Display Filter Reference: SMB (Server Message Block Protocol)
Protocol field name: smb
Versions: 1.0.0 to 4.4.1
Back to Display Filter Reference
| Field name | Description | Type | Versions |
|---|---|---|---|
| nt | Access required | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| nt | Access SACL | Boolean | 1.0.0 to 4.4.1 |
| nt | Delete | Boolean | 1.0.0 to 4.4.1 |
| nt | Generic all | Boolean | 1.0.0 to 4.4.1 |
| nt | Generic execute | Boolean | 1.0.0 to 4.4.1 |
| nt | Generic read | Boolean | 1.0.0 to 4.4.1 |
| nt | Generic write | Boolean | 1.0.0 to 4.4.1 |
| nt | Maximum allowed | Boolean | 1.0.0 to 4.4.1 |
| nt | Read control | Boolean | 1.0.0 to 4.4.1 |
| nt | Specific access, bit 0 | Boolean | 1.0.0 to 4.4.1 |
| nt | Specific access, bit 1 | Boolean | 1.0.0 to 4.4.1 |
| nt | Specific access, bit 10 | Boolean | 1.0.0 to 4.4.1 |
| nt | Specific access, bit 11 | Boolean | 1.0.0 to 4.4.1 |
| nt | Specific access, bit 12 | Boolean | 1.0.0 to 4.4.1 |
| nt | Specific access, bit 13 | Boolean | 1.0.0 to 4.4.1 |
| nt | Specific access, bit 14 | Boolean | 1.0.0 to 4.4.1 |
| nt | Specific access, bit 15 | Boolean | 1.0.0 to 4.4.1 |
| nt | Specific access, bit 2 | Boolean | 1.0.0 to 4.4.1 |
| nt | Specific access, bit 3 | Boolean | 1.0.0 to 4.4.1 |
| nt | Specific access, bit 4 | Boolean | 1.0.0 to 4.4.1 |
| nt | Specific access, bit 5 | Boolean | 1.0.0 to 4.4.1 |
| nt | Specific access, bit 6 | Boolean | 1.0.0 to 4.4.1 |
| nt | Specific access, bit 7 | Boolean | 1.0.0 to 4.4.1 |
| nt | Specific access, bit 8 | Boolean | 1.0.0 to 4.4.1 |
| nt | Specific access, bit 9 | Boolean | 1.0.0 to 4.4.1 |
| nt | Synchronise | Boolean | 1.0.0 to 4.4.1 |
| nt | Write DAC | Boolean | 1.0.0 to 4.4.1 |
| nt | Write owner | Boolean | 1.0.0 to 4.4.1 |
| nt | Conditional Expression | Label | 3.6.0 to 4.4.1 |
| nt | BASE | Unsigned integer (8 bits) | 3.6.0 to 4.4.1 |
| nt | DEVICE_ATTRIBUTE | Character string | 3.6.0 to 4.4.1 |
| nt | LOCAL_ATTRIBUTE | Character string | 3.6.0 to 4.4.1 |
| nt | RESOURCE_ATTRIBUTE | Character string | 3.6.0 to 4.4.1 |
| nt | SIGN | Unsigned integer (8 bits) | 3.6.0 to 4.4.1 |
| nt | Token | Unsigned integer (8 bits) | 3.6.0 to 4.4.1 |
| nt | USER_ATTRIBUTE | Character string | 3.6.0 to 4.4.1 |
| nt | INT16 | Signed integer (16 bits) | 3.6.0 to 4.4.1 |
| nt | INT32 | Signed integer (32 bits) | 3.6.0 to 4.4.1 |
| nt | INT64 | Signed integer (64 bits) | 3.6.0 to 4.4.1 |
| nt | INT8 | Signed integer (8 bits) | 3.6.0 to 4.4.1 |
| nt | OCTET_STRING | Byte sequence | 3.6.0 to 4.4.1 |
| nt | UNICODE_STRING | Character string | 3.6.0 to 4.4.1 |
| nt | NT ACE Flags | Unsigned integer (8 bits) | 2.0.0 to 4.4.1 |
| nt | Container Inherit | Boolean | 1.0.0 to 4.4.1 |
| nt | Audit Failed Accesses | Boolean | 1.0.0 to 4.4.1 |
| nt | Inherit Only | Boolean | 1.0.0 to 4.4.1 |
| nt | Inherited ACE | Boolean | 1.0.0 to 4.4.1 |
| nt | Non-Propagate Inherit | Boolean | 1.0.0 to 4.4.1 |
| nt | Object Inherit | Boolean | 1.0.0 to 4.4.1 |
| nt | Audit Successful Accesses | Boolean | 1.0.0 to 4.4.1 |
| nt | ACE Object Flags | Unsigned integer (32 bits) | 2.0.0 to 4.4.1 |
| nt | Inherited Object Type Present | Boolean | 1.0.0 to 4.4.1 |
| nt | Object Type Present | Boolean | 1.0.0 to 4.4.1 |
| nt | GUID | Globally Unique Identifier | 1.0.0 to 4.4.1 |
| nt | Inherited GUID | Globally Unique Identifier | 1.0.0 to 4.4.1 |
| nt | Size | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| nt | Resource Attribute | Label | 3.6.0 to 4.4.1 |
| nt | Flags | Unsigned integer (32 bits) | 3.6.0 to 4.4.1 |
| nt | Case Sensitive | Boolean | 3.6.0 to 4.4.1 |
| nt | Deny Only | Boolean | 3.6.0 to 4.4.1 |
| nt | Disabled | Boolean | 3.6.0 to 4.4.1 |
| nt | Disabled By Default | Boolean | 3.6.0 to 4.4.1 |
| nt | Mandatory | Boolean | 3.6.0 to 4.4.1 |
| nt | Manual | Boolean | 3.6.0 to 4.4.1 |
| nt | Non-Inheritable | Boolean | 3.6.0 to 4.4.1 |
| nt | Policy Derived | Boolean | 3.6.0 to 4.4.1 |
| nt | Name | Character string | 3.6.0 to 4.4.1 |
| nt | Name Offset | Unsigned integer (32 bits) | 3.6.0 to 4.4.1 |
| nt | Reserved | Unsigned integer (16 bits) | 3.6.0 to 4.4.1 |
| nt | Type | Unsigned integer (16 bits) | 3.6.0 to 4.4.1 |
| nt | BOOLEAN | Unsigned integer (64 bits) | 3.6.0 to 4.4.1 |
| nt | Value Count | Unsigned integer (32 bits) | 3.6.0 to 4.4.1 |
| nt | INT64 | Signed integer (64 bits) | 3.6.0 to 4.4.1 |
| nt | OCTET_STRING | Byte sequence | 3.6.0 to 4.4.1 |
| nt | SID | Character string | 3.6.0 to 4.4.1 |
| nt | STRING | Character string | 3.6.0 to 4.4.1 |
| nt | UINT64 | Unsigned integer (64 bits) | 3.6.0 to 4.4.1 |
| nt | Type | Unsigned integer (8 bits) | 1.0.0 to 4.4.1 |
| nt | ACE Extends beyond end of captured data | Label | 2.0.0 to 2.6.20 |
| nt | ACE Extends beyond end of data | Label | 3.0.0 to 4.4.1 |
| nt | ACE Extends beyond end of reassembled data | Label | 2.0.0 to 4.4.1 |
| nt | Num ACEs | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| nt | Revision | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| nt | Size | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| nt | Group SID beyond end of captured data | Label | 2.0.0 to 2.6.20 |
| nt | Group SID beyond end of data | Label | 3.0.0 to 4.4.1 |
| nt | Group SID beyond end of reassembled data | Label | 2.0.0 to 4.4.1 |
| nt | Item offset is out of range | Label | 2.6.0 to 4.4.1 |
| nt | Offset to DACL | Unsigned integer (32 bits) | 2.0.0 to 4.4.1 |
| nt | Offset to group SID | Unsigned integer (32 bits) | 2.0.0 to 4.4.1 |
| nt | Offset to owner SID | Unsigned integer (32 bits) | 2.0.0 to 4.4.1 |
| nt | Offset to SACL | Unsigned integer (32 bits) | 2.0.0 to 4.4.1 |
| nt | Owner SID beyond end of captured data | Label | 2.0.0 to 2.6.20 |
| nt | Owner SID beyond end of data | Label | 3.0.0 to 4.4.1 |
| nt | Owner SID beyond end of reassembled data | Label | 2.0.0 to 4.4.1 |
| nt | Revision | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| nt | Type | Unsigned integer (16 bits) | 2.0.0 to 4.4.1 |
