds] =09[Time since reference or first frame: 0.056787000 seconds] =09Frame Number: 3 =09Frame Length: 66 bytes =09Capture Length: 66 bytes =09[Frame is marked: False] =09[Protocols in frame: eth:ip:tcp] =09[Coloring Rule Name: TCP] =09[Coloring Rule String: tcp] Ethernet II, Src: Inventec_dd:63:6b (00:1e:33:dd:63:6b), Dst: JuniperN_f8:1= 3:8b (b0:c6:9a:f8:13:8b) =09Destination: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b) =09=09Address: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b) =09=09.... ...0 .... .... .... .... =3D IG bit: Individual address (unicast= ) =09=09.... ..0. .... .... .... .... =3D LG bit: Globally unique address (fa= ctory default) =09Source: Inventec_dd:63:6b (00:1e:33:dd:63:6b) =09=09Address: Inventec_dd:63:6b (00:1e:33:dd:63:6b) =09=09.... ...0 .... .... .... .... =3D IG bit: Individual address (unicast= ) =09=09.... ..0. .... .... .... .... =3D LG bit: Globally unique address (fa= ctory default) =09Type: IP (0x0800) Internet Protocol, Src: 172.30.33.11 (172.30.33.11), Dst: 172.19.71.71 (172= .19.71.71) =09Version: 4 =09Header length: 20 bytes =09Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) =09=090000 00.. =3D Differentiated Services Codepoint: Default (0x00) =09=09.... ..0. =3D ECN-Capable Transport (ECT): 0 =09=09.... ...0 =3D ECN-CE: 0 =09Total Length: 52 =09Identification: 0x73ba (29626) =09Flags: 0x04 (Don't Fragment) =09=090... =3D Reserved bit: Not set =09=09.1.. =3D Don't fragment: Set =09=09..0. =3D More fragments: Not set =09Fragment offset: 0 =09Time to live: 64 =09Protocol: TCP (0x06) =09Header checksum: 0x0686 [correct] =09=09[Good: True] =09=09[Bad : False] =09Source: 172.30.33.11 (172.30.33.11) =09Destination: 172.19.71.71 (172.19.71.71) Transmission Control Protocol, Src Port: 55075 (55075), Dst Port: microsoft= -ds (445), Seq: 89, Ack: 201, Len: 0 =09Source port: 55075 (55075) =09Destination port: microsoft-ds (445) =09[Stream index: 0] =09Sequence number: 89 (relative sequence number) =09Acknowledgement number: 201 (relative ack number) =09Header length: 32 bytes =09Flags: 0x10 (ACK) =09=090... .... =3D Congestion Window Reduced (CWR): Not set =09=09.0.. .... =3D ECN-Echo: Not set =09=09..0. .... =3D Urgent: Not set =09=09...1 .... =3D Acknowledgement: Set =09=09.... 0... =3D Push: Not set =09=09.... .0.. =3D Reset: Not set =09=09.... ..0. =3D Syn: Not set =09=09.... ...0 =3D Fin: Not set =09Window size: 1002 =09Checksum: 0xf2e9 [validation disabled] =09=09[Good Checksum: False] =09=09[Bad Checksum: False] =09Options: (12 bytes) =09=09NOP =09=09NOP =09=09Timestamps: TSval 6591851, TSecr 62822120 =09[SEQ/ACK analysis] =09=09[This is an ACK to the segment in frame: 2] =09=09[The RTT to ACK the segment was: 0.000055000 seconds] No. Time Source Destination Protocol In= fo =09 4 0.057279 172.30.33.11 172.19.71.71 SMB Tra= ns2 Request, FIND_FIRST2, Pattern: \Temp\* Frame 4 (164 bytes on wire, 164 bytes captured) =09Arrival Time: Mar 1, 2010 15:05:49.555900000 =09[Time delta from previous captured frame: 0.000492000 seconds] =09[Time delta from previous displayed frame: 0.000547000 seconds] =09[Time since reference or first frame: 0.057279000 seconds] =09Frame Number: 4 =09Frame Length: 164 bytes =09Capture Length: 164 bytes =09[Frame is marked: False] =09[Protocols in frame: eth:ip:tcp:nbss:smb] =09[Coloring Rule Name: SMB] =09[Coloring Rule String: smb || nbss || nbns || nbipx || ipxsap || netbios= ] Ethernet II, Src: Inventec_dd:63:6b (00:1e:33:dd:63:6b), Dst: JuniperN_f8:1= 3:8b (b0:c6:9a:f8:13:8b) =09Destination: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b) =09=09Address: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b) =09=09.... ...0 .... .... .... .... =3D IG bit: Individual address (unicast= ) =09=09.... ..0. .... .... .... .... =3D LG bit: Globally unique address (fa= ctory default) =09Source: Inventec_dd:63:6b (00:1e:33:dd:63:6b) =09=09Address: Inventec_dd:63:6b (00:1e:33:dd:63:6b) =09=09.... ...0 .... .... .... .... =3D IG bit: Individual address (unicast= ) =09=09.... ..0. .... .... .... .... =3D LG bit: Globally unique address (fa= ctory default) =09Type: IP (0x0800) Internet Protocol, Src: 172.30.33.11 (172.30.33.11), Dst: 172.19.71.71 (172= .19.71.71) =09Version: 4 =09Header length: 20 bytes =09Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) =09=090000 00.. =3D Differentiated Services Codepoint: Default (0x00) =09=09.... ..0. =3D ECN-Capable Transport (ECT): 0 =09=09.... ...0 =3D ECN-CE: 0 =09Total Length: 150 =09Identification: 0x73bb (29627) =09Flags: 0x04 (Don't Fragment) =09=090... =3D Reserved bit: Not set =09=09.1.. =3D Don't fragment: Set =09=09..0. =3D More fragments: Not set =09Fragment offset: 0 =09Time to live: 64 =09Protocol: TCP (0x06) =09Header checksum: 0x0623 [correct] =09=09[Good: True] =09=09[Bad : False] =09Source: 172.30.33.11 (172.30.33.11) =09Destination: 172.19.71.71 (172.19.71.71) Transmission Control Protocol, Src Port: 55075 (55075), Dst Port: microsoft= -ds (445), Seq: 89, Ack: 201, Len: 98 =09Source port: 55075 (55075) =09Destination port: microsoft-ds (445) =09[Stream index: 0] =09Sequence number: 89 (relative sequence number) =09[Next sequence number: 187 (relative sequence number)] =09Acknowledgement number: 201 (relative ack number) =09Header length: 32 bytes =09Flags: 0x18 (PSH, ACK) =09=090... .... =3D Congestion Window Reduced (CWR): Not set =09=09.0.. .... =3D ECN-Echo: Not set =09=09..0. .... =3D Urgent: Not set =09=09...1 .... =3D Acknowledgement: Set =09=09.... 1... =3D Push: Set =09=09.... .0.. =3D Reset: Not set =09=09.... ..0. =3D Syn: Not set =09=09.... ...0 =3D Fin: Not set =09Window size: 1002 =09Checksum: 0x59d3 [validation disabled] =09=09[Good Checksum: False] =09=09[Bad Checksum: False] =09Options: (12 bytes) =09=09NOP =09=09NOP =09=09Timestamps: TSval 6591851, TSecr 62822120 =09[SEQ/ACK analysis] =09=09[Number of bytes in flight: 98] NetBIOS Session Service =09Message Type: Session message =09Length: 94 SMB (Server Message Block Protocol) =09SMB Header =09=09Server Component: SMB =09=09[Response in: 5] =09=09SMB Command: Trans2 (0x32) =09=09NT Status: STATUS_SUCCESS (0x00000000) =09=09Flags: 0x00 =09=09=090... .... =3D Request/Response: Message is a request to the server =09=09=09.0.. .... =3D Notify: Notify client only on open =09=09=09..0. .... =3D Oplocks: OpLock not requested/granted =09=09=09...0 .... =3D Canonicalized Pathnames: Pathnames are not canonical= ized =09=09=09.... 0... =3D Case Sensitivity: Path names are case sensitive =09=09=09.... ..0. =3D Receive Buffer Posted: Receive buffer has not been p= osted =09=09=09.... ...0 =3D Lock and Read: Lock&Read, Write&Unlock are not suppo= rted =09=09Flags2: 0xc001 =09=09=091... .... .... .... =3D Unicode Strings: Strings are Unicode =09=09=09.1.. .... .... .... =3D Error Code Type: Error codes are NT error = codes =09=09=09..0. .... .... .... =3D Execute-only Reads: Don't permit reads if = execute-only =09=09=09...0 .... .... .... =3D Dfs: Don't resolve pathnames with Dfs =09=09=09.... 0... .... .... =3D Extended Security Negotiation: Extended se= curity negotiation is not supported =09=09=09.... .... .0.. .... =3D Long Names Used: Path names in request are= not long file names =09=09=09.... .... .... .0.. =3D Security Signatures: Security signatures a= re not supported =09=09=09.... .... .... ..0. =3D Extended Attributes: Extended attributes a= re not supported =09=09=09.... .... .... ...1 =3D Long Names Allowed: Long file names are al= lowed in the response =09=09Process ID High: 0 =09=09Signature: 0000000000000000 =09=09Reserved: 0000 =09=09Tree ID: 4106 =09=09Process ID: 5657 =09=09User ID: 10241 =09=09Multiplex ID: 632 =09Trans2 Request (0x32) =09=09Word Count (WCT): 15 =09=09Total Parameter Count: 28 =09=09Total Data Count: 0 =09=09Max Parameter Count: 10 =09=09Max Data Count: 16384 =09=09Max Setup Count: 0 =09=09Reserved: 00 =09=09Flags: 0x0000 =09=09=09.... .... .... ..0. =3D One Way Transaction: Two way transaction =09=09=09.... .... .... ...0 =3D Disconnect TID: Do NOT disconnect TID =09=09Timeout: Return immediately (0) =09=09Reserved: 0000 =09=09Parameter Count: 28 =09=09Parameter Offset: 66 =09=09Data Count: 0 =09=09Data Offset: 0 =09=09Setup Count: 1 =09=09Reserved: 00 =09=09Subcommand: FIND_FIRST2 (0x0001) =09=09Byte Count (BCC): 29 =09=09Padding: 00 =09=09FIND_FIRST2 Parameters =09=09=09Search Attributes: 0x0017 =09=09=09=09.... .... .... ...1 =3D Read Only: Include READ ONLY files in s= earch results =09=09=09=09.... .... .... ..1. =3D Hidden: Include HIDDEN files in search = results =09=09=09=09.... .... .... .1.. =3D System: Include SYSTEM files in search = results =09=09=09=09.... .... .... 