OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: Is this bad Locking Response?

From: Kartik Subbanna (kaangirasYAHOO.COM)
Date: Wed Jan 21 2004 - 22:52:04 CST

Jerry,

Thanks for the response. I looked at the document. I
think you are referring to oplock break from the
server and the close from the client crossing on the
wire. The case is different here.

  This is not an oplock break from the server. Because

  - The packet contains response bit in the SMB header
flags. The oplock break from the server should be sent
as a request packet (without setting the response
bit).

  - The word count in the packet is 2 which matches
with the LockingAndx response. The oplock break packet
should have word count 8.

   But, the MID in the packet is 0xffff (-1).

Thanks
Kartik

--- "Gerald (Jerry) Carter" <jerrySAMBA.ORG> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Kartik Subbanna wrote:
> > I am seeing LockingAndx response with MID 0xffff
> from the
> > server. The reply bit is set in the SMB header
> and the
> > WordCount is 2. I dont even have the LockingAndx
> request
> > waiting for the response from the server. Has
> anybody
> > seen this? Any idea why it is sent by the server.
> >
> > Any information on this is highly appreciated.
>
> See section 2.6.4 of the SNIA CIFS reference
> (oplocks).
>
> http://www.snia.org/tech_activities/CIFS/
>
>
>
>
> cheers, jerry
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.1 (GNU/Linux)
> Comment: Using GnuPG with Mozilla -
> http://enigmail.mozdev.org
>
>
iD8DBQFADzHAIR7qMdg1EfYRAkhVAKC3eaif4Ttvel+ZQ0ROu9N92zIacgCfR20e
> dlX33RQxdugff9M2313/cy4=
> =+M8b
> -----END PGP SIGNATURE-----
>
>
----------------------------------------------------------------
> Users Guide
> http://discuss.microsoft.com/archives/mailfaq.html
> contains important info including how to
> unsubscribe. Save time, search
> the archives at
http://discuss.microsoft.com/archives/index.html

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free web site building tool. Try it!
http://webhosting.yahoo.com/ps/sb/

----------------------------------------------------------------
Users Guide http://discuss.microsoft.com/archives/mailfaq.html
contains important info including how to unsubscribe. Save time, search
the archives at http://discuss.microsoft.com/archives/index.html