| nt | DACL Auto Inherit Required | Boolean | 1.0.0 to 4.4.1 |
| nt | DACL Auto Inherited | Boolean | 1.0.0 to 4.4.1 |
| nt | DACL Defaulted | Boolean | 1.0.0 to 4.4.1 |
| nt | DACL Present | Boolean | 1.0.0 to 4.4.1 |
| nt | DACL Protected | Boolean | 1.0.0 to 4.4.1 |
| nt | DACL Trusted | Boolean | 1.0.0 to 4.4.1 |
| nt | Group Defaulted | Boolean | 1.0.0 to 4.4.1 |
| nt | Owner Defaulted | Boolean | 1.0.0 to 4.4.1 |
| nt | RM Control Valid | Boolean | 1.0.0 to 4.4.1 |
| nt | SACL Auto Inherit Required | Boolean | 1.0.0 to 4.4.1 |
| nt | SACL Auto Inherited | Boolean | 1.0.0 to 4.4.1 |
| nt | SACL Defaulted | Boolean | 1.0.0 to 4.4.1 |
| nt | SACL Present | Boolean | 1.0.0 to 4.4.1 |
| nt | SACL Protected | Boolean | 1.0.0 to 4.4.1 |
| nt | Self Relative | Boolean | 1.0.0 to 4.4.1 |
| nt | Server Security | Boolean | 1.0.0 to 4.4.1 |
| nt | SEC INFO | Unsigned integer (32 bits) | 2.0.0 to 4.4.1 |
| nt | DACL | Boolean | 1.2.0 to 4.4.1 |
| nt | Group | Boolean | 1.2.0 to 4.4.1 |
| nt | Owner | Boolean | 1.2.0 to 4.4.1 |
| nt | SACL | Boolean | 1.2.0 to 4.4.1 |
| nt | SID | Character string | 1.0.0 to 4.4.1 |
| nt | Authority | Unsigned integer (64 bits) | 1.6.0 to 4.4.1 |
| nt | Domain | Character string | 1.6.0 to 4.4.1 |
| nt | Num Auth | Unsigned integer (8 bits) | 1.0.0 to 4.4.1 |
| nt | Revision | Unsigned integer (8 bits) | 1.0.0 to 4.4.1 |
| nt | RID | Unsigned integer (32 bits) | 1.6.0 to 4.4.1 |
| nt | Subauthorities | Character string | 1.6.0 to 4.4.1 |
| nt | Well-known SID | Character string | 1.6.0 to 4.4.1 |
| smb | Append | Boolean | 1.0.0 to 4.4.1 |
| smb | Caching | Boolean | 1.0.0 to 4.4.1 |
| smb | Delete | Boolean | 1.0.0 to 4.4.1 |
| smb | Delete Child | Boolean | 1.0.0 to 4.4.1 |
| smb | Desired Access | Unsigned integer (16 bits) | 2.0.0 to 4.4.1 |
| smb | Execute | Boolean | 1.0.0 to 4.4.1 |
| smb | Generic All | Boolean | 1.0.0 to 4.4.1 |
| smb | Generic Execute | Boolean | 1.0.0 to 4.4.1 |
| smb | Generic Read | Boolean | 1.0.0 to 4.4.1 |
| smb | Generic Write | Boolean | 1.0.0 to 4.4.1 |
| smb | Granted Access | Unsigned integer (16 bits) | 2.0.0 to 4.4.1 |
| smb | Locality | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Maximum Allowed | Boolean | 1.0.0 to 4.4.1 |
| smb | Access Mode | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Read | Boolean | 1.0.0 to 4.4.1 |
| smb | Read Attributes | Boolean | 1.0.0 to 4.4.1 |
| smb | Read Control | Boolean | 1.0.0 to 4.4.1 |
| smb | Read EA | Boolean | 1.0.0 to 4.4.1 |
| smb | Sharing Mode | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Last Access Date | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Last Access Time | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Synchronize | Boolean | 1.0.0 to 4.4.1 |
| smb | System Security | Boolean | 1.0.0 to 4.4.1 |
| smb | Last Access | Date and time | 1.0.0 to 4.4.1 |
| smb | Write | Boolean | 1.0.0 to 4.4.1 |
| smb | Write Attributes | Boolean | 1.0.0 to 4.4.1 |
| smb | Write DAC | Boolean | 1.0.0 to 4.4.1 |
| smb | Write EA | Boolean | 1.0.0 to 4.4.1 |
| smb | Write Owner | Boolean | 1.0.0 to 4.4.1 |
| smb | Writethrough | Boolean | 1.0.0 to 4.4.1 |
| smb | Access Mask | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Account | Character string | 1.0.0 to 4.4.1 |
| smb | Actual Free Units | Unsigned integer (64 bits) | 1.0.0 to 4.4.1 |
| smb | Alignment | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Allocation Block Count | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Allocation Block Count | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Allocation Size | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Allocation Size | Unsigned integer (64 bits) | 2.2.0 to 4.4.1 |
| smb | AndXOffset | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | ANSI Password | Byte sequence | 1.0.0 to 4.4.1 |
| smb | ANSI Password Length | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Attribute | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Available Units | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Backed-up | Date and time | 1.0.0 to 4.4.1 |
| smb | Byte Count (BCC) | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Block Size | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Blocks Per Unit | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Buffer Format | Unsigned integer (8 bits) | 1.0.0 to 4.4.1 |
| smb | Byte parameters | Byte sequence | 2.0.0 to 4.4.1 |
| smb | Bytes remaining until TDC | Unsigned integer (16 bits) | 4.4.0 to 4.4.1 |
| smb | Caller Free Units | Unsigned integer (64 bits) | 1.0.0 to 4.4.1 |
| smb | Cancel to | Frame number | 1.0.0 to 4.4.1 |
| smb | Challenge | Byte sequence | 2.0.0 to 4.4.1 |
| smb | Challenge Length | Unsigned integer (16 bits) | 2.0.0 to 4.4.1 |
| smb | Change | Date and time | 1.0.0 to 4.4.1 |
| smb | Change Count | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | SMB Command | Unsigned integer (8 bits) | 1.0.0 to 4.4.1 |
| smb | Chunk Shift | Unsigned integer (8 bits) | 1.0.0 to 4.4.1 |
| smb | Cluster Shift | Unsigned integer (8 bits) | 1.0.0 to 4.4.1 |
| smb | Compressed Size | Unsigned integer (64 bits) | 1.0.0 to 4.4.1 |
| smb | Compression Format | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Unit Shift | Unsigned integer (8 bits) | 1.0.0 to 4.4.1 |
| smb | Flags | Unsigned integer (16 bits) | 1.12.0 to 4.4.1 |
| smb | Disconnect TID | Boolean | 1.0.0 to 4.4.1 |
| smb | Extended Response | Boolean | 1.6.0 to 4.4.1 |
| smb | Extended Signature | Boolean | 1.6.0 to 4.4.1 |
| smb | Optional Support | Unsigned integer (16 bits) | 1.12.0 to 4.4.1 |
| smb | CSC Mask | Unsigned integer (16 bits) | 1.6.0 to 4.4.1 |
| smb | In Dfs | Boolean | 1.0.0 to 4.4.1 |
| smb | Extended Signatures | Boolean | 1.6.0 to 4.4.1 |
| smb | Search Bits | Boolean | 1.0.0 to 4.4.1 |
| smb | Unique File Name | Boolean | 1.6.0 to 4.4.1 |