0... =3D Volume ID: Do NOT include volume IDs in= search results =09=09=09=09.... .... ...1 .... =3D Directory: Include DIRECTORIES in searc= h results =09=09=09=09.... .... ..0. .... =3D Archive: Do NOT include archive files i= n search results =09=09=09Search Count: 150 =09=09=09Flags: 0x0006 =09=09=09=09.... .... ...0 .... =3D Backup Intent: No backup intent =09=09=09=09.... .... .... 0... =3D Continue: New search, do NOT continue f= rom previous position =09=09=09=09.... .... .... .1.. =3D Resume: Return RESUME keys =09=09=09=09.... .... .... ..1. =3D Close on EOS: CLOSE search if END OF SE= ARCH is reached =09=09=09=09.... .... .... ...0 =3D Close: Do NOT close search after this r= equest =09=09=09Level of Interest: Find File Directory Info (257) =09=09=09Storage Type: 0 =09=09=09Search Pattern: \Temp\* No. Time Source Destination Protocol In= fo =09 5 0.114724 172.19.71.71 172.30.33.11 SMB Tra= ns2 Response, FIND_FIRST2, Files: . .. file1 file2 file3 Frame 5 (522 bytes on wire, 522 bytes captured) =09Arrival Time: Mar 1, 2010 15:05:49.613345000 =09[Time delta from previous captured frame: 0.057445000 seconds] =09[Time delta from previous displayed frame: 0.057445000 seconds] =09[Time since reference or first frame: 0.114724000 seconds] =09Frame Number: 5 =09Frame Length: 522 bytes =09Capture Length: 522 bytes =09[Frame is marked: False] =09[Protocols in frame: eth:ip:tcp:nbss:smb] =09[Coloring Rule Name: SMB] =09[Coloring Rule String: smb || nbss || nbns || nbipx || ipxsap || netbios= ] Ethernet II, Src: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b), Dst: Inventec_dd:6= 3:6b (00:1e:33:dd:63:6b) =09Destination: Inventec_dd:63:6b (00:1e:33:dd:63:6b) =09=09Address: Inventec_dd:63:6b (00:1e:33:dd:63:6b) =09=09.... ...0 .... .... .... .... =3D IG bit: Individual address (unicast= ) =09=09.... ..0. .... .... .... .... =3D LG bit: Globally unique address (fa= ctory default) =09Source: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b) =09=09Address: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b) =09=09.... ...0 .... .... .... .... =3D IG bit: Individual address (unicast= ) =09=09.... ..0. .... .... .... .... =3D LG bit: Globally unique address (fa= ctory default) =09Type: IP (0x0800) Internet Protocol, Src: 172.19.71.71 (172.19.71.71), Dst: 172.30.33.11 (172= .30.33.11) =09Version: 4 =09Header length: 20 bytes =09Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) =09=090000 00.. =3D Differentiated Services Codepoint: Default (0x00) =09=09.... ..0. =3D ECN-Capable Transport (ECT): 0 =09=09.... ...0 =3D ECN-CE: 0 =09Total Length: 508 =09Identification: 0x5619 (22041) =09Flags: 0x04 (Don't Fragment) =09=090... =3D Reserved bit: Not set =09=09.1.. =3D Don't fragment: Set =09=09..0. =3D More fragments: Not set =09Fragment offset: 0 =09Time to live: 125 =09Protocol: TCP (0x06) =09Header checksum: 0xe55e [correct] =09=09[Good: True] =09=09[Bad : False] =09Source: 172.19.71.71 (172.19.71.71) =09Destination: 172.30.33.11 (172.30.33.11) Transmission Control Protocol, Src Port: microsoft-ds (445), Dst Port: 5507= 5 (55075), Seq: 201, Ack: 187, Len: 456 =09Source port: microsoft-ds (445) =09Destination port: 55075 (55075) =09[Stream index: 0] =09Sequence number: 201 (relative sequence number) =09[Next sequence number: 657 (relative sequence number)] =09Acknowledgement number: 187 (relative ack number) =09Header length: 32 bytes =09Flags: 0x18 (PSH, ACK) =09=090... .... =3D Congestion Window Reduced (CWR): Not set =09=09.0.. .... =3D ECN-Echo: Not set =09=09..0. .... =3D Urgent: Not set =09=09...1 .... =3D Acknowledgement: Set =09=09.... 1... =3D Push: Set =09=09.... .0.. =3D Reset: Not set =09=09.... ..0. =3D Syn: Not set =09=09.... ...0 =3D Fin: Not set =09Window size: 65031 =09Checksum: 0xd4d3 [validation disabled] =09=09[Good Checksum: False] =09=09[Bad Checksum: False] =09Options: (12 bytes) =09=09NOP =09=09NOP =09=09Timestamps: TSval 62822121, TSecr 6591851 =09[SEQ/ACK analysis] =09=09[This is an ACK to the segment in frame: 4] =09=09[The RTT to ACK the segment was: 0.057445000 seconds] =09=09[Number of bytes in flight: 456] NetBIOS Session Service =09Message Type: Session message =09Length: 452 SMB (Server Message Block Protocol) =09SMB Header =09=09Server Component: SMB =09=09[Response to: 4] =09=09[Time from request: 0.057445000 seconds] =09=09SMB Command: Trans2 (0x32) =09=09NT Status: STATUS_SUCCESS (0x00000000) =09=09Flags: 0x80 =09=09=091... .... =3D Request/Response: Message is a response to the clien= t/redirector =09=09=09.0.. .... =3D Notify: Notify client only on open =09=09=09..0. .... =3D Oplocks: OpLock not requested/granted =09=09=09...0 .... =3D Canonicalized Pathnames: Pathnames are not canonical= ized =09=09=09.... 0... =3D Case Sensitivity: Path names are case sensitive =09=09=09.... ..0. =3D Receive Buffer Posted: Receive buffer has not been p= osted =09=09=09.... ...0 =3D Lock and Read: Lock&Read, Write&Unlock are not suppo= rted =09=09Flags2: 0xc001 =09=09=091... .... .... .... =3D Unicode Strings: Strings are Unicode =09=09=09.1.. .... .... .... =3D Error Code Type: Error codes are NT error = codes =09=09=09..0. .... .... .... =3D Execute-only Reads: Don't permit reads if = execute-only =09=09=09...0 .... .... .... =3D Dfs: Don't resolve pathnames with Dfs =09=09=09.... 0... .... .... =3D Extended Security Negotiation: Extended se= curity negotiation is not supported =09=09=09.... .... .0.. .... =3D Long Names Used: Path names in request are= not long file names =09=09=09.... .... .... .0.. =3D Security Signatures: Security signatures a= re not supported =09=09=09.... .... .... ..0. =3D Extended Attributes: Extended attributes a= re not supported =09=09=09.... .... .... ...1 =3D Long Names Allowed: Long file names are al= lowed in the response =09=09Process ID High: 0 =09=09Signature: 0000000000000000 =09=09Reserved: 0000 =09=09Tree ID: 4106 =09=09Process ID: 5657 =09=09User ID: 10241 =09=09Multiplex ID: 632 =09Trans2 Response (0x32) =09=09Subcommand: FIND_FIRST2 (0x0001) =09=09[Level of Interest: Find File Directory Info (257)] =09=09[Search Pattern: \Temp\*] =09=09Word Count (WCT): 10 =09=09Total Parameter Count: 10 =09=09Total Data Count: 384 =09=09Reserved: 0000 =09=09Parameter Count: 10 =09=09Parameter Offset: 56 =09=09Parameter Displacement: 0 =09=09Data Count: 384 =09=09Data Offset: 68 =09=09Data Displacement: 0 =09=09Setup Count: 0 =09=09Reserved: 00 =09=09Byte Count (BCC): 397 =09=09Padding: 00 =09=09FIND_FIRST2 Parameters =09=09=09Level of Interest: Find File Directory Info (257) =09=09=09Search ID: 0x0002 =09=09=09Search Count: 5 =09=09=09End Of Search: 1 =09=09=09EA Error offset: 0 =09=09=09Last Name Offset: 304 =09=09Padding: 0000 =09=09FIND_FIRST2 Data =09=09=09Find File Directory Info File: . =09=09=09=09Next Entry Offset: 72 =09=09=09=09File Index: 0 =09=09=09=09Created: Apr 24, 2009 16:56:11.024191600 =09=09=09=09Last Access: Mar 1, 2010 14:13:56.979891600 =09=09=09=09Last Write: Mar 1, 2010 14:13:56.870541100 =09=09=09=09Change: Mar 1, 2010 14:13:56.870541100 =09=09=09=09End Of File: 0 =09=09=09=09Allocation Size: 0 =09=09=09=09File Attributes: 0x00000010 =09=09=09=09=09.... .... .... .... .0.. .... .... .... =3D Encrypted: This = is NOT an encrypted file =09=09=09=09=09.... .... .... .... ..0. .... .... .... =3D Content Indexed:= This file MAY be indexed by the content indexing service =09=09=09=09=09.... .... .... .... ...0 .... .... .... =3D Offline: This fi= le is NOT offline =09=09=09=09=09.... .... .... .... .... 0... .... .... =3D Compressed: This= is NOT a compressed file =09=09=09=09=09.... .... .... .... .... .0.. .... .... =3D Reparse Point: T= his file does NOT have an associated reparse point =09=09=09=09=09.... .... .... .... .... ..0. .... .... =3D Sparse: This is = NOT a sparse file =09=09=09=09=09.... .... .... .... .... ...0 .... .... =3D Temporary: This = is NOT a temporary file =09=09=09=09=09.... .... .... .... .... .... 0... .... =3D Normal: This fil= e has some attribute set =09=09=09=09=09.... .... .... .... .... .... .0.. .... =3D Device: This is = NOT a device =09=09=09=09=09.... .... .... .... .... .... ..0. .... =3D Archive: This fi= le has NOT been modified since last archive =09=09=09=09=09.... .... .... .... .... .... ...1 .... =3D Directory: This = is a DIRECTORY =09=09=09=09=09.... .... .... .... .... .... .... 