Wireshark · Ethereal-users: Re: [Ethereal-users] SMB Trans2 request

[Prize Jose <PJose@xxxxxxx>]

Hello,

Many  thanks for the detailed explanation, I looked for ' find, first,
next'. But I don't see any. Please see below the consecutive
request/response.

Client is Windows XP and server is Novel. Time between request/reponse is
not too large.

I am trying to find out the versions.  I found following posting on the web
which talks about 'file sharing problems'  with Win XP.

"""""
                                                                       
 There are numerous, 'improve file sharing performance', 'XP file sharing
 slower that Windows 2000' etc.  Start at                            
 http://support.microsoft.com/?kbid=811113 and see KB326826, KB834350 etc
                                                                       


""""""

These files are shared by muliple users and at any time there is a chance
that some one else is reading from the same file.

Can I attribute the following issue as  a Windows XP problem ?

   1019 46.923006   aaa.bbb.ccc.183        aaa.bbb.ccc.91         SMB
NT Create AndX Request, Path: \ICX0000W.BMP
   1020 46.923825   aaa.bbb.ccc.91         aaa.bbb.ccc.183        SMB
NT Create AndX Response, Error: STATUS_ACCESS_DENIED
   1021 46.923999   aaa.bbb.ccc.183        aaa.bbb.ccc.91         SMB
NT Create AndX Request, Path: \ICX0000W.BMP
   1022 46.924863   aaa.bbb.ccc.91         aaa.bbb.ccc.183        SMB
NT Create AndX Response, Error: STATUS_ACCESS_DENIED
   1023 46.924964   aaa.bbb.ccc.183        aaa.bbb.ccc.91         SMB
NT Create AndX Request, Path: \ICX0000W.BMP
   1024 46.926230   aaa.bbb.ccc.91         aaa.bbb.ccc.183        SMB
NT Create AndX Response, FID: 0x0008
   1025 46.926315   aaa.bbb.ccc.183        aaa.bbb.ccc.91         SMB
Trans2 Request, QUERY_FILE_INFO, FID: 0x0008, Query File Standard Info
   1026 46.927194   aaa.bbb.ccc.91         aaa.bbb.ccc.183        SMB
Trans2 Response, QUERY_FILE_INFO
   1027 46.927289   aaa.bbb.ccc.183        aaa.bbb.ccc.91         SMB
Trans2 Request, QUERY_FILE_INFO, FID: 0x0008, Query File Standard Info
   1028 46.928087   aaa.bbb.ccc.91         aaa.bbb.ccc.183        SMB
Trans2 Response, QUERY_FILE_INFO
   1029 46.928159   aaa.bbb.ccc.183        aaa.bbb.ccc.91         SMB
Read AndX Request, FID: 0x0008, 630 bytes at offset 0
   1030 46.928543   aaa.bbb.ccc.91         aaa.bbb.ccc.183        SMB
Read AndX Response, FID: 0x0008, 630 bytes
   1031 46.928722   aaa.bbb.ccc.183        aaa.bbb.ccc.91         SMB
Trans2 Request, QUERY_FILE_INFO, FID: 0x0008, Query File Standard Info
   1032 46.929293   aaa.bbb.ccc.91         aaa.bbb.ccc.183        SMB
Trans2 Response, QUERY_FILE_INFO
   1033 46.929398   aaa.bbb.ccc.183        aaa.bbb.ccc.91         SMB
Trans2 Request, QUERY_FILE_INFO, FID: 0x0008, Query File Standard Info
   1034 46.929666   aaa.bbb.ccc.91         aaa.bbb.ccc.183        SMB
Trans2 Response, QUERY_FILE_INFO
   1035 46.929744   aaa.bbb.ccc.183        aaa.bbb.ccc.91         SMB
Trans2 Request, QUERY_FILE_INFO, FID: 0x0008, Query File Standard Info
   1036 46.930199   aaa.bbb.ccc.91         aaa.bbb.ccc.183        SMB
Trans2 Response, QUERY_FILE_INFO
   1037 46.930238   aaa.bbb.ccc.183        aaa.bbb.ccc.91         SMB
Trans2 Request, QUERY_FILE_INFO, FID: 0x0008, Query File Standard Info
   1038 46.930484   aaa.bbb.ccc.91         aaa.bbb.ccc.183        SMB
Trans2 Response, QUERY_FILE_INFO
   1039 46.930688   aaa.bbb.ccc.183        aaa.bbb.ccc.91         SMB
Trans2 Request, QUERY_FILE_INFO, FID: 0x0008, Query File Standard Info
   1040 46.931674   aaa.bbb.ccc.91         aaa.bbb.ccc.183        SMB
Trans2 Response, QUERY_FILE_INFO
   1041 46.931886   aaa.bbb.ccc.183        aaa.bbb.ccc.91         SMB
Trans2 Request, QUERY_FILE_INFO, FID: 0x0008, Query File Standard Info
   1042 46.932808   aaa.bbb.ccc.91         aaa.bbb.ccc.183        SMB
Trans2 Response, QUERY_FILE_INFO
   1043 46.932943   aaa.bbb.ccc.183        aaa.bbb.ccc.91         SMB
Trans2 Request, QUERY_FILE_INFO, FID: 0x0008, Query File Standard Info
   1044 46.933138   aaa.bbb.ccc.91         aaa.bbb.ccc.183        SMB
Trans2 Response, QUERY_FILE_INFO
   1045 46.933180   aaa.bbb.ccc.183        aaa.bbb.ccc.91         SMB
Trans2 Request, QUERY_FILE_INFO, FID: 0x0008, Query File Standard Info
   1046 46.933718   aaa.bbb.ccc.91         aaa.bbb.ccc.183        SMB
Trans2 Response, QUERY_FILE_INFO
   1047 46.933774   aaa.bbb.ccc.183        aaa.bbb.ccc.91         SMB
Trans2 Request, QUERY_FILE_INFO, FID: 0x0008, Query File Standard Info
   1048 46.934373   aaa.bbb.ccc.91         aaa.bbb.ccc.183        SMB
Trans2 Response, QUERY_FILE_INFO
   1049 46.934482   aaa.bbb.ccc.183        aaa.bbb.ccc.91         SMB
Close Request, FID: 0x0008
   1050 46.935009   aaa.bbb.ccc.91         aaa.bbb.ccc.183        SMB
Close Response