| smb | Continuation of | Frame number | 4.4.0 to 4.4.1 |
| smb | Continuation to | Frame number | 1.0.0 to 4.2.8 |
| smb | Flags | Unsigned integer (16 bits) | 1.12.0 to 4.4.1 |
| smb | Destination mode | Boolean | 1.0.0 to 4.4.1 |
| smb | Must be directory | Boolean | 1.0.0 to 4.4.1 |
| smb | EA action if EAs not supported on dest | Boolean | 1.0.0 to 4.4.1 |
| smb | Must be file | Boolean | 1.0.0 to 4.4.1 |
| smb | Source mode | Boolean | 1.0.0 to 4.4.1 |
| smb | Tree copy | Boolean | 1.0.0 to 4.4.1 |
| smb | Verify writes | Boolean | 1.0.0 to 4.4.1 |
| smb | Count | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Count High (multiply with 64K) | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Count Low | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Create action | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Disposition | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Server unique file ID | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Server unique 64-bit file ID | Unsigned integer (64 bits) | 1.8.0 to 4.4.1 |
| smb | Create Date | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Create Time | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Created | Date and time | 1.0.0 to 4.4.1 |
| smb | Create Flags | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Create Options | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Data Displacement | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Data Length | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Data Length High (multiply with 64K) | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Data Length Low | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Data Offset | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Data Size | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Data Count | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Data Compaction Mode | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Delete Pending | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Destination Name | Character string | 1.0.0 to 4.4.1 |
| smb | Device Characteristics | Unsigned integer (32 bits) | 1.12.0 to 4.4.1 |
| smb | Allow Appcontainer Traversal | Boolean | 2.6.0 to 4.4.1 |
| smb | Floppy | Boolean | 1.0.0 to 4.4.1 |
| smb | Mounted | Boolean | 1.0.0 to 4.4.1 |
| smb | Portable | Boolean | 2.6.0 to 4.4.1 |
| smb | Read Only | Boolean | 1.0.0 to 4.4.1 |
| smb | Remote | Boolean | 1.0.0 to 4.4.1 |
| smb | Removable | Boolean | 1.0.0 to 4.4.1 |
| smb | Secure Open | Boolean | 2.6.0 to 4.4.1 |
| smb | Terminal Services | Boolean | 2.6.0 to 4.4.1 |
| smb | Device Type | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Virtual | Boolean | 1.0.0 to 4.4.1 |
| smb | Webdav | Boolean | 2.6.0 to 4.4.1 |
| smb | Write Once | Boolean | 1.0.0 to 4.4.1 |
| smb | Flags | Unsigned integer (16 bits) | 1.12.0 to 4.4.1 |
| smb | Fielding | Boolean | 1.0.0 to 4.4.1 |
| smb | Hold Storage | Boolean | 1.0.0 to 4.4.1 |
| smb | Num Referrals | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Path Consumed | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Alt Path | Character string | 1.0.0 to 4.4.1 |
| smb | Alt Path Offset | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Domain Name | Character string | 1.2.3 to 4.4.1 |
| smb | Domain Offset | Unsigned integer (16 bits) | 1.2.3 to 4.4.1 |
| smb | Expanded Name | Character string | 1.2.3 to 4.4.1 |
| smb | Expanded Names Offset | Unsigned integer (16 bits) | 1.2.3 to 4.4.1 |
| smb | Flags | Unsigned integer (16 bits) | 1.12.0 to 4.4.1 |
| smb | NameListReferral | Boolean | 1.2.3 to 4.4.1 |
| smb | Strip | Boolean | 1.0.0 to 1.2.2 |
| smb | TargetSetBoundary | Boolean | 1.2.3 to 4.4.1 |
| smb | Node | Character string | 1.0.0 to 4.4.1 |
| smb | Node Offset | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Number of Expanded Names | Unsigned integer (16 bits) | 1.2.3 to 4.4.1 |
| smb | Path | Character string | 1.0.0 to 4.4.1 |
| smb | Path Offset | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Proximity | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Server Type | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Server GUID | Globally Unique Identifier | 1.2.3 to 4.4.1 |
| smb | Size | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | TTL | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Version | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Dialect | Character string | 1.12.0 to 4.4.1 |
| smb | Selected Index | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Name | Character string | 1.0.0 to 4.4.1 |
| smb | Add File | Boolean | 1.0.0 to 4.4.1 |
| smb | Add Subdir | Boolean | 1.0.0 to 4.4.1 |
| smb | Delete Child | Boolean | 1.0.0 to 4.4.1 |
| smb | FULL CONTROL | Unsigned integer (32 bits) | 2.0.0 to 4.4.1 |
| smb | List | Boolean | 1.0.0 to 4.4.1 |
| smb | Read Attribute | Boolean | 1.0.0 to 4.4.1 |
| smb | Read EA | Boolean | 1.0.0 to 4.4.1 |
| smb | Traverse | Boolean | 1.0.0 to 4.4.1 |
| smb | Write Attribute | Boolean | 1.0.0 to 4.4.1 |
| smb | Write EA | Boolean | 1.0.0 to 4.4.1 |
| smb | Root Directory Count | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Directory | Character string | 1.0.0 to 4.4.1 |
| smb | Delete on close | Boolean | 1.0.0 to 4.4.1 |
| smb | EA Data | Byte sequence | 1.0.0 to 4.4.1 |
| smb | EA Data Length | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | EA Error offset | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | EA Flags | Unsigned integer (8 bits) | 1.0.0 to 4.4.1 |
| smb | EA List Length | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | EA Name | Character string | 1.0.0 to 4.4.1 |
| smb | EA Name Length | Unsigned integer (8 bits) | 1.0.0 to 4.4.1 |
| smb | Echo Count | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Echo Data | Byte sequence | 1.0.0 to 4.4.1 |
| smb | Echo Seq Num | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Encryption Key | Byte sequence | 1.0.0 to 1.12.13 |