0... =3D Volume ID: This = is NOT a volume ID =09=09=09=09=09.... .... .... .... .... .... .... .0.. =3D System: This is = NOT a system file =09=09=09=09=09.... .... .... .... .... .... .... ..0. =3D Hidden: This is = NOT a hidden file =09=09=09=09=09.... .... .... .... .... .... .... ...0 =3D Read Only: This = file is NOT read only =09=09=09=09File Name Len: 2 =09=09=09=09File Name: . =09=09=09Find File Directory Info File: .. =09=09=09=09Next Entry Offset: 72 =09=09=09=09File Index: 0 =09=09=09=09Created: Apr 24, 2009 16:56:11.024191600 =09=09=09=09Last Access: Mar 1, 2010 14:13:56.979891600 =09=09=09=09Last Write: Mar 1, 2010 14:13:56.870541100 =09=09=09=09Change: Mar 1, 2010 14:13:56.870541100 =09=09=09=09End Of File: 0 =09=09=09=09Allocation Size: 0 =09=09=09=09File Attributes: 0x00000010 =09=09=09=09=09.... .... .... .... .0.. .... .... .... =3D Encrypted: This = is NOT an encrypted file =09=09=09=09=09.... .... .... .... ..0. .... .... .... =3D Content Indexed:= This file MAY be indexed by the content indexing service =09=09=09=09=09.... .... .... .... ...0 .... .... .... =3D Offline: This fi= le is NOT offline =09=09=09=09=09.... .... .... .... .... 0... .... .... =3D Compressed: This= is NOT a compressed file =09=09=09=09=09.... .... .... .... .... .0.. .... .... =3D Reparse Point: T= his file does NOT have an associated reparse point =09=09=09=09=09.... .... .... .... .... ..0. .... .... =3D Sparse: This is = NOT a sparse file =09=09=09=09=09.... .... .... .... .... ...0 .... .... =3D Temporary: This = is NOT a temporary file =09=09=09=09=09.... .... .... .... .... .... 0... .... =3D Normal: This fil= e has some attribute set =09=09=09=09=09.... .... .... .... .... .... .0.. .... =3D Device: This is = NOT a device =09=09=09=09=09.... .... .... .... .... .... ..0. .... =3D Archive: This fi= le has NOT been modified since last archive =09=09=09=09=09.... .... .... .... .... .... ...1 .... =3D Directory: This = is a DIRECTORY =09=09=09=09=09.... .... .... .... .... .... .... 0... =3D Volume ID: This = is NOT a volume ID =09=09=09=09=09.... .... .... .... .... .... .... .0.. =3D System: This is = NOT a system file =09=09=09=09=09.... .... .... .... .... .... .... ..0. =3D Hidden: This is = NOT a hidden file =09=09=09=09=09.... .... .... .... .... .... .... ...0 =3D Read Only: This = file is NOT read only =09=09=09=09File Name Len: 4 =09=09=09=09File Name: .. =09=09=09Find File Directory Info File: file1 =09=09=09=09Next Entry Offset: 80 =09=09=09=09File Index: 0 =09=09=09=09Created: Mar 1, 2010 14:13:01.851618100 =09=09=09=09Last Access: Mar 1, 2010 14:13:35.953352600 =09=09=09=09Last Write: Mar 1, 2010 14:13:35.953352600 =09=09=09=09Change: Mar 1, 2010 14:13:35.953352600 =09=09=09=09End Of File: 14 =09=09=09=09Allocation Size: 16 =09=09=09=09File Attributes: 0x00000020 =09=09=09=09=09.... .... .... .... .0.. .... .... .... =3D Encrypted: This = is NOT an encrypted file =09=09=09=09=09.... .... .... .... ..0. .... .... .... =3D Content Indexed:= This file MAY be indexed by the content indexing service =09=09=09=09=09.... .... .... .... ...0 .... .... .... =3D Offline: This fi= le is NOT offline =09=09=09=09=09.... .... .... .... .... 0... .... .... =3D Compressed: This= is NOT a compressed file =09=09=09=09=09.... .... .... .... .... .0.. .... .... =3D Reparse Point: T= his file does NOT have an associated reparse point =09=09=09=09=09.... .... .... .... .... ..0. .... .... =3D Sparse: This is = NOT a sparse file =09=09=09=09=09.... .... .... .... .... ...0 .... .... =3D Temporary: This = is NOT a temporary file =09=09=09=09=09.... .... .... .... .... .... 0... .... =3D Normal: This fil= e has some attribute set =09=09=09=09=09.... .... .... .... .... .... .0.. .... =3D Device: This is = NOT a device =09=09=09=09=09.... .... .... .... .... .... ..1. .... =3D Archive: This fi= le has been modified since last ARCHIVE =09=09=09=09=09.... .... .... .... .... .... ...0 .... =3D Directory: This = is NOT a directory =09=09=09=09=09.... .... .... .... .... .... .... 0... =3D Volume ID: This = is NOT a volume ID =09=09=09=09=09.... .... .... .... .... .... .... .0.. =3D System: This is = NOT a system file =09=09=09=09=09.... .... .... .... .... .... .... ..0. =3D Hidden: This is = NOT a hidden file =09=09=09=09=09.... .... .... .... .... .... .... ...0 =3D Read Only: This = file is NOT read only =09=09=09=09File Name Len: 10 =09=09=09=09File Name: file1 =09=09=09Find File Directory Info File: file2 =09=09=09=09Next Entry Offset: 80 =09=09=09=09File Index: 0 =09=09=09=09Created: Mar 1, 2010 14:13:50.653184100 =09=09=09=09Last Access: Mar 1, 2010 14:13:50.762534600 =09=09=09=09Last Write: Mar 1, 2010 14:13:50.762534600 =09=09=09=09Change: Mar 1, 2010 14:13:50.762534600 =09=09=09=09End Of File: 14 =09=09=09=09Allocation Size: 16 =09=09=09=09File Attributes: 0x00000020 =09=09=09=09=09.... .... .... .... .0.. .... .... .... =3D Encrypted: This = is NOT an encrypted file =09=09=09=09=09.... .... .... .... ..0. .... .... .... =3D Content Indexed:= This file MAY be indexed by the content indexing service =09=09=09=09=09.... .... .... .... ...0 .... .... .... =3D Offline: This fi= le is NOT offline =09=09=09=09=09.... .... .... .... .... 0... .... .... =3D Compressed: This= is NOT a compressed file =09=09=09=09=09.... .... .... .... .... .0.. .... .... =3D Reparse Point: T= his file does NOT have an associated reparse point =09=09=09=09=09.... .... .... .... .... ..0. .... .... =3D Sparse: This is = NOT a sparse file =09=09=09=09=09.... .... .... .... .... ...0 .... .... =3D Temporary: This = is NOT a temporary file =09=09=09=09=09.... .... .... .... .... .... 0... .... =3D Normal: This fil= e has some attribute set =09=09=09=09=09.... .... .... .... .... .... .0.. .... =3D Device: This is = NOT a device =09=09=09=09=09.... .... .... .... .... .... ..1. .... =3D Archive: This fi= le has been modified since last ARCHIVE =09=09=09=09=09.... .... .... .... .... .... ...0 .... =3D Directory: This = is NOT a directory =09=09=09=09=09.... .... .... .... .... .... .... 0... =3D Volume ID: This = is NOT a volume ID =09=09=09=09=09.... .... .... .... .... .... .... .0.. =3D System: This is = NOT a system file =09=09=09=09=09.... .... .... .... .... .... .... ..0. =3D Hidden: This is = NOT a hidden file =09=09=09=09=09.... .... .... .... .... .... .... ...0 =3D Read Only: This = file is NOT read only =09=09=09=09File Name Len: 10 =09=09=09=09File Name: file2 =09=09=09Find File Directory Info File: file3 =09=09=09=09Next Entry Offset: 0 =09=09=09=09File Index: 0 =09=09=09=09Created: Mar 1, 2010 14:13:56.870541100 =09=09=09=09Last Access: Mar 1, 2010 14:13:56.979891600 =09=09=09=09Last Write: Mar 1, 2010 14:13:56.979891600 =09=09=09=09Change: Mar 1, 2010 14:13:56.979891600 =09=09=09=09End Of File: 14 =09=09=09=09Allocation Size: 16 =09=09=09=09File Attributes: 0x00000020 =09=09=09=09=09.... .... .... .... .0.. .... .... .... =3D Encrypted: This = is NOT an encrypted file =09=09=09=09=09.... .... .... .... ..0. .... .... .... =3D Content Indexed:= This file MAY be indexed by the content indexing service =09=09=09=09=09.... .... .... .... ...0 .... .... .... =3D Offline: This fi= le is NOT offline =09=09=09=09=09.... .... .... .... .... 0... .... .... =3D Compressed: This= is NOT a compressed file =09=09=09=09=09.... .... .... .... .... .0.. .... .... =3D Reparse Point: T= his file does NOT have an associated reparse point =09=09=09=09=09.... .... .... .... .... ..0. .... .... =3D Sparse: This is = NOT a sparse file =09=09=09=09=09.... .... .... .... .... ...0 .... .... =3D Temporary: This = is NOT a temporary file =09=09=09=09=09.... .... .... .... .... .... 0... .... =3D Normal: This fil= e has some attribute set =09=09=09=09=09.... .... .... .... .... .... .0.. .... =3D Device: This is = NOT a device =09=09=09=09=09.... .... .... .... .... .... ..1. .... =3D Archive: This fi= le has been modified since last ARCHIVE =09=09=09=09=09.... .... .... .... .... .... ...0 .... =3D Directory: This = is NOT a directory =09=09=09=09=09.... .... .... .... .... .... .... 