Here is one expanded request/response

Frame 1025

    Trans2 Request (0x32)
        Word Count (WCT): 15
        Total Parameter Count: 4
        Total Data Count: 0
        Max Parameter Count: 2
        Max Data Count: 24
        Max Setup Count: 0
        Reserved: 00
        Flags: 0x0000
        Timeout: Return immediately (0)
        Reserved: 0000
        Parameter Count: 4
        Parameter Offset: 68
        Data Count: 0
        Data Offset: 0
        Setup Count: 1
        Reserved: 00
        Subcommand: QUERY_FILE_INFO (0x0007)
        Byte Count (BCC): 7
        Padding: 000000
        QUERY_FILE_INFO Parameters
            FID: 0x0008
            Level of Interest: Query File Standard Info (1005)


Frame 1026 (142 bytes on wire, 142 bytes captured)

    Trans2 Response (0x32)
        Subcommand: QUERY_FILE_INFO (0x0007)
        Word Count (WCT): 10
        Total Parameter Count: 2
        Total Data Count: 24
        Reserved: 0000
        Parameter Count: 2
        Parameter Offset: 56
        Parameter Displacement: 0
        Data Count: 24
        Data Offset: 60
        Data Displacement: 0
        Setup Count: 0
        Reserved: 00
        Byte Count (BCC): 29
        Padding: 00
        QUERY_FILE_INFO Parameters
            EA Error offset: 0
        Padding: 0001
        QUERY_FILE_INFO Data
            Allocation Size: 632
            End Of File: 630
            Link Count: 1
            Delete Pending: Normal, no pending delete (0)
            Is Directory: This is NOT a directory (0)
            Unknown Data: 0000

Thanks for any help,

Prize




                                                                       
             Guy Harris                                                
             <gharris@xxxxxxxx                                         
             t>                                                         To
             Sent by:                  Ethereal user support           
             ethereal-users-bo         <ethereal-users@xxxxxxxxxxxx>   
             unces@xxxxxxxxxxx                                          cc
             m                                                         
                                                                   Subject
                                       Re: [Ethereal-users] SMB Trans2 
             03/04/2005 01:46          request                         
             PM                                                        
                                                                       
                                                                       
             Please respond to                                         
               Ethereal user                                           
                  support                                              
             <ethereal-users@e                                         
               thereal.com>                                            
                                                                       
                                                                       




Prize Jose wrote:

> Can some one please explain me the meaning of  'SMB Trans2 ' request and
> response.

SMB's "transaction" mechanism is used to implement requests and
responses that could transfer more data than the limited amounts some
mechanisms over which SMB is sent allow in a single packet.

Several different types of operations, including the operations that
scan directories and return information about the files and
subdirectories in that directory, use the "transaction" mechanism.  The
directory-scanning operations are probably the most frequently seen
operations that use the "trans2" request, and:

> Subcommand: QUERY_FILE_INFO (0x0007)

...that's probably what the Trans2 request you sent is (you'll probably
see "find first" or "find next" (perhaps all capitalized, and perhaps
with underscores or nothing between "find" and "first" or "next") in the
dissection of those requests.

If the time between the request and the response is large, this might be
a problem with the server - scanning a large directory might be slow.
What operating system is the server running and, if it's some flavor of
UN*X (commercial UN*X including Mac OS X, Linux, some flavor of BSD), is
it using Samba and, if so, what version of Samba is it using?

_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
 http://www.ethereal.com/mailman/listinfo/ethereal-users