| smb | Key Length | Unsigned integer (16 bits) | 1.0.0 to 1.12.13 |
| smb | End Of File | Unsigned integer (64 bits) | 1.0.0 to 4.4.1 |
| smb | End Of Search | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Error Class | Unsigned integer (8 bits) | 1.0.0 to 4.4.1 |
| smb | Error Code | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Extended Attributes | Byte sequence | 1.0.0 to 4.4.1 |
| smb | Extra byte parameters | Byte sequence | 2.0.0 to 4.4.1 |
| smb | Level of Interest | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | FID | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Closed in | Frame number | 1.0.0 to 4.4.1 |
| smb | Mapped in | Frame number | 1.0.0 to 4.4.1 |
| smb | Opened in | Frame number | 1.0.0 to 4.4.1 |
| smb | Unmapped in | Frame number | 1.0.0 to 4.4.1 |
| smb | File Name | Character string | 1.0.0 to 4.4.1 |
| smb | Append Data | Boolean | 1.0.0 to 4.4.1 |
| smb | Execute | Boolean | 1.0.0 to 4.4.1 |
| smb | FULL CONTROL | Unsigned integer (32 bits) | 2.0.0 to 4.4.1 |
| smb | Read Attribute | Boolean | 1.0.0 to 4.4.1 |
| smb | Read Data | Boolean | 1.0.0 to 4.4.1 |
| smb | Read EA | Boolean | 1.0.0 to 4.4.1 |
| smb | Write Attribute | Boolean | 1.0.0 to 4.4.1 |
| smb | Write Data | Boolean | 1.0.0 to 4.4.1 |
| smb | Write EA | Boolean | 1.0.0 to 4.4.1 |
| smb | Root File Count | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | File RW Length | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | File Offset | Unsigned integer (64 bits) | 1.0.0 to 4.4.1 |
| smb | File Attributes | Unsigned integer (16 bits) | 1.12.0 to 4.4.1 |
| smb | Archive | Boolean | 1.0.0 to 4.4.1 |
| smb | Compressed | Boolean | 1.0.0 to 4.4.1 |
| smb | Device | Boolean | 1.0.0 to 4.4.1 |
| smb | Directory | Boolean | 1.0.0 to 4.4.1 |
| smb | Encrypted | Boolean | 1.0.0 to 4.4.1 |
| smb | Normal | Boolean | 1.0.0 to 4.4.1 |
| smb | Content Indexed | Boolean | 1.0.0 to 4.4.1 |
| smb | Offline | Boolean | 1.0.0 to 4.4.1 |
| smb | Read Only | Boolean | 1.0.0 to 4.4.1 |
| smb | Reparse Point | Boolean | 1.0.0 to 4.4.1 |
| smb | Sparse | Boolean | 1.0.0 to 4.4.1 |
| smb | System | Boolean | 1.0.0 to 4.4.1 |
| smb | Temporary | Boolean | 1.0.0 to 4.4.1 |
| smb | Volume ID | Boolean | 1.0.0 to 4.4.1 |
| smb | File Data | Byte sequence | 1.0.0 to 4.4.1 |
| smb | File Index | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | File Name Len | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | File Size | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | File Type | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Files Moved | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Flags | Unsigned integer (16 bits) | 1.12.0 to 4.4.1 |
| smb | Backup Intent | Boolean | 1.0.0 to 4.4.1 |
| smb | Close | Boolean | 1.0.0 to 4.4.1 |
| smb | Continue | Boolean | 1.0.0 to 4.4.1 |
| smb | Close on EOS | Boolean | 1.0.0 to 4.4.1 |
| smb | Resume | Boolean | 1.0.0 to 4.4.1 |
| smb | Flags | Unsigned integer (8 bits) | 1.12.0 to 4.4.1 |
| smb | Canonicalized Pathnames | Boolean | 1.0.0 to 4.4.1 |
| smb | Case Sensitivity | Boolean | 1.0.0 to 4.4.1 |
| smb | Lock and Read | Boolean | 1.0.0 to 4.4.1 |
| smb | Notify | Boolean | 1.0.0 to 4.4.1 |
| smb | Oplocks | Boolean | 1.0.0 to 4.4.1 |
| smb | Receive Buffer Posted | Boolean | 1.0.0 to 4.4.1 |
| smb | Request/Response | Boolean | 1.0.0 to 4.4.1 |
| smb | Flags2 | Unsigned integer (16 bits) | 1.12.0 to 4.4.1 |
| smb | Compressed | Boolean | 1.8.0 to 4.4.1 |
| smb | Dfs | Boolean | 1.0.0 to 4.4.1 |
| smb | Extended Attributes | Boolean | 1.0.0 to 4.4.1 |
| smb | Extended Security Negotiation | Boolean | 1.0.0 to 4.4.1 |
| smb | Long Names Allowed | Boolean | 1.0.0 to 4.4.1 |
| smb | Long Names Used | Boolean | 1.0.0 to 4.4.1 |
| smb | Error Code Type | Boolean | 1.0.0 to 4.4.1 |
| smb | Reparse Path | Boolean | 1.8.0 to 4.4.1 |
| smb | Execute-only Reads | Boolean | 1.0.0 to 4.4.1 |
| smb | Security Signatures | Boolean | 1.0.0 to 4.4.1 |
| smb | Security Signatures Required | Boolean | 1.8.0 to 4.4.1 |
| smb | Unicode Strings | Boolean | 1.0.0 to 4.4.1 |
| smb | Level of Interest | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Forwarded Name | Character string | 1.0.0 to 4.4.1 |
| smb | Fragment count | Unsigned integer (32 bits) | 1.6.0 to 4.4.1 |
| smb | Free Units | Unsigned integer (64 bits) | 1.0.0 to 4.4.1 |
| smb | Free Block Count | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Free Units | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | FS Attributes | Unsigned integer (32 bits) | 1.12.0 to 4.4.1 |
| smb | Case Preserving | Boolean | 1.0.0 to 4.4.1 |
| smb | Case Sensitive Search | Boolean | 1.0.0 to 4.4.1 |
| smb | Compression | Boolean | 1.0.0 to 4.4.1 |
| smb | Named Streams | Boolean | 1.0.0 to 4.4.1 |
| smb | Persistent ACLs | Boolean | 1.0.0 to 4.4.1 |
| smb | Read Only Volume | Boolean | 1.0.0 to 4.4.1 |
| smb | Block Refcounting | Boolean | 2.6.0 to 4.4.1 |
| smb | Supports Encryption | Boolean | 1.0.0 to 4.4.1 |
| smb | Hard Links | Boolean | 2.6.0 to 4.4.1 |
| smb | Integrity Streams | Boolean | 2.6.0 to 4.4.1 |
| smb | LFN APIs | Boolean | 1.0.0 to 4.4.1 |
| smb | Supports OIDs | Boolean | 1.0.0 to 4.4.1 |
| smb | Reparse Points | Boolean | 1.0.0 to 4.4.1 |
| smb | Remote Storage | Boolean | 1.0.0 to 4.4.1 |
| smb | Sparse Files | Boolean | 1.0.0 to 4.4.1 |
| smb | Sparse VDL | Boolean | 2.6.0 to 4.4.1 |
| smb | Transactions | Boolean | 2.6.0 to 4.4.1 |
| smb | Sequential Write Once | Boolean | 2.6.0 to 4.4.1 |
| smb | Unicode On Disk | Boolean | 1.0.0 to 4.4.1 |
| smb | Volume Is Compressed | Boolean | 1.0.0 to 4.4.1 |
| smb | Volume Quotas | Boolean | 1.0.0 to 4.4.1 |
| smb | Bytes per Sector | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | FS Id | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Max name length | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | FS Name | Character string | 1.0.0 to 4.4.1 |