0... =3D Volume ID: This = is NOT a volume ID =09=09=09=09=09.... .... .... .... .... .... .... .0.. =3D System: This is = NOT a system file =09=09=09=09=09.... .... .... .... .... .... .... ..0. =3D Hidden: This is = NOT a hidden file =09=09=09=09=09.... .... .... .... .... .... .... ...0 =3D Read Only: This = file is NOT read only =09=09=09=09File Name Len: 10 =09=09=09=09File Name: file3 =09=09=09Unknown Data: 000000000000 No. Time Source Destination Protocol In= fo =09 6 0.114870 172.30.33.11 172.19.71.71 SMB Tra= ns2 Request, QUERY_PATH_INFO, Query File All Info, Path: \Temp\file1 Frame 6 (166 bytes on wire, 166 bytes captured) =09Arrival Time: Mar 1, 2010 15:05:49.613491000 =09[Time delta from previous captured frame: 0.000146000 seconds] =09[Time delta from previous displayed frame: 0.000146000 seconds] =09[Time since reference or first frame: 0.114870000 seconds] =09Frame Number: 6 =09Frame Length: 166 bytes =09Capture Length: 166 bytes =09[Frame is marked: False] =09[Protocols in frame: eth:ip:tcp:nbss:smb] =09[Coloring Rule Name: SMB] =09[Coloring Rule String: smb || nbss || nbns || nbipx || ipxsap || netbios= ] Ethernet II, Src: Inventec_dd:63:6b (00:1e:33:dd:63:6b), Dst: JuniperN_f8:1= 3:8b (b0:c6:9a:f8:13:8b) =09Destination: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b) =09=09Address: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b) =09=09.... ...0 .... .... .... .... =3D IG bit: Individual address (unicast= ) =09=09.... ..0. .... .... .... .... =3D LG bit: Globally unique address (fa= ctory default) =09Source: Inventec_dd:63:6b (00:1e:33:dd:63:6b) =09=09Address: Inventec_dd:63:6b (00:1e:33:dd:63:6b) =09=09.... ...0 .... .... .... .... =3D IG bit: Individual address (unicast= ) =09=09.... ..0. .... .... .... .... =3D LG bit: Globally unique address (fa= ctory default) =09Type: IP (0x0800) Internet Protocol, Src: 172.30.33.11 (172.30.33.11), Dst: 172.19.71.71 (172= .19.71.71) =09Version: 4 =09Header length: 20 bytes =09Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) =09=090000 00.. =3D Differentiated Services Codepoint: Default (0x00) =09=09.... ..0. =3D ECN-Capable Transport (ECT): 0 =09=09.... ...0 =3D ECN-CE: 0 =09Total Length: 152 =09Identification: 0x73bc (29628) =09Flags: 0x04 (Don't Fragment) =09=090... =3D Reserved bit: Not set =09=09.1.. =3D Don't fragment: Set =09=09..0. =3D More fragments: Not set =09Fragment offset: 0 =09Time to live: 64 =09Protocol: TCP (0x06) =09Header checksum: 0x0620 [correct] =09=09[Good: True] =09=09[Bad : False] =09Source: 172.30.33.11 (172.30.33.11) =09Destination: 172.19.71.71 (172.19.71.71) Transmission Control Protocol, Src Port: 55075 (55075), Dst Port: microsoft= -ds (445), Seq: 187, Ack: 657, Len: 100 =09Source port: 55075 (55075) =09Destination port: microsoft-ds (445) =09[Stream index: 0] =09Sequence number: 187 (relative sequence number) =09[Next sequence number: 287 (relative sequence number)] =09Acknowledgement number: 657 (relative ack number) =09Header length: 32 bytes =09Flags: 0x18 (PSH, ACK) =09=090... .... =3D Congestion Window Reduced (CWR): Not set =09=09.0.. .... =3D ECN-Echo: Not set =09=09..0. .... =3D Urgent: Not set =09=09...1 .... =3D Acknowledgement: Set =09=09.... 1... =3D Push: Set =09=09.... .0.. =3D Reset: Not set =09=09.... ..0. =3D Syn: Not set =09=09.... ...0 =3D Fin: Not set =09Window size: 1002 =09Checksum: 0x8cf3 [validation disabled] =09=09[Good Checksum: False] =09=09[Bad Checksum: False] =09Options: (12 bytes) =09=09NOP =09=09NOP =09=09Timestamps: TSval 6591865, TSecr 62822121 =09[SEQ/ACK analysis] =09=09[This is an ACK to the segment in frame: 5] =09=09[The RTT to ACK the segment was: 0.000146000 seconds] =09=09[Number of bytes in flight: 100] NetBIOS Session Service =09Message Type: Session message =09Length: 96 SMB (Server Message Block Protocol) =09SMB Header =09=09Server Component: SMB =09=09[Response in: 7] =09=09SMB Command: Trans2 (0x32) =09=09NT Status: STATUS_SUCCESS (0x00000000) =09=09Flags: 0x00 =09=09=090... .... =3D Request/Response: Message is a request to the server =09=09=09.0.. .... =3D Notify: Notify client only on open =09=09=09..0. .... =3D Oplocks: OpLock not requested/granted =09=09=09...0 .... =3D Canonicalized Pathnames: Pathnames are not canonical= ized =09=09=09.... 0... =3D Case Sensitivity: Path names are case sensitive =09=09=09.... ..0. =3D Receive Buffer Posted: Receive buffer has not been p= osted =09=09=09.... ...0 =3D Lock and Read: Lock&Read, Write&Unlock are not suppo= rted =09=09Flags2: 0xc001 =09=09=091... .... .... .... =3D Unicode Strings: Strings are Unicode =09=09=09.1.. .... .... .... =3D Error Code Type: Error codes are NT error = codes =09=09=09..0. .... .... .... =3D Execute-only Reads: Don't permit reads if = execute-only =09=09=09...0 .... .... .... =3D Dfs: Don't resolve pathnames with Dfs =09=09=09.... 0... .... .... =3D Extended Security Negotiation: Extended se= curity negotiation is not supported =09=09=09.... .... .0.. .... =3D Long Names Used: Path names in request are= not long file names =09=09=09.... .... .... .0.. =3D Security Signatures: Security signatures a= re not supported =09=09=09.... .... .... ..0. =3D Extended Attributes: Extended attributes a= re not supported =09=09=09.... .... .... ...1 =3D Long Names Allowed: Long file names are al= lowed in the response =09=09Process ID High: 0 =09=09Signature: 0000000000000000 =09=09Reserved: 0000 =09=09Tree ID: 4106 =09=09Process ID: 5657 =09=09User ID: 10241 =09=09Multiplex ID: 633 =09Trans2 Request (0x32) =09=09Word Count (WCT): 15 =09=09Total Parameter Count: 30 =09=09Total Data Count: 0 =09=09Max Parameter Count: 2 =09=09Max Data Count: 4000 =09=09Max Setup Count: 0 =09=09Reserved: 00 =09=09Flags: 0x0000 =09=09=09.... .... .... ..0. =3D One Way Transaction: Two way transaction =09=09=09.... .... .... ...0 =3D Disconnect TID: Do NOT disconnect TID =09=09Timeout: Return immediately (0) =09=09Reserved: 0000 =09=09Parameter Count: 30 =09=09Parameter Offset: 66 =09=09Data Count: 0 =09=09Data Offset: 0 =09=09Setup Count: 1 =09=09Reserved: 00 =09=09Subcommand: QUERY_PATH_INFO (0x0005) =09=09Byte Count (BCC): 31 =09=09Padding: 00 =09=09QUERY_PATH_INFO Parameters =09=09=09Level of Interest: Query File All Info (263) =09=09=09Reserved: 00000000 =09=09=09File Name: \Temp\file1 No. Time Source Destination Protocol In= fo =09 7 0.174305 172.19.71.71 172.30.33.11 SMB Tra= ns2 Response, QUERY_PATH_INFO Frame 7 (278 bytes on wire, 278 bytes captured) =09Arrival Time: Mar 1, 2010 15:05:49.672926000 =09[Time delta from previous captured frame: 0.059435000 seconds] =09[Time delta from previous displayed frame: 0.059435000 seconds] =09[Time since reference or first frame: 0.174305000 seconds] =09Frame Number: 7 =09Frame Length: 278 bytes =09Capture Length: 278 bytes =09[Frame is marked: False] =09[Protocols in frame: eth:ip:tcp:nbss:smb] =09[Coloring Rule Name: SMB] =09[Coloring Rule String: smb || nbss || nbns || nbipx || ipxsap || netbios= ] Ethernet II, Src: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b), Dst: Inventec_dd:6= 3:6b (00:1e:33:dd:63:6b) =09Destination: Inventec_dd:63:6b (00:1e:33:dd:63:6b) =09=09Address: Inventec_dd:63:6b (00:1e:33:dd:63:6b) =09=09.... ...0 .... .... .... .... =3D IG bit: Individual address (unicast= ) =09=09.... ..0. .... .... .... .... =3D LG bit: Globally unique address (fa= ctory default) =09Source: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b) =09=09Address: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b) =09=09.... ...0 .... .... .... .... =3D IG bit: Individual address (unicast= ) =09=09.... ..0. .... .... .... .... =3D LG bit: Globally unique address (fa= ctory default) =09Type: IP (0x0800) Internet Protocol, Src: 172.19.71.71 (172.19.71.71), Dst: 172.30.33.11 (172= .30.33.11) =09Version: 4 =09Header length: 20 bytes =09Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) =09=090000 00.. =3D Differentiated Services Codepoint: Default (0x00) =09=09.... ..0. =3D ECN-Capable Transport (ECT): 0 =09=09.... ...0 =3D ECN-CE: 0 =09Total Length: 264 =09Identification: 0x5620 (22048) =09Flags: 0x04 (Don't Fragment) =09=090... =3D Reserved bit: Not set =09=09.1.. =3D Don't fragment: Set =09=09..0. =3D More fragments: Not set =09Fragment offset: 0 =09Time to live: 125 =09Protocol: TCP (0x06) =09Header checksum: 0xe64b [correct] =09=09[Good: True] =09=09[Bad : False] =09Source: 172.19.71.71 (172.19.71.71) =09Destination: 172.30.33.11 (172.30.33.11) Transmission Control Protocol, Src Port: microsoft-ds (445), Dst Port: 5507= 5 (55075), Seq: 657, Ack: 287, Len: 212 =09Source port: microsoft-ds (445) =09Destination port: 55075 (55075) =09[Stream index: 0] =09Sequence number: 657 (relative sequence number) =09[Next sequence number: 869 (relative sequence number)] =09Acknowledgement number: 287 (relative ack number) =09Header length: 32 bytes =09Flags: 0x18 (PSH, ACK) =09=090... .... =3D Congestion Window Reduced (CWR): Not set =09=09.0.. .... =3D ECN-Echo: Not set =09=09..0. .... =3D Urgent: Not set =09=09...1 .... =3D Acknowledgement: Set =09=09.... 