1 1 2016-11-30 15:35:08.640523 IP (tos 0x0, ttl 128, id 376, offset 0, flags [DF], proto TCP (6), length 128) 2 192.168.56.55.445 > 192.168.56.119.49199: Flags [P.], cksum 0x3e2f (incorrect -> 0x3d49), seq 4267808374:4267808462, ack 628292694, win 63102, length 88 3 SMB PACKET: SMBtrans2 (REPLY) 4 SMB Command = 0x32 5 Error class = 0x0 6 Error code = 0 (0x0) 7 Flags1 = 0xFF 8 Flags2 = 0x7 9 Tree ID = 2048 (0x800) 10 Proc ID = 2848 (0xb20) 11 UID = 4098 (0x1002) 12 MID = 1616 (0x650) 13 Word Count = 10 (0xa) 14 TRANSACT2_OPEN param_length=2 data_length=24 15 TotParam=2 (0x2) 16 TotData=24 (0x18) 17 Res1=0x0 18 ParamCnt=2 (0x2) 19 ParamOff=56 (0x38) 20 ParamDisp0 (0x0) 21 DataCnt=24 (0x18) 22 DataOff=60 (0x3c) 23 DataDisp=0 (0x0) 24 SetupCnt=0 (0x0) 25 smb_bcc=29 26 Handle=0 (0x0) 27 Attrib=Data= 28 Data: (24 bytes) 29 [000] 00 00 0B 00 00 00 00 00 00 00 00 00 00 00 00 00 ^@^@^K^@^@^@^@^@ ^@^@^@^@^@^@^@^@ 30 [010] 01 00 00 00 00 00 00 00 ^A^@^@^@^@^@^@^@ 31 32 2 2016-11-30 15:35:08.640906 IP (tos 0x0, ttl 128, id 632, offset 0, flags [DF], proto TCP (6), length 114) 33 192.168.56.119.49199 > 192.168.56.55.445: Flags [P.], cksum 0x2437 (correct), seq 1:75, ack 88, win 254, length 74 34 SMB PACKET: SMBtrans2 (REQUEST) 35 SMB Command = 0x32 36 Error class = 0x0 37 Error code = 0 (0x0) 38 Flags1 = 0x18 39 Flags2 = 0x7 40 Tree ID = 2048 (0x800) 41 Proc ID = 2848 (0xb20) 42 UID = 4098 (0x1002) 43 MID = 1632 (0x660) 44 Word Count = 15 (0xf) 45 TRANSACT2_QFSINFO param_length=2 data_length=0 46 TotParam=2 (0x2) 47 TotData=0 (0x0) 48 MaxParam=0 (0x0) 49 MaxData=560 (0x230) 50 MaxSetup=0 (0x0) 51 Flags=0x0 52 TimeOut=0 (0x0) 53 Res1=0x0 54 ParamCnt=2 (0x2) 55 ParamOff=68 (0x44) 56 DataCnt=0 (0x0) 57 DataOff=0 (0x0) 58 SetupCnt=1 (0x1) 59 smb_bcc=5 60 InfoLevel=261 (0x105) 61 62 3 2016-11-30 15:35:08.641033 IP (tos 0x0, ttl 128, id 377, offset 0, flags [DF], proto TCP (6), length 120) 63 192.168.56.55.445 > 192.168.56.119.49199: Flags [P.], cksum 0xf1fb (incorrect -> 0x1559), seq 88:168, ack 75, win 63028, length 80 64 SMB PACKET: SMBtrans2 (REPLY) 65 SMB Command = 0x32 66 Error class = 0x0 67 Error code = 0 (0x0) 68 Flags1 = 0x98 69 Flags2 = 0x7 70 Tree ID = 0 (0x0) 71 Proc ID = 0 (0x0) 72 UID = 0 (0x0) 73 MID = 0 (0x0) 74 Word Count = 11 (0xb) 75 TRANSACT2_QFSINFO param_length=0 data_length=20 76 TotParam=0 (0x0) 77 TotData=0 (0x0) 78 Res1=0x0 79 ParamCnt=0 (0x0) 80 ParamOff=56 (0x38) 81 ParamDisp0 (0x0) 82 DataCnt=20 (0x14) 83 DataOff=56 (0x38) 84 DataDisp=0 (0x0) 85 SetupCnt=0 (0x0) 86 smb_bcc=65280 87 Capabilities=0x700FF 88 MaxFileLen=255 (0xff) 89 VolNameLen=4278190088 90 Volume=... [|smb] 91 data: 92 [000] FF 00 07 00 FF 00 00 00 08 00 00 FF FF FF FF 00 M-^?^@^G^@M-^?^@^@^@ ^H^@^@M-^?M-^?M-^?M-^?^@ 93 [010] 46 00 53 00 F^@S^@ 94 95 4 2038-01-01 00:00:00.000000 IP (tos 0x0, ttl 128, id 633, offset 0, flags [DF], proto TCP (6), length 116) 96 192.168.56.119.49199 > 192.168.56.55.445: Flags [P.], cksum 0x2253 (incorrect -> 0x229b), seq 75:151, ack 168, win 253, length 76 SMB-over-TCP packet:(raw data or continuation?) 97 98