| smb | Label Length | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Sectors/Unit | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Total Units | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Group ID | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Impersonation | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Index Number | Unsigned integer (64 bits) | 1.0.0 to 4.4.1 |
| smb | Information level not understood | Label | 2.0.0 to 4.4.1 |
| smb | Information level unknown | Label | 2.0.0 to 4.4.1 |
| smb | Information level structure goes past the end of the transaction data. | Label | 1.12.0 to 4.4.1 |
| smb | IPC State | Unsigned integer (16 bits) | 1.12.0 to 4.4.1 |
| smb | Endpoint | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Icount | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Nonblocking | Boolean | 1.0.0 to 4.4.1 |
| smb | Pipe Type | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Read Mode | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Is Directory | Unsigned integer (8 bits) | 1.0.0 to 4.4.1 |
| smb | Key | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Last Name Offset | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Last Write Date | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Last Write Time | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Last Write | Date and time | 1.0.0 to 4.4.1 |
| smb | Length of SID | Unsigned integer (32 bits) | 1.12.0 to 4.4.1 |
| smb | Link Count | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Length | Unsigned integer (64 bits) | 1.0.0 to 4.4.1 |
| smb | Offset | Unsigned integer (64 bits) | 1.0.0 to 4.4.1 |
| smb | Lock Type | Unsigned integer (8 bits) | 1.12.0 to 4.4.1 |
| smb | Cancel | Boolean | 1.0.0 to 4.4.1 |
| smb | Change | Boolean | 1.0.0 to 4.4.1 |
| smb | Large Files | Boolean | 1.0.0 to 4.4.1 |
| smb | Oplock Break | Boolean | 1.0.0 to 4.4.1 |
| smb | Shared | Boolean | 1.0.0 to 4.4.1 |
| smb | Number of Locks | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Number of Unlocks | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Oplock Level | Unsigned integer (8 bits) | 1.0.0 to 4.4.1 |
| smb | Logged In | Frame number | 1.0.0 to 4.4.1 |
| smb | Logged Out | Frame number | 1.0.0 to 4.4.1 |
| smb | Mac Support Flags | Unsigned integer (32 bits) | 1.12.0 to 4.4.1 |
| smb | Mac Access Control | Boolean | 1.0.0 to 4.4.1 |
| smb | Desktop DB Calls | Boolean | 1.0.0 to 4.4.1 |
| smb | Finder Info | Byte sequence | 1.0.0 to 4.4.1 |
| smb | Get Set Comments | Boolean | 1.0.0 to 4.4.1 |
| smb | Mac Streams | Boolean | 1.0.0 to 4.4.1 |
| smb | Mac Support Flags | Unsigned integer (32 bits) | 1.0.0 to 1.8.15 |
| smb | Macintosh Unique IDs | Boolean | 1.0.0 to 4.4.1 |
| smb | Machine Name | Character string | 1.0.0 to 4.4.1 |
| smb | Marked for Deletion | Boolean | 1.0.0 to 4.4.1 |
| smb | Max Buffer | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Max Buffer Size | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Max Mpx Count | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Max Raw Buffer | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Max Referral Level | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Max VCs | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Max Count | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Max Count High (multiply with 64K) | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Max Count Low | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Max Data Count | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Message | Character string | 1.0.0 to 4.4.1 |
| smb | Message Len | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Message Group ID | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Multiplex ID | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Min Count | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | The word parameters are missing, so the byte parameters cannot be dissected. | Label | 2.4.16, 2.6.10 to 2.6.20, 3.0.3 to 4.4.1 |
| smb | Mode | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Modified | Date and time | 1.0.0 to 4.4.1 |
| smb | Monitor Handle | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Flags | Unsigned integer (16 bits) | 1.12.0 to 4.4.1 |
| smb | Must be directory | Boolean | 1.0.0 to 4.4.1 |
| smb | Must be file | Boolean | 1.0.0 to 4.4.1 |
| smb | Verify writes | Boolean | 1.0.0 to 4.4.1 |
| smb | Max Parameter Count | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Max Setup Count | Unsigned integer (8 bits) | 1.0.0 to 4.4.1 |
| smb | Native File System | Character string | 1.0.0 to 4.4.1 |
| smb | Native LAN Manager | Character string | 1.0.0 to 4.4.1 |
| smb | Native OS | Character string | 1.0.0 to 4.4.1 |
| smb | Next Entry Offset | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Not Implemented yet | Label | 1.12.0 to 4.4.1 |
| smb | Batch Oplock | Boolean | 1.0.0 to 4.4.1 |
| smb | Create Directory | Boolean | 1.0.0 to 4.4.1 |
| smb | Extended Response | Boolean | 1.0.0 to 4.4.1 |
| smb | Exclusive Oplock | Boolean | 1.0.0 to 4.4.1 |
| smb | Backup Intent | Boolean | 1.0.0 to 4.4.1 |
| smb | Complete If Oplocked | Boolean | 1.0.0 to 4.4.1 |
| smb | Create Tree Connection | Boolean | 1.0.0 to 4.4.1 |
| smb | Delete On Close | Boolean | 1.0.0 to 4.4.1 |
| smb | Directory | Boolean | 1.0.0 to 4.4.1 |
| smb | 8.3 Only | Boolean | 1.0.0 to 4.4.1 |
| smb | Intermediate Buffering | Boolean | 1.0.0 to 4.4.1 |
| smb | No Compression | Boolean | 1.0.0 to 4.4.1 |
| smb | No EA Knowledge | Boolean | 1.0.0 to 4.4.1 |
| smb | Non-Directory | Boolean | 1.0.0 to 4.4.1 |
| smb | Open By FileID | Boolean | 1.0.0 to 4.4.1 |
| smb | Open For Free Space query | Boolean | 1.0.0 to 4.4.1 |
| smb | Open No Recall | Boolean | 1.0.0 to 4.4.1 |
| smb | Open Reparse Point | Boolean | 1.0.0 to 4.4.1 |