1... =3D Push: Set =09=09.... .0.. =3D Reset: Not set =09=09.... ..0. =3D Syn: Not set =09=09.... ...0 =3D Fin: Not set =09Window size: 64931 =09Checksum: 0x396b [validation disabled] =09=09[Good Checksum: False] =09=09[Bad Checksum: False] =09Options: (12 bytes) =09=09NOP =09=09NOP =09=09Timestamps: TSval 62822121, TSecr 6591865 =09[SEQ/ACK analysis] =09=09[This is an ACK to the segment in frame: 6] =09=09[The RTT to ACK the segment was: 0.059435000 seconds] =09=09[Number of bytes in flight: 212] NetBIOS Session Service =09Message Type: Session message =09Length: 208 SMB (Server Message Block Protocol) =09SMB Header =09=09Server Component: SMB =09=09[Response to: 6] =09=09[Time from request: 0.059435000 seconds] =09=09SMB Command: Trans2 (0x32) =09=09NT Status: STATUS_SUCCESS (0x00000000) =09=09Flags: 0x80 =09=09=091... .... =3D Request/Response: Message is a response to the clien= t/redirector =09=09=09.0.. .... =3D Notify: Notify client only on open =09=09=09..0. .... =3D Oplocks: OpLock not requested/granted =09=09=09...0 .... =3D Canonicalized Pathnames: Pathnames are not canonical= ized =09=09=09.... 0... =3D Case Sensitivity: Path names are case sensitive =09=09=09.... ..0. =3D Receive Buffer Posted: Receive buffer has not been p= osted =09=09=09.... ...0 =3D Lock and Read: Lock&Read, Write&Unlock are not suppo= rted =09=09Flags2: 0xc001 =09=09=091... .... .... .... =3D Unicode Strings: Strings are Unicode =09=09=09.1.. .... .... .... =3D Error Code Type: Error codes are NT error = codes =09=09=09..0. .... .... .... =3D Execute-only Reads: Don't permit reads if = execute-only =09=09=09...0 .... .... .... =3D Dfs: Don't resolve pathnames with Dfs =09=09=09.... 0... .... .... =3D Extended Security Negotiation: Extended se= curity negotiation is not supported =09=09=09.... .... .0.. .... =3D Long Names Used: Path names in request are= not long file names =09=09=09.... .... .... .0.. =3D Security Signatures: Security signatures a= re not supported =09=09=09.... .... .... ..0. =3D Extended Attributes: Extended attributes a= re not supported =09=09=09.... .... .... ...1 =3D Long Names Allowed: Long file names are al= lowed in the response =09=09Process ID High: 0 =09=09Signature: 0000000000000000 =09=09Reserved: 0000 =09=09Tree ID: 4106 =09=09Process ID: 5657 =09=09User ID: 10241 =09=09Multiplex ID: 633 =09Trans2 Response (0x32) =09=09Subcommand: QUERY_PATH_INFO (0x0005) =09=09[Level of Interest: Query File All Info (263)] =09=09[File Name: \Temp\file1] =09=09Word Count (WCT): 10 =09=09Total Parameter Count: 2 =09=09Total Data Count: 148 =09=09Reserved: 0000 =09=09Parameter Count: 2 =09=09Parameter Offset: 56 =09=09Parameter Displacement: 0 =09=09Data Count: 148 =09=09Data Offset: 60 =09=09Data Displacement: 0 =09=09Setup Count: 0 =09=09Reserved: 00 =09=09Byte Count (BCC): 153 =09=09Padding: 00 =09=09QUERY_PATH_INFO Parameters =09=09=09EA Error offset: 0 =09=09Padding: 0000 =09=09QUERY_PATH_INFO Data =09=09=09Created: Mar 1, 2010 14:13:01.851618100 =09=09=09Last Access: Mar 1, 2010 14:13:40.561695100 =09=09=09Last Write: Mar 1, 2010 14:13:35.953352600 =09=09=09Change: Mar 1, 2010 14:13:35.953352600 =09=09=09File Attributes: 0x00000020 =09=09=09=09.0.. .... .... .... =3D Encrypted: This is NOT an encrypted fil= e =09=09=09=09..0. .... .... .... =3D Content Indexed: This file MAY be index= ed by the content indexing service =09=09=09=09...0 .... .... .... =3D Offline: This file is NOT offline =09=09=09=09.... 0... .... .... =3D Compressed: This is NOT a compressed fi= le =09=09=09=09.... .0.. .... .... =3D Reparse Point: This file does NOT have = an associated reparse point =09=09=09=09.... ..0. .... .... =3D Sparse: This is NOT a sparse file =09=09=09=09.... ...0 .... .... =3D Temporary: This is NOT a temporary file =09=09=09=09.... .... 0... .... =3D Normal: This file has some attribute se= t =09=09=09=09.... .... .0.. .... =3D Device: This is NOT a device =09=09=09=09.... .... ..1. .... =3D Archive: This file has been modified si= nce last ARCHIVE =09=09=09=09.... .... ...0 .... =3D Directory: This is NOT a directory =09=09=09=09.... .... .... 0... =3D Volume ID: This is NOT a volume ID =09=09=09=09.... .... .... .0.. =3D System: This is NOT a system file =09=09=09=09.... .... .... ..0. =3D Hidden: This is NOT a hidden file =09=09=09=09.... .... .... ...0 =3D Read Only: This file is NOT read only =09=09=09Allocation Size: 16 =09=09=09End Of File: 14 =09=09=09Link Count: 1 =09=09=09Delete Pending: Normal, no pending delete (0) =09=09=09Is Directory: This is NOT a directory (0) =09=09=09EA List Length: 0 =09=09=09File Name Len: 76 =09=09=09File Name: \SLP\Temp\file1 No. Time Source Destination Protocol In= fo =09 8 0.174423 172.30.33.11 172.19.71.71 SMB Tra= ns2 Request, QUERY_PATH_INFO, Query File All Info, Path: \Temp\file2 Frame 8 (166 bytes on wire, 166 bytes captured) =09Arrival Time: Mar 1, 2010 15:05:49.673044000 =09[Time delta from previous captured frame: 0.000118000 seconds] =09[Time delta from previous displayed frame: 0.000118000 seconds] =09[Time since reference or first frame: 0.174423000 seconds] =09Frame Number: 8 =09Frame Length: 166 bytes =09Capture Length: 166 bytes =09[Frame is marked: False] =09[Protocols in frame: eth:ip:tcp:nbss:smb] =09[Coloring Rule Name: SMB] =09[Coloring Rule String: smb || nbss || nbns || nbipx || ipxsap || netbios= ] Ethernet II, Src: Inventec_dd:63:6b (00:1e:33:dd:63:6b), Dst: JuniperN_f8:1= 3:8b (b0:c6:9a:f8:13:8b) =09Destination: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b) =09=09Address: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b) =09=09.... ...0 .... .... .... .... =3D IG bit: Individual address (unicast= ) =09=09.... ..0. .... .... .... .... =3D LG bit: Globally unique address (fa= ctory default) =09Source: Inventec_dd:63:6b (00:1e:33:dd:63:6b) =09=09Address: Inventec_dd:63:6b (00:1e:33:dd:63:6b) =09=09.... ...0 .... .... .... .... =3D IG bit: Individual address (unicast= ) =09=09.... ..0. .... .... .... .... =3D LG bit: Globally unique address (fa= ctory default) =09Type: IP (0x0800) Internet Protocol, Src: 172.30.33.11 (172.30.33.11), Dst: 172.19.71.71 (172= .19.71.71) =09Version: 4 =09Header length: 20 bytes =09Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) =09=090000 00.. =3D Differentiated Services Codepoint: Default (0x00) =09=09.... ..0. =3D ECN-Capable Transport (ECT): 0 =09=09.... ...0 =3D ECN-CE: 0 =09Total Length: 152 =09Identification: 0x73bd (29629) =09Flags: 0x04 (Don't Fragment) =09=090... =3D Reserved bit: Not set =09=09.1.. =3D Don't fragment: Set =09=09..0. =3D More fragments: Not set =09Fragment offset: 0 =09Time to live: 64 =09Protocol: TCP (0x06) =09Header checksum: 0x061f [correct] =09=09[Good: True] =09=09[Bad : False] =09Source: 172.30.33.11 (172.30.33.11) =09Destination: 172.19.71.71 (172.19.71.71) Transmission Control Protocol, Src Port: 55075 (55075), Dst Port: microsoft= -ds (445), Seq: 287, Ack: 869, Len: 100 =09Source port: 55075 (55075) =09Destination port: microsoft-ds (445) =09[Stream index: 0] =09Sequence number: 287 (relative sequence number) =09[Next sequence number: 387 (relative sequence number)] =09Acknowledgement number: 869 (relative ack number) =09Header length: 32 bytes =09Flags: 0x18 (PSH, ACK) =09=090... .... =3D Congestion Window Reduced (CWR): Not set =09=09.0.. .... =3D ECN-Echo: Not set =09=09..0. .... =3D Urgent: Not set =09=09...1 .... =3D Acknowledgement: Set =09=09.... 1... =3D Push: Set =09=09.... .0.. =3D Reset: Not set =09=09.... ..0. =3D Syn: Not set =09=09.... ...0 =3D Fin: Not set =09Window size: 1002 =09Checksum: 0x89ac [validation disabled] =09=09[Good Checksum: False] =09=09[Bad Checksum: False] =09Options: (12 bytes) =09=09NOP =09=09NOP =09=09Timestamps: TSval 6591880, TSecr 62822121 =09[SEQ/ACK analysis] =09=09[This is an ACK to the segment in frame: 7] =09=09[The RTT to ACK the segment was: 0.000118000 seconds] =09=09[Number of bytes in flight: 100] NetBIOS Session Service =09Message Type: Session message =09Length: 96 SMB (Server Message Block Protocol) =09SMB Header =09=09Server Component: SMB =09=09[Response in: 9] =09=09SMB Command: Trans2 (0x32) =09=09NT Status: STATUS_SUCCESS (0x00000000) =09=09Flags: 0x00 =09=09=090... .... =3D Request/Response: Message is a request to the server =09=09=09.0.. .... =3D Notify: Notify client only on open =09=09=09..0. .... =3D Oplocks: OpLock not requested/granted =09=09=09...0 .... =3D Canonicalized Pathnames: Pathnames are not canonical= ized =09=09=09.... 0... =3D Case Sensitivity: Path names are case sensitive =09=09=09.... ..0. =3D Receive Buffer Posted: Receive buffer has not been p= osted =09=09=09.... ...0 =3D Lock and Read: Lock&Read, Write&Unlock are not suppo= rted =09=09Flags2: 0xc001 =09=09=091... .... .... .... =3D Unicode Strings: Strings are Unicode =09=09=09.1.. .... .... .... =3D Error Code Type: Error codes are NT error = codes =09=09=09..0. .... .... .... =3D Execute-only Reads: Don't permit reads if = execute-only =09=09=09...0 .... .... .... =3D Dfs: Don't resolve pathnames with Dfs =09=09=09.... 