| smb | Random Access | Boolean | 1.0.0 to 4.4.1 |
| smb | Reserve Opfilter | Boolean | 1.0.0 to 4.4.1 |
| smb | Sequential Only | Boolean | 1.0.0 to 4.4.1 |
| smb | Sync I/O Alert | Boolean | 1.0.0 to 4.4.1 |
| smb | Sync I/O Nonalert | Boolean | 1.0.0 to 4.4.1 |
| smb | Write Through | Boolean | 1.0.0 to 4.4.1 |
| smb | Function | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Completion Filter | Unsigned integer (8 bits) | 1.12.0 to 4.4.1 |
| smb | Root Handle | Boolean | 1.0.0 to 4.4.1 |
| smb | IsFSctl | Unsigned integer (8 bits) | 1.0.0 to 4.4.1 |
| smb | Action | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Attribute Change | Boolean | 1.0.0 to 4.4.1 |
| smb | Completion Filter | Unsigned integer (32 bits) | 1.12.0 to 4.4.1 |
| smb | Created Change | Boolean | 1.0.0 to 4.4.1 |
| smb | Directory Name Change | Boolean | 1.0.0 to 4.4.1 |
| smb | EA Change | Boolean | 1.0.0 to 4.4.1 |
| smb | File Name Change | Boolean | 1.0.0 to 4.4.1 |
| smb | Last Access Change | Boolean | 1.0.0 to 4.4.1 |
| smb | Last Write Change | Boolean | 1.0.0 to 4.4.1 |
| smb | Security Change | Boolean | 1.0.0 to 4.4.1 |
| smb | Size Change | Boolean | 1.0.0 to 4.4.1 |
| smb | Stream Name Change | Boolean | 1.0.0 to 4.4.1 |
| smb | Stream Size Change | Boolean | 1.0.0 to 4.4.1 |
| smb | Stream Write | Boolean | 1.0.0 to 4.4.1 |
| smb | Watch Tree | Unsigned integer (8 bits) | 1.0.0 to 4.4.1 |
| smb | Security Information | Unsigned integer (32 bits) | 1.12.0 to 4.4.1 |
| smb | DACL | Boolean | 1.0.0 to 4.4.1 |
| smb | Group | Boolean | 1.0.0 to 4.4.1 |
| smb | Owner | Boolean | 1.0.0 to 4.4.1 |
| smb | SACL | Boolean | 1.0.0 to 4.4.1 |
| smb | NT Status | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | NT Transaction Setup | Byte sequence | 2.0.0 to 4.4.1 |
| smb | Unknown NT Transaction Setup (matching request not seen) | Label | 2.0.0 to 4.4.1 |
| smb | Cluster count | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Level of Interest | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Offset | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | High Offset | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Old File Name | Character string | 1.0.0 to 4.4.1 |
| smb | Action | Unsigned integer (16 bits) | 1.12.0 to 4.4.1 |
| smb | Exclusive Open | Boolean | 1.0.0 to 4.4.1 |
| smb | Open Action | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Flags | Unsigned integer (16 bits) | 1.12.0 to 4.4.1 |
| smb | Additional Info | Boolean | 1.0.0 to 4.4.1 |
| smb | Batch Oplock | Boolean | 1.0.0 to 4.4.1 |
| smb | Total EA Len | Boolean | 1.0.0 to 4.4.1 |
| smb | Exclusive Oplock | Boolean | 1.0.0 to 4.4.1 |
| smb | Open Function | Unsigned integer (16 bits) | 1.12.0 to 4.4.1 |
| smb | Create | Boolean | 1.0.0 to 4.4.1 |
| smb | Open | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Oplock level | Unsigned integer (8 bits) | 1.0.0 to 4.4.1 |
| smb | Originator Name | Character string | 1.0.0 to 4.4.1 |
| smb | Padding | Byte sequence | 1.0.0 to 4.4.1 |
| smb | Password | Byte sequence | 1.0.0 to 4.4.1 |
| smb | Path | Character string | 1.0.0 to 4.4.1 |
| smb | Parameter Count | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Parameter Displacement | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Process ID | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Process ID High | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Pipe Write Len | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Pipe Info | Boolean | 1.0.0 to 4.4.1 |
| smb | Parameter Offset | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Position | Unsigned integer (64 bits) | 1.0.0 to 4.4.1 |
| smb | Permissions | Unsigned integer (8 bits) | 1.0.0 to 4.4.1 |
| smb | EXECUTE | Boolean | 1.0.0 to 4.4.1 |
| smb | GID | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Owner GID | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Owner UID | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | READ | Boolean | 1.0.0 to 4.4.1 |
| smb | UID | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | WRITE | Boolean | 1.0.0 to 4.4.1 |
| smb | ACE Type | Unsigned integer (8 bits) | 1.0.0 to 4.4.1 |
| smb | Unknown posix ace type | Label | 2.0.0 to 4.4.1 |
| smb | Number of default ACEs | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Number of file ACEs | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Posix ACL version | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Primary Domain | Character string | 1.0.0 to 4.4.1 |
| smb | Identifier | Character string | 1.0.0 to 4.4.1 |
| smb | Mode | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Queued | Date and time | 1.0.0 to 4.4.1 |
| smb | Queued Date | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Queued Time | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Restart Index | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Setup Len | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Spool File Number | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Spool File Size | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Name | Character string | 1.0.0 to 4.4.1 |
| smb | Start Index | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Status | Unsigned integer (8 bits) | 1.0.0 to 4.4.1 |
| smb | Password Length | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Level of Interest | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Level of Interest | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Quota Flags | Unsigned integer (8 bits) | 2.0.0 to 4.4.1 |
| smb | Deny Disk | Boolean | 1.0.0 to 4.4.1 |
| smb | Enabled | Boolean | 1.0.0 to 4.4.1 |
| smb | Log Limit | Boolean | 1.0.0 to 4.4.1 |
| smb | Log Warning | Boolean | 1.0.0 to 4.4.1 |
| smb | (Hard) Quota Limit | Unsigned integer (64 bits) | 1.0.0 to 4.4.1 |
| smb | (Soft) Quota Threshold | Unsigned integer (64 bits) | 1.0.0 to 4.4.1 |
| smb | Quota Used | Unsigned integer (64 bits) | 1.0.0 to 4.4.1 |
| smb | Change Time | Date and time | 2.4.0 to 4.4.1 |
| smb | Next Offset | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Reassembled SMB length | Unsigned integer (32 bits) | 1.4.0 to 4.4.1 |
| smb | Remaining | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Reparse Tag | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Replace | Boolean | 1.0.0 to 4.4.1 |
| smb | Request Mask | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Reserved | Byte sequence | 1.0.0 to 4.4.1 |
| smb | Response Mask | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Response in | Frame number | 1.0.0 to 4.4.1 |
| smb | Response to | Frame number | 1.0.0 to 4.4.1 |
| smb | Response type | Unsigned integer (8 bits) | 3.2.0 to 4.4.1 |
| smb | Resume Key | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Client Cookie | Byte sequence | 1.0.0 to 4.4.1 |
| smb | Find ID | Unsigned integer (8 bits) | 1.0.0 to 4.4.1 |
| smb | Resume Key Length | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Server Cookie | Byte sequence | 1.0.0 to 4.4.1 |
| smb | Root FID | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Raw Mode | Unsigned integer (16 bits) | 1.12.0 to 4.4.1 |
| smb | Read Raw | Boolean | 1.0.0 to 4.4.1 |
| smb | Write Raw | Boolean | 1.0.0 to 4.4.1 |
| smb | Root Directory Count | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Root File Count | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Root Directory Handle | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Setup Count | Unsigned integer (8 bits) | 1.0.0 to 4.4.1 |
| smb | SD Length | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Search Attributes | Unsigned integer (16 bits) | 1.12.0 to 4.4.1 |
| smb | Archive | Boolean | 1.0.0 to 4.4.1 |
| smb | Directory | Boolean | 1.0.0 to 4.4.1 |
| smb | Read Only | Boolean | 1.0.0 to 4.4.1 |
| smb | System | Boolean | 1.0.0 to 4.4.1 |
| smb | Volume ID | Boolean | 1.0.0 to 4.4.1 |
| smb | Search Count | Unsigned integer (16 bits) | 1.0.0 to 4.2.8 |
| smb | Search Count Found | Unsigned integer (16 bits) | 4.4.0 to 4.4.1 |
| smb | Search Count Max | Unsigned integer (16 bits) | 4.4.0 to 4.4.1 |
| smb | Search ID | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Search Pattern | Character string | 1.0.0 to 4.4.1 |
| smb | NT Security Descriptor Length | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Secondaries will follow | Byte sequence | 4.4.0 to 4.4.1 |
| smb | Security Flags | Unsigned integer (8 bits) | 1.12.0 to 4.4.1 |
| smb | Context Tracking | Boolean | 1.0.0 to 4.4.1 |
| smb | Effective Only | Boolean | 1.0.0 to 4.4.1 |
| smb | Security Blob | Byte sequence | 1.0.0 to 4.4.1 |
| smb | Security Blob Length | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Seek Mode | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | SMB Segment | Frame number | 1.0.0 to 4.4.1 |
| smb | Defragmentation error | Frame number | 1.0.0 to 4.4.1 |
| smb | Multiple tail fragments found | Boolean | 1.0.0 to 4.4.1 |
| smb | Fragment overlap | Boolean | 1.0.0 to 4.4.1 |
| smb | Conflicting data in fragment overlap | Boolean | 1.0.0 to 4.4.1 |
| smb | SMB Segments | Label | 1.0.0 to 4.4.1 |
| smb | Fragment too long | Boolean | 1.0.0 to 4.4.1 |
| smb | Sequence Number | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Server | Character string | 1.0.0 to 4.4.1 |
| smb | Capabilities | Unsigned integer (32 bits) | 1.12.0 to 4.4.1 |
| smb | Bulk Transfer | Boolean | 1.0.0 to 1.6.16 |
| smb | Compressed Data | Boolean | 1.0.0 to 4.4.1 |
| smb | Dfs | Boolean | 1.0.0 to 4.4.1 |
| smb | Dynamic Reauth | Boolean | 1.8.0 to 4.4.1 |
| smb | Extended Security | Boolean | 1.0.0 to 4.4.1 |
| smb | Infolevel Passthru | Boolean | 1.0.0 to 4.4.1 |
| smb | Large Files | Boolean | 1.0.0 to 4.4.1 |
| smb | Large ReadX | Boolean | 1.0.0 to 4.4.1 |
| smb | Large WriteX | Boolean | 1.0.0 to 4.4.1 |
| smb | Level 2 Oplocks | Boolean | 1.0.0 to 4.4.1 |
| smb | Lock and Read | Boolean | 1.0.0 to 4.4.1 |
| smb | LWIO | Boolean | 1.8.0 to 4.4.1 |
| smb | MPX Mode | Boolean | 1.0.0 to 4.4.1 |
| smb | NT Find | Boolean | 1.0.0 to 4.4.1 |
| smb | NT SMBs | Boolean | 1.0.0 to 4.4.1 |
| smb | NT Status Codes | Boolean | 1.0.0 to 4.4.1 |
| smb | Raw Mode | Boolean | 1.0.0 to 4.4.1 |
| smb | Reserved | Boolean | 1.0.0 to 1.6.16 |
| smb | RPC Remote APIs | Boolean | 1.0.0 to 4.4.1 |
| smb | Unicode | Boolean | 1.0.0 to 4.4.1 |
| smb | UNIX | Boolean | 1.0.0 to 4.4.1 |
| smb | Server Component | Unsigned integer (32 bits) | 2.0.0 to 4.4.1 |
| smb | Server Date and Time | Date and time | 1.0.0 to 4.4.1 |
| smb | Server Date | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Server Time | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Server FID | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Server GUID | Globally Unique Identifier | 1.0.0 to 4.4.1 |
| smb | Server Time Zone | Signed integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Service | Character string | 1.0.0 to 4.4.1 |
| smb | Session ID | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Session Key | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Action | Unsigned integer (16 bits) | 1.12.0 to 4.4.1 |
| smb | Guest | Boolean | 1.0.0 to 4.4.1 |
| smb | Level of Interest | Unsigned integer (16 bits) | 1.8.0 to 4.4.1 |
| smb | Delete | Boolean | 1.0.0 to 4.4.1 |
| smb | Read | Boolean | 1.0.0 to 4.4.1 |
| smb | Write | Boolean | 1.0.0 to 4.4.1 |
| smb | Share Access | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Short File Name | Character string | 1.0.0 to 4.4.1 |
| smb | Short File Name Len | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Signature | Byte sequence | 1.0.0 to 4.4.1 |
| smb | Size of returned Quota data | Unsigned integer (32 bits) | 1.12.0 to 4.4.1 |
| smb | Security Mode | Unsigned integer (16 bits) | 1.12.0 to 4.4.1 |
| smb | Mode | Boolean | 1.0.0 to 4.4.1 |
| smb | Password | Boolean | 1.0.0 to 4.4.1 |