0... .... .... =3D Extended Security Negotiation: Extended se= curity negotiation is not supported =09=09=09.... .... .0.. .... =3D Long Names Used: Path names in request are= not long file names =09=09=09.... .... .... .0.. =3D Security Signatures: Security signatures a= re not supported =09=09=09.... .... .... ..0. =3D Extended Attributes: Extended attributes a= re not supported =09=09=09.... .... .... ...1 =3D Long Names Allowed: Long file names are al= lowed in the response =09=09Process ID High: 0 =09=09Signature: 0000000000000000 =09=09Reserved: 0000 =09=09Tree ID: 4106 =09=09Process ID: 5657 =09=09User ID: 10241 =09=09Multiplex ID: 634 =09Trans2 Request (0x32) =09=09Word Count (WCT): 15 =09=09Total Parameter Count: 30 =09=09Total Data Count: 0 =09=09Max Parameter Count: 2 =09=09Max Data Count: 4000 =09=09Max Setup Count: 0 =09=09Reserved: 00 =09=09Flags: 0x0000 =09=09=09.... .... .... ..0. =3D One Way Transaction: Two way transaction =09=09=09.... .... .... ...0 =3D Disconnect TID: Do NOT disconnect TID =09=09Timeout: Return immediately (0) =09=09Reserved: 0000 =09=09Parameter Count: 30 =09=09Parameter Offset: 66 =09=09Data Count: 0 =09=09Data Offset: 0 =09=09Setup Count: 1 =09=09Reserved: 00 =09=09Subcommand: QUERY_PATH_INFO (0x0005) =09=09Byte Count (BCC): 31 =09=09Padding: 00 =09=09QUERY_PATH_INFO Parameters =09=09=09Level of Interest: Query File All Info (263) =09=09=09Reserved: 00000000 =09=09=09File Name: \Temp\file2 No. Time Source Destination Protocol In= fo =09 9 0.230720 172.19.71.71 172.30.33.11 SMB Tra= ns2 Response, QUERY_PATH_INFO Frame 9 (278 bytes on wire, 278 bytes captured) =09Arrival Time: Mar 1, 2010 15:05:49.729341000 =09[Time delta from previous captured frame: 0.056297000 seconds] =09[Time delta from previous displayed frame: 0.056297000 seconds] =09[Time since reference or first frame: 0.230720000 seconds] =09Frame Number: 9 =09Frame Length: 278 bytes =09Capture Length: 278 bytes =09[Frame is marked: False] =09[Protocols in frame: eth:ip:tcp:nbss:smb] =09[Coloring Rule Name: SMB] =09[Coloring Rule String: smb || nbss || nbns || nbipx || ipxsap || netbios= ] Ethernet II, Src: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b), Dst: Inventec_dd:6= 3:6b (00:1e:33:dd:63:6b) =09Destination: Inventec_dd:63:6b (00:1e:33:dd:63:6b) =09=09Address: Inventec_dd:63:6b (00:1e:33:dd:63:6b) =09=09.... ...0 .... .... .... .... =3D IG bit: Individual address (unicast= ) =09=09.... ..0. .... .... .... .... =3D LG bit: Globally unique address (fa= ctory default) =09Source: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b) =09=09Address: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b) =09=09.... ...0 .... .... .... .... =3D IG bit: Individual address (unicast= ) =09=09.... ..0. .... .... .... .... =3D LG bit: Globally unique address (fa= ctory default) =09Type: IP (0x0800) Internet Protocol, Src: 172.19.71.71 (172.19.71.71), Dst: 172.30.33.11 (172= .30.33.11) =09Version: 4 =09Header length: 20 bytes =09Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) =09=090000 00.. =3D Differentiated Services Codepoint: Default (0x00) =09=09.... ..0. =3D ECN-Capable Transport (ECT): 0 =09=09.... ...0 =3D ECN-CE: 0 =09Total Length: 264 =09Identification: 0x567b (22139) =09Flags: 0x04 (Don't Fragment) =09=090... =3D Reserved bit: Not set =09=09.1.. =3D Don't fragment: Set =09=09..0. =3D More fragments: Not set =09Fragment offset: 0 =09Time to live: 125 =09Protocol: TCP (0x06) =09Header checksum: 0xe5f0 [correct] =09=09[Good: True] =09=09[Bad : False] =09Source: 172.19.71.71 (172.19.71.71) =09Destination: 172.30.33.11 (172.30.33.11) Transmission Control Protocol, Src Port: microsoft-ds (445), Dst Port: 5507= 5 (55075), Seq: 869, Ack: 387, Len: 212 =09Source port: microsoft-ds (445) =09Destination port: 55075 (55075) =09[Stream index: 0] =09Sequence number: 869 (relative sequence number) =09[Next sequence number: 1081 (relative sequence number)] =09Acknowledgement number: 387 (relative ack number) =09Header length: 32 bytes =09Flags: 0x18 (PSH, ACK) =09=090... .... =3D Congestion Window Reduced (CWR): Not set =09=09.0.. .... =3D ECN-Echo: Not set =09=09..0. .... =3D Urgent: Not set =09=09...1 .... =3D Acknowledgement: Set =09=09.... 1... =3D Push: Set =09=09.... .0.. =3D Reset: Not set =09=09.... ..0. =3D Syn: Not set =09=09.... ...0 =3D Fin: Not set =09Window size: 64831 =09Checksum: 0x94dd [validation disabled] =09=09[Good Checksum: False] =09=09[Bad Checksum: False] =09Options: (12 bytes) =09=09NOP =09=09NOP =09=09Timestamps: TSval 62822122, TSecr 6591880 =09[SEQ/ACK analysis] =09=09[This is an ACK to the segment in frame: 8] =09=09[The RTT to ACK the segment was: 0.056297000 seconds] =09=09[Number of bytes in flight: 212] NetBIOS Session Service =09Message Type: Session message =09Length: 208 SMB (Server Message Block Protocol) =09SMB Header =09=09Server Component: SMB =09=09[Response to: 8] =09=09[Time from request: 0.056297000 seconds] =09=09SMB Command: Trans2 (0x32) =09=09NT Status: STATUS_SUCCESS (0x00000000) =09=09Flags: 0x80 =09=09=091... .... =3D Request/Response: Message is a response to the clien= t/redirector =09=09=09.0.. .... =3D Notify: Notify client only on open =09=09=09..0. .... =3D Oplocks: OpLock not requested/granted =09=09=09...0 .... =3D Canonicalized Pathnames: Pathnames are not canonical= ized =09=09=09.... 0... =3D Case Sensitivity: Path names are case sensitive =09=09=09.... ..0. =3D Receive Buffer Posted: Receive buffer has not been p= osted =09=09=09.... ...0 =3D Lock and Read: Lock&Read, Write&Unlock are not suppo= rted =09=09Flags2: 0xc001 =09=09=091... .... .... .... =3D Unicode Strings: Strings are Unicode =09=09=09.1.. .... .... .... =3D Error Code Type: Error codes are NT error = codes =09=09=09..0. .... .... .... =3D Execute-only Reads: Don't permit reads if = execute-only =09=09=09...0 .... .... .... =3D Dfs: Don't resolve pathnames with Dfs =09=09=09.... 0... .... .... =3D Extended Security Negotiation: Extended se= curity negotiation is not supported =09=09=09.... .... .0.. .... =3D Long Names Used: Path names in request are= not long file names =09=09=09.... .... .... .0.. =3D Security Signatures: Security signatures a= re not supported =09=09=09.... .... .... ..0. =3D Extended Attributes: Extended attributes a= re not supported =09=09=09.... .... .... ...1 =3D Long Names Allowed: Long file names are al= lowed in the response =09=09Process ID High: 0 =09=09Signature: 0000000000000000 =09=09Reserved: 0000 =09=09Tree ID: 4106 =09=09Process ID: 5657 =09=09User ID: 10241 =09=09Multiplex ID: 634 =09Trans2 Response (0x32) =09=09Subcommand: QUERY_PATH_INFO (0x0005) =09=09[Level of Interest: Query File All Info (263)] =09=09[File Name: \Temp\file2] =09=09Word Count (WCT): 10 =09=09Total Parameter Count: 2 =09=09Total Data Count: 148 =09=09Reserved: 0000 =09=09Parameter Count: 2 =09=09Parameter Offset: 56 =09=09Parameter Displacement: 0 =09=09Data Count: 148 =09=09Data Offset: 60 =09=09Data Displacement: 0 =09=09Setup Count: 0 =09=09Reserved: 00 =09=09Byte Count (BCC): 153 =09=09Padding: 00 =09=09QUERY_PATH_INFO Parameters =09=09=09EA Error offset: 0 =09=09Padding: 0000 =09=09QUERY_PATH_INFO Data =09=09=09Created: Mar 1, 2010 14:13:50.653184100 =09=09=09Last Access: Mar 1, 2010 14:13:50.762534600 =09=09=09Last Write: Mar 1, 2010 14:13:50.762534600 =09=09=09Change: Mar 1, 2010 14:13:50.762534600 =09=09=09File Attributes: 0x00000020 =09=09=09=09.0.. .... .... .... =3D Encrypted: This is NOT an encrypted fil= e =09=09=09=09..0. .... .... .... =3D Content Indexed: This file MAY be index= ed by the content indexing service =09=09=09=09...0 .... .... .... =3D Offline: This file is NOT offline =09=09=09=09.... 0... .... .... =3D Compressed: This is NOT a compressed fi= le =09=09=09=09.... .0.. .... .... =3D Reparse Point: This file does NOT have = an associated reparse point =09=09=09=09.... ..0. .... .... =3D Sparse: This is NOT a sparse file =09=09=09=09.... ...0 .... .... =3D Temporary: This is NOT a temporary file =09=09=09=09.... .... 0... .... =3D Normal: This file has some attribute se= t =09=09=09=09.... .... .0.. .... =3D Device: This is NOT a device =09=09=09=09.... .... ..1. .... =3D Archive: This file has been modified si= nce last ARCHIVE =09=09=09=09.... .... ...0 .... =3D Directory: This is NOT a directory =09=09=09=09.... .... .... 