| smb | Sig Req | Boolean | 1.0.0 to 4.4.1 |
| smb | Signatures | Boolean | 1.0.0 to 4.4.1 |
| smb | Level of Interest | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Storage Type | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Stream Name | Character string | 1.0.0 to 4.4.1 |
| smb | Stream Name Length | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Stream Size | Unsigned integer (64 bits) | 1.0.0 to 4.4.1 |
| smb | System Time | Date and time | 1.0.0 to 4.4.1 |
| smb | Target name | Character string | 1.0.0 to 4.4.1 |
| smb | Target name length | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Total Data Count | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Tree ID | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Time from request | Time offset | 1.0.0 to 4.4.1 |
| smb | Timeout | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Total Data Length | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Total Parameter Count | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Subcommand | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Data | Byte sequence | 1.12.0 to 4.4.1 |
| smb | Parameters | Byte sequence | 1.12.0 to 4.4.1 |
| smb | Setup Word | Unsigned integer (16 bits) | 1.12.0 to 4.4.1 |
| smb | Transaction Name | Character string | 1.0.0 to 4.4.1 |
| smb | Flags | Unsigned integer (16 bits) | 1.12.0 to 4.4.1 |
| smb | Disconnect TID | Boolean | 1.0.0 to 4.4.1 |
| smb | One Way Transaction | Boolean | 1.0.0 to 4.4.1 |
| smb | User ID | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Unicode Password | Byte sequence | 1.0.0 to 4.4.1 |
| smb | Unicode Password Length | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Total Units | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Capabilities | Unsigned integer (64 bits) | 1.12.0 to 4.4.1 |
| smb | Additional Attributes Capability | Boolean | 1.12.0 to 4.4.1 |
| smb | EA Capability | Boolean | 1.12.0 to 4.4.1 |
| smb | Encryption Capability | Boolean | 1.12.0 to 3.2.18 |
| smb | Encryption Capability | Boolean | 3.4.0 to 4.4.1 |
| smb | FCNTL Capability | Boolean | 1.0.0 to 4.4.1 |
| smb | Large Read Capability | Boolean | 1.12.0 to 4.4.1 |
| smb | Large Write Capability | Boolean | 1.12.0 to 4.4.1 |
| smb | Mandatory Encryption Capability | Boolean | 1.12.0 to 4.4.1 |
| smb | POSIX ACL Capability | Boolean | 1.0.0 to 4.4.1 |
| smb | POSIX Path Operations Capability | Boolean | 1.12.0 to 4.4.1 |
| smb | POSIX Pathnames Capability | Boolean | 1.12.0 to 4.4.1 |
| smb | Proxy Capability | Boolean | 1.12.0 to 4.4.1 |
| smb | Last access | Date and time | 1.0.0 to 4.4.1 |
| smb | Creation time | Date and time | 1.6.0 to 4.4.1 |
| smb | Major device | Unsigned integer (64 bits) | 1.0.0 to 4.4.1 |
| smb | Minor device | Unsigned integer (64 bits) | 1.0.0 to 4.4.1 |
| smb | File type | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | GID | Unsigned integer (64 bits) | 1.0.0 to 4.4.1 |
| smb | Link destination | Character string | 1.0.0 to 4.4.1 |
| smb | Last modification | Date and time | 1.0.0 to 4.4.1 |
| smb | File name | Character string | 1.6.0 to 4.4.1 |
| smb | File name length | Unsigned integer (32 bits) | 1.6.0 to 4.4.1 |
| smb | Number of bytes | Unsigned integer (64 bits) | 1.0.0 to 4.4.1 |
| smb | Num links | Unsigned integer (64 bits) | 1.0.0 to 4.4.1 |
| smb | File permissions | Unsigned integer (64 bits) | 1.0.0 to 4.4.1 |
| smb | File size | Unsigned integer (64 bits) | 1.0.0 to 4.4.1 |
| smb | Last status change | Date and time | 1.0.0 to 4.4.1 |
| smb | UID | Unsigned integer (64 bits) | 1.0.0 to 4.4.1 |
| smb | Unique ID | Unsigned integer (64 bits) | 1.0.0 to 4.4.1 |
| smb | Next entry offset | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Resume key | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Major Version | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Minor Version | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | UNIX whoami mapping flags | Unsigned integer (32 bits) | 1.12.0 to 4.4.1 |
| smb | UNIX whoami mapping flags mask | Unsigned integer (32 bits) | 1.12.0 to 4.4.1 |
| smb | Number of supplementary UNIX GIDs | Unsigned integer (32 bits) | 1.12.0 to 4.4.1 |
| smb | Number of supplementary SIDs | Unsigned integer (32 bits) | 1.12.0 to 4.4.1 |
| smb | Supplementary SIDs buffer length | Unsigned integer (32 bits) | 1.12.0 to 4.4.1 |
| smb | Flags | Unsigned integer (32 bits) | 1.6.0 to 4.4.1 |
| smb | Append-only | Boolean | 1.6.0 to 4.4.1 |
| smb | Do not backup | Boolean | 1.6.0 to 4.4.1 |
| smb | Enable undelete | Boolean | 1.6.0 to 4.4.1 |
| smb | Immutable | Boolean | 1.6.0 to 4.4.1 |
| smb | Don't update atime | Boolean | 1.6.0 to 4.4.1 |
| smb | Secure delete | Boolean | 1.6.0 to 4.4.1 |
| smb | Synchronous | Boolean | 1.6.0 to 4.4.1 |
| smb | Flags mask | Unsigned integer (32 bits) | 1.6.0 to 4.4.1 |
| smb | Unknown Data | Byte sequence | 1.0.0 to 1.2.18 |
| smb | Unknown Data | Byte sequence | 1.4.0 to 4.4.1 |
| smb | Unknown field | Unsigned integer (32 bits) | 1.4.0 to 1.10.14 |
| smb | VC Number | Unsigned integer (16 bits) | 1.0.0 to 4.4.1 |
| smb | Label | Character string | 1.0.0 to 4.4.1 |
| smb | Label Length | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Volume Serial Number | Unsigned integer (32 bits) | 1.0.0 to 4.4.1 |
| smb | Volume GUID | Globally Unique Identifier | 1.8.0 to 4.4.1 |
| smb | Word Count (WCT) | Unsigned integer (8 bits) | 1.0.0 to 4.4.1 |
| smb | Word parameters | Byte sequence | 2.0.0 to 4.4.1 |
| smb | Words for unknown response format | Byte sequence | 2.0.0 to 4.4.1 |
| smb | Write Mode | Unsigned integer (16 bits) | 1.12.0 to 4.4.1 |
| smb | Connectionless | Boolean | 1.0.0 to 4.4.1 |
| smb | Message Start | Boolean | 1.0.0 to 4.4.1 |
| smb | Write Raw | Boolean | 1.0.0 to 4.4.1 |
| smb | Return Remaining | Boolean | 1.0.0 to 4.4.1 |
| smb | Write Through | Boolean | 1.0.0 to 4.4.1 |