0... =3D Volume ID: This is NOT a volume ID =09=09=09=09.... .... .... .0.. =3D System: This is NOT a system file =09=09=09=09.... .... .... ..0. =3D Hidden: This is NOT a hidden file =09=09=09=09.... .... .... ...0 =3D Read Only: This file is NOT read only =09=09=09Allocation Size: 16 =09=09=09End Of File: 14 =09=09=09Link Count: 1 =09=09=09Delete Pending: Normal, no pending delete (0) =09=09=09Is Directory: This is NOT a directory (0) =09=09=09EA List Length: 0 =09=09=09File Name Len: 76 =09=09=09File Name: \SLP\Temp\file2 No. Time Source Destination Protocol In= fo =09 10 0.230837 172.30.33.11 172.19.71.71 SMB Tra= ns2 Request, QUERY_PATH_INFO, Query File All Info, Path: \Temp\file3 Frame 10 (166 bytes on wire, 166 bytes captured) =09Arrival Time: Mar 1, 2010 15:05:49.729458000 =09[Time delta from previous captured frame: 0.000117000 seconds] =09[Time delta from previous displayed frame: 0.000117000 seconds] =09[Time since reference or first frame: 0.230837000 seconds] =09Frame Number: 10 =09Frame Length: 166 bytes =09Capture Length: 166 bytes =09[Frame is marked: False] =09[Protocols in frame: eth:ip:tcp:nbss:smb] =09[Coloring Rule Name: SMB] =09[Coloring Rule String: smb || nbss || nbns || nbipx || ipxsap || netbios= ] Ethernet II, Src: Inventec_dd:63:6b (00:1e:33:dd:63:6b), Dst: JuniperN_f8:1= 3:8b (b0:c6:9a:f8:13:8b) =09Destination: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b) =09=09Address: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b) =09=09.... ...0 .... .... .... .... =3D IG bit: Individual address (unicast= ) =09=09.... ..0. .... .... .... .... =3D LG bit: Globally unique address (fa= ctory default) =09Source: Inventec_dd:63:6b (00:1e:33:dd:63:6b) =09=09Address: Inventec_dd:63:6b (00:1e:33:dd:63:6b) =09=09.... ...0 .... .... .... .... =3D IG bit: Individual address (unicast= ) =09=09.... ..0. .... .... .... .... =3D LG bit: Globally unique address (fa= ctory default) =09Type: IP (0x0800) Internet Protocol, Src: 172.30.33.11 (172.30.33.11), Dst: 172.19.71.71 (172= .19.71.71) =09Version: 4 =09Header length: 20 bytes =09Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) =09=090000 00.. =3D Differentiated Services Codepoint: Default (0x00) =09=09.... ..0. =3D ECN-Capable Transport (ECT): 0 =09=09.... ...0 =3D ECN-CE: 0 =09Total Length: 152 =09Identification: 0x73be (29630) =09Flags: 0x04 (Don't Fragment) =09=090... =3D Reserved bit: Not set =09=09.1.. =3D Don't fragment: Set =09=09..0. =3D More fragments: Not set =09Fragment offset: 0 =09Time to live: 64 =09Protocol: TCP (0x06) =09Header checksum: 0x061e [correct] =09=09[Good: True] =09=09[Bad : False] =09Source: 172.30.33.11 (172.30.33.11) =09Destination: 172.19.71.71 (172.19.71.71) Transmission Control Protocol, Src Port: 55075 (55075), Dst Port: microsoft= -ds (445), Seq: 387, Ack: 1081, Len: 100 =09Source port: 55075 (55075) =09Destination port: microsoft-ds (445) =09[Stream index: 0] =09Sequence number: 387 (relative sequence number) =09[Next sequence number: 487 (relative sequence number)] =09Acknowledgement number: 1081 (relative ack number) =09Header length: 32 bytes =09Flags: 0x18 (PSH, ACK) =09=090... .... =3D Congestion Window Reduced (CWR): Not set =09=09.0.. .... =3D ECN-Echo: Not set =09=09..0. .... =3D Urgent: Not set =09=09...1 .... =3D Acknowledgement: Set =09=09.... 1... =3D Push: Set =09=09.... .0.. =3D Reset: Not set =09=09.... ..0. =3D Syn: Not set =09=09.... ...0 =3D Fin: Not set =09Window size: 1002 =09Checksum: 0x8665 [validation disabled] =09=09[Good Checksum: False] =09=09[Bad Checksum: False] =09Options: (12 bytes) =09=09NOP =09=09NOP =09=09Timestamps: TSval 6591894, TSecr 62822122 =09[SEQ/ACK analysis] =09=09[This is an ACK to the segment in frame: 9] =09=09[The RTT to ACK the segment was: 0.000117000 seconds] =09=09[Number of bytes in flight: 100] NetBIOS Session Service =09Message Type: Session message =09Length: 96 SMB (Server Message Block Protocol) =09SMB Header =09=09Server Component: SMB =09=09[Response in: 11] =09=09SMB Command: Trans2 (0x32) =09=09NT Status: STATUS_SUCCESS (0x00000000) =09=09Flags: 0x00 =09=09=090... .... =3D Request/Response: Message is a request to the server =09=09=09.0.. .... =3D Notify: Notify client only on open =09=09=09..0. .... =3D Oplocks: OpLock not requested/granted =09=09=09...0 .... =3D Canonicalized Pathnames: Pathnames are not canonical= ized =09=09=09.... 0... =3D Case Sensitivity: Path names are case sensitive =09=09=09.... ..0. =3D Receive Buffer Posted: Receive buffer has not been p= osted =09=09=09.... ...0 =3D Lock and Read: Lock&Read, Write&Unlock are not suppo= rted =09=09Flags2: 0xc001 =09=09=091... .... .... .... =3D Unicode Strings: Strings are Unicode =09=09=09.1.. .... .... .... =3D Error Code Type: Error codes are NT error = codes =09=09=09..0. .... .... .... =3D Execute-only Reads: Don't permit reads if = execute-only =09=09=09...0 .... .... .... =3D Dfs: Don't resolve pathnames with Dfs =09=09=09.... 0... .... .... =3D Extended Security Negotiation: Extended se= curity negotiation is not supported =09=09=09.... .... .0.. .... =3D Long Names Used: Path names in request are= not long file names =09=09=09.... .... .... .0.. =3D Security Signatures: Security signatures a= re not supported =09=09=09.... .... .... ..0. =3D Extended Attributes: Extended attributes a= re not supported =09=09=09.... .... .... ...1 =3D Long Names Allowed: Long file names are al= lowed in the response =09=09Process ID High: 0 =09=09Signature: 0000000000000000 =09=09Reserved: 0000 =09=09Tree ID: 4106 =09=09Process ID: 5657 =09=09User ID: 10241 =09=09Multiplex ID: 635 =09Trans2 Request (0x32) =09=09Word Count (WCT): 15 =09=09Total Parameter Count: 30 =09=09Total Data Count: 0 =09=09Max Parameter Count: 2 =09=09Max Data Count: 4000 =09=09Max Setup Count: 0 =09=09Reserved: 00 =09=09Flags: 0x0000 =09=09=09.... .... .... ..0. =3D One Way Transaction: Two way transaction =09=09=09.... .... .... ...0 =3D Disconnect TID: Do NOT disconnect TID =09=09Timeout: Return immediately (0) =09=09Reserved: 0000 =09=09Parameter Count: 30 =09=09Parameter Offset: 66 =09=09Data Count: 0 =09=09Data Offset: 0 =09=09Setup Count: 1 =09=09Reserved: 00 =09=09Subcommand: QUERY_PATH_INFO (0x0005) =09=09Byte Count (BCC): 31 =09=09Padding: 00 =09=09QUERY_PATH_INFO Parameters =09=09=09Level of Interest: Query File All Info (263) =09=09=09Reserved: 00000000 =09=09=09File Name: \Temp\file3 No. Time Source Destination Protocol In= fo =09 11 0.286786 172.19.71.71 172.30.33.11 SMB Tra= ns2 Response, QUERY_PATH_INFO Frame 11 (278 bytes on wire, 278 bytes captured) =09Arrival Time: Mar 1, 2010 15:05:49.785407000 =09[Time delta from previous captured frame: 0.055949000 seconds] =09[Time delta from previous displayed frame: 0.055949000 seconds] =09[Time since reference or first frame: 0.286786000 seconds] =09Frame Number: 11 =09Frame Length: 278 bytes =09Capture Length: 278 bytes =09[Frame is marked: False] =09[Protocols in frame: eth:ip:tcp:nbss:smb] =09[Coloring Rule Name: SMB] =09[Coloring Rule String: smb || nbss || nbns || nbipx || ipxsap || netbios= ] Ethernet II, Src: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b), Dst: Inventec_dd:6= 3:6b (00:1e:33:dd:63:6b) =09Destination: Inventec_dd:63:6b (00:1e:33:dd:63:6b) =09=09Address: Inventec_dd:63:6b (00:1e:33:dd:63:6b) =09=09.... ...0 .... .... .... .... =3D IG bit: Individual address (unicast= ) =09=09.... ..0. .... .... .... .... =3D LG bit: Globally unique address (fa= ctory default) =09Source: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b) =09=09Address: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b) =09=09.... ...0 .... .... .... .... =3D IG bit: Individual address (unicast= ) =09=09.... ..0. .... .... .... .... =3D LG bit: Globally unique address (fa= ctory default) =09Type: IP (0x0800) Internet Protocol, Src: 172.19.71.71 (172.19.71.71), Dst: 172.30.33.11 (172= .30.33.11) =09Version: 4 =09Header length: 20 bytes =09Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) =09=090000 00.. =3D Differentiated Services Codepoint: Default (0x00) =09=09.... ..0. =3D ECN-Capable Transport (ECT): 0 =09=09.... ...0 =3D ECN-CE: 0 =09Total Length: 264 =09Identification: 0x572f (22319) =09Flags: 0x04 (Don't Fragment) =09=090... =3D Reserved bit: Not set =09=09.1.. =3D Don't fragment: Set =09=09..0. =3D More fragments: Not set =09Fragment offset: 0 =09Time to live: 125 =09Protocol: TCP (0x06) =09Header checksum: 0xe53c [correct] =09=09[Good: True] =09=09[Bad : False] =09Source: 172.19.71.71 (172.19.71.71) =09Destination: 172.30.33.11 (172.30.33.11) Transmission Control Protocol, Src Port: microsoft-ds (445), Dst Port: 5507= 5 (55075), Seq: 1081, Ack: 487, Len: 212 =09Source port: microsoft-ds (445) =09Destination port: 55075 (55075) =09[Stream index: 0] =09Sequence number: 1081 (relative sequence number) =09[Next sequence number: 1293 (relative sequence number)] =09Acknowledgement number: 487 (relative ack number) =09Header length: 32 bytes =09Flags: 0x18 (PSH, ACK) =09=090... .... =3D Congestion Window Reduced (CWR): Not set =09=09.0.. .... =3D ECN-Echo: Not set =09=09..0. .... =3D Urgent: Not set =09=09...1 .... =3D Acknowledgement: Set =09=09.... 1... =3D Push: Set =09=09.... .0.. =3D Reset: Not set =09=09.... ..0. =3D Syn: Not set =09=09.... ...0 =3D Fin: Not set =09Window size: 64731 =09Checksum: 0xb726 [validation disabled] =09=09[Good Checksum: False] =09=09[Bad Checksum: False] =09Options: (12 bytes) =09=09NOP =09=09NOP =09=09Timestamps: TSval 62822122, TSecr 6591894 =09[SEQ/ACK analysis] =09=09[This is an ACK to the segment in frame: 10] =09=09[The RTT to ACK the segment was: 0.055949000 seconds] =09=09[Number of bytes in flight: 212] NetBIOS Session Service =09Message Type: Session message =09Length: 208 SMB (Server Message Block Protocol) =09SMB Header =09=09Server Component: SMB =09=09[Response to: 10] =09=09[Time from request: 0.055949000 seconds] =09=09SMB Command: Trans2 (0x32) =09=09NT Status: STATUS_SUCCESS (0x00000000) =09=09Flags: 0x80 =09=09=091... .... =3D Request/Response: Message is a response to the clien= t/redirector =09=09=09.0.. .... =3D Notify: Notify client only on open =09=09=09..0. .... =3D Oplocks: OpLock not requested/granted =09=09=09...0 .... =3D Canonicalized Pathnames: Pathnames are not canonical= ized =09=09=09.... 0... =3D Case Sensitivity: Path names are case sensitive =09=09=09.... ..0. =3D Receive Buffer Posted: Receive buffer has not been p= osted =09=09=09.... ...0 =3D Lock and Read: Lock&Read, Write&Unlock are not suppo= rted =09=09Flags2: 0xc001 =09=09=091... .... .... .... =3D Unicode Strings: Strings are Unicode =09=09=09.1.. .... .... .... =3D Error Code Type: Error codes are NT error = codes =09=09=09..0. .... .... .... =3D Execute-only Reads: Don't permit reads if = execute-only =09=09=09...0 .... .... .... =3D Dfs: Don't resolve pathnames with Dfs =09=09=09.... 0... .... .... =3D Extended Security Negotiation: Extended se= curity negotiation is not supported =09=09=09.... .... .0.. .... =3D Long Names Used: Path names in request are= not long file names =09=09=09.... .... .... .0.. =3D Security Signatures: Security signatures a= re not supported =09=09=09.... .... .... ..0. =3D Extended Attributes: Extended attributes a= re not supported =09=09=09.... .... .... ...1 =3D Long Names Allowed: Long file names are al= lowed in the response =09=09Process ID High: 0 =09=09Signature: 0000000000000000 =09=09Reserved: 0000 =09=09Tree ID: 4106 =09=09Process ID: 5657 =09=09User ID: 10241 =09=09Multiplex ID: 635 =09Trans2 Response (0x32) =09=09Subcommand: QUERY_PATH_INFO (0x0005) =09=09[Level of Interest: Query File All Info (263)] =09=09[File Name: \Temp\file3] =09=09Word Count (WCT): 10 =09=09Total Parameter Count: 2 =09=09Total Data Count: 148 =09=09Reserved: 0000 =09=09Parameter Count: 2 =09=09Parameter Offset: 56 =09=09Parameter Displacement: 0 =09=09Data Count: 148 =09=09Data Offset: 60 =09=09Data Displacement: 0 =09=09Setup Count: 0 =09=09Reserved: 00 =09=09Byte Count (BCC): 153 =09=09Padding: 00 =09=09QUERY_PATH_INFO Parameters =09=09=09EA Error offset: 0 =09=09Padding: 0000 =09=09QUERY_PATH_INFO Data =09=09=09Created: Mar 1, 2010 14:13:56.870541100 =09=09=09Last Access: Mar 1, 2010 14:13:56.979891600 =09=09=09Last Write: Mar 1, 2010 14:13:56.979891600 =09=09=09Change: Mar 1, 2010 14:13:56.979891600 =09=09=09File Attributes: 0x00000020 =09=09=09=09.0.. .... .... .... =3D Encrypted: This is NOT an encrypted fil= e =09=09=09=09..0. .... .... .... =3D Content Indexed: This file MAY be index= ed by the content indexing service =09=09=09=09...0 .... .... .... =3D Offline: This file is NOT offline =09=09=09=09.... 0... .... .... =3D Compressed: This is NOT a compressed fi= le =09=09=09=09.... .0.. .... .... =3D Reparse Point: This file does NOT have = an associated reparse point =09=09=09=09.... ..0. .... .... =3D Sparse: This is NOT a sparse file =09=09=09=09.... ...0 .... .... =3D Temporary: This is NOT a temporary file =09=09=09=09.... .... 0... .... =3D Normal: This file has some attribute se= t =09=09=09=09.... .... .0.. .... =3D Device: This is NOT a device =09=09=09=09.... .... ..1. .... =3D Archive: This file has been modified si= nce last ARCHIVE =09=09=09=09.... .... ...0 .... =3D Directory: This is NOT a directory =09=09=09=09.... .... .... 0... =3D Volume ID: This is NOT a volume ID =09=09=09=09.... .... .... .0.. =3D System: This is NOT a system file =09=09=09=09.... .... .... ..0. =3D Hidden: This is NOT a hidden file =09=09=09=09.... .... .... ...0 =3D Read Only: This file is NOT read only =09=09=09Allocation Size: 16 =09=09=09End Of File: 14 =09=09=09Link Count: 1 =09=09=09Delete Pending: Normal, no pending delete (0) =09=09=09Is Directory: This is NOT a directory (0) =09=09=09EA List Length: 0 =09=09=09File Name Len: 76 =09=09=09File Name: \SLP\Temp\file3 No. Time Source Destination Protocol In= fo =09 12 0.327224 172.30.33.11 172.19.71.71 TCP 550= 75 > microsoft-ds [ACK] Seq=3D487 Ack=3D1293 Win=3D1002 Len=3D0 TSV=3D65919= 18 TSER=3D62822122 Frame 12 (66 bytes on wire, 66 bytes captured) =09Arrival Time: Mar 1, 2010 15:05:49.825845000 =09[Time delta from previous captured frame: 0.040438000 seconds] =09[Time delta from previous displayed frame: 0.040438000 seconds] =09[Time since reference or first frame: 0.327224000 seconds] =09Frame Number: 12 =09Frame Length: 66 bytes =09Capture Length: 66 bytes =09[Frame is marked: False] =09[Protocols in frame: eth:ip:tcp] =09[Coloring Rule Name: TCP] =09[Coloring Rule String: tcp] Ethernet II, Src: Inventec_dd:63:6b (00:1e:33:dd:63:6b), Dst: JuniperN_f8:1= 3:8b (b0:c6:9a:f8:13:8b) =09Destination: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b) =09=09Address: JuniperN_f8:13:8b (b0:c6:9a:f8:13:8b) =09=09.... ...0 .... .... .... .... =3D IG bit: Individual address (unicast= ) =09=09.... ..0. .... .... .... .... =3D LG bit: Globally unique address (fa= ctory default) =09Source: Inventec_dd:63:6b (00:1e:33:dd:63:6b) =09=09Address: Inventec_dd:63:6b (00:1e:33:dd:63:6b) =09=09.... ...0 .... .... .... .... =3D IG bit: Individual address (unicast= ) =09=09.... ..0. .... .... .... .... =3D LG bit: Globally unique address (fa= ctory default) =09Type: IP (0x0800) Internet Protocol, Src: 172.30.33.11 (172.30.33.11), Dst: 172.19.71.71 (172= .19.71.71) =09Version: 4 =09Header length: 20 bytes =09Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) =09=090000 00.. =3D Differentiated Services Codepoint: Default (0x00) =09=09.... ..0. =3D ECN-Capable Transport (ECT): 0 =09=09.... ...0 =3D ECN-CE: 0 =09Total Length: 52 =09Identification: 0x73bf (29631) =09Flags: 0x04 (Don't Fragment) =09=090... =3D Reserved bit: Not set =09=09.1.. =3D Don't fragment: Set =09=09..0. =3D More fragments: Not set =09Fragment offset: 0 =09Time to live: 64 =09Protocol: TCP (0x06) =09Header checksum: 0x0681 [correct] =09=09[Good: True] =09=09[Bad : False] =09Source: 172.30.33.11 (172.30.33.11) =09Destination: 172.19.71.71 (172.19.71.71) Transmission Control Protocol, Src Port: 55075 (55075), Dst Port: microsoft= -ds (445), Seq: 487, Ack: 1293, Len: 0 =09Source port: 55075 (55075) =09Destination port: microsoft-ds (445) =09[Stream index: 0] =09Sequence number: 487 (relative sequence number) =09Acknowledgement number: 1293 (relative ack number) =09Header length: 32 bytes =09Flags: 0x10 (ACK) =09=090... .... =3D Congestion Window Reduced (CWR): Not set =09=09.0.. .... =3D ECN-Echo: Not set =09=09..0. .... =3D Urgent: Not set =09=09...1 .... =3D Acknowledgement: Set =09=09.... 0... =3D Push: Not set =09=09.... .0.. =3D Reset: Not set =09=09.... ..0. =3D Syn: Not set =09=09.... ...0 =3D Fin: Not set =09Window size: 1002 =09Checksum: 0xecd2 [validation disabled] =09=09[Good Checksum: False] =09=09[Bad Checksum: False] =09Options: (12 bytes) =09=09NOP =09=09NOP =09=09Timestamps: TSval 6591918, TSecr 62822122 =09[SEQ/ACK analysis] =09=09[This is an ACK to the segment in frame: 11] =09=09[The RTT to ACK the segment was: 0.040438000 seconds] ------=_Part_24088_25931338.1269421873506 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ linux-cifs-client mailing list [email protected] https://lists.samba.org/mailman/listinfo/linux-cifs-client ------=_Part_24088_25931338.1269421873506--