No. Time Source Destination Protocol Info 54708 8.972423 10.10.59.4 10.10.59.16 SMB Write Request, FID: 0x2d83, 16580 bytes at offset 49107140 Frame 54708 (1514 bytes on wire, 1514 bytes captured) Arrival Time: May 13, 2005 17:15:24.362344000 Time delta from previous packet: 0.000243000 seconds Time since reference or first frame: 8.972423000 seconds Frame Number: 54708 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:nbss:smb Ethernet II, Src: 00:10:18:0a:d1:01, Dst: 00:e0:81:61:5d:9c Destination: 00:e0:81:61:5d:9c (10.10.59.16) Source: 00:10:18:0a:d1:01 (Broadcom_0a:d1:01) Type: IP (0x0800) Internet Protocol, Src Addr: 10.10.59.4 (10.10.59.4), Dst Addr: 10.10.59.16 (10.10.59.16) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xd98e (55694) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x9165 (correct) Source: 10.10.59.4 (10.10.59.4) Destination: 10.10.59.16 (10.10.59.16) Transmission Control Protocol, Src Port: 2603 (2603), Dst Port: netbios-ssn (139), Seq: 49274213, Ack: 131593, Len: 1460 Source port: 2603 (2603) Destination port: netbios-ssn (139) Sequence number: 49274213 (relative sequence number) Next sequence number: 49275673 (relative sequence number) Acknowledgement number: 131593 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65330 Checksum: 0x1d97 (correct) Last frame of this PDU: 54724 Time until the last segment of this PDU: 0.001468000 seconds SEQ/ACK analysis NetBIOS Session Service Message Type: Session message Flags: 0x00 .... ...0 = Add 0 to length Length: 16628 SMB (Server Message Block Protocol) SMB Header Server Component: SMB Response in: 54726 SMB Command: Write (0x0b) NT Status: STATUS_SUCCESS (0x00000000) Flags: 0x18 0... .... = Request/Response: Message is a request to the server .0.. .... = Notify: Notify client only on open ..0. .... = Oplocks: OpLock not requested/granted ...1 .... = Canonicalized Pathnames: Pathnames are canonicalized .... 1... = Case Sensitivity: Path names are caseless .... ..0. = Receive Buffer Posted: Receive buffer has not been posted .... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported Flags2: 0x4803 0... .... .... .... = Unicode Strings: Strings are ASCII .1.. .... .... .... = Error Code Type: Error codes are NT error codes ..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only ...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs .... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported .... .... .0.. .... = Long Names Used: Path names in request are not long file names .... .... .... .0.. = Security Signatures: Security signatures are not supported .... .... .... ..1. = Extended Attributes: Extended attributes are supported .... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response Process ID High: 0 Signature: 0000000000000000 Reserved: 0000 Tree ID: 1 Process ID: 65279 User ID: 100 Multiplex ID: 65089 Write Request (0x0b) Word Count (WCT): 5 FID: 0x2d83 Count: 16580 Offset: 49107140 Remaining: 0 Byte Count (BCC): 16583 Buffer Format: Data Block (1) Data Length: 16580 File Data: Incomplete. Only 1408 of 16580 bytes 0000 00 e0 81 61 5d 9c 00 10 18 0a d1 01 08 00 45 00 ...a].........E. 0010 05 dc d9 8e 40 00 80 06 91 65 0a 0a 3b 04 0a 0a ....@....e..;... 0020 3b 10 0a 2b 00 8b 93 24 7f 2a 3f 21 13 21 50 10 ;..+...$.*?!.!P. 0030 ff 32 1d 97 00 00 00 00 40 f4 ff 53 4d 42 0b 00 .2......@..SMB.. 0040 00 00 00 18 03 48 00 00 00 00 00 00 00 00 00 00 .....H.......... 0050 00 00 01 00 ff fe 64 00 41 fe 05 83 2d c4 40 c4 ......d.A...-.@. 0060 50 ed 02 00 00 c7 40 01 c4 40 30 34 39 31 30 37 P.....@..@049107 0070 31 34 0d 0a 30 34 39 31 30 37 31 35 0d 0a 30 34 14..04910715..04 0080 39 31 30 37 31 36 0d 0a 30 34 39 31 30 37 31 37 910716..04910717 0090 0d 0a 30 34 39 31 30 37 31 38 0d 0a 30 34 39 31 ..04910718..0491 00a0 30 37 31 39 0d 0a 30 34 39 31 30 37 32 30 0d 0a 0719..04910720.. 00b0 30 34 39 31 30 37 32 31 0d 0a 30 34 39 31 30 37 04910721..049107 00c0 32 32 0d 0a 30 34 39 31 30 37 32 33 0d 0a 30 34 22..04910723..04 00d0 39 31 30 37 32 34 0d 0a 30 34 39 31 30 37 32 35 910724..04910725 00e0 0d 0a 30 34 39 31 30 37 32 36 0d 0a 30 34 39 31 ..04910726..0491 00f0 30 37 32 37 0d 0a 30 34 39 31 30 37 32 38 0d 0a 0727..04910728.. 0100 30 34 39 31 30 37 32 39 0d 0a 30 34 39 31 30 37 04910729..049107 0110 33 30 0d 0a 30 34 39 31 30 37 33 31 0d 0a 30 34 30..04910731..04 0120 39 31 30 37 33 32 0d 0a 30 34 39 31 30 37 33 33 910732..04910733 0130 0d 0a 30 34 39 31 30 37 33 34 0d 0a 30 34 39 31 ..04910734..0491 0140 30 37 33 35 0d 0a 30 34 39 31 30 37 33 36 0d 0a 0735..04910736.. 0150 30 34 39 31 30 37 33 37 0d 0a 30 34 39 31 30 37 04910737..049107 0160 33 38 0d 0a 30 34 39 31 30 37 33 39 0d 0a 30 34 38..04910739..04 0170 39 31 30 37 34 30 0d 0a 30 34 39 31 30 37 34 31 910740..04910741 0180 0d 0a 30 34 39 31 30 37 34 32 0d 0a 30 34 39 31 ..04910742..0491 0190 30 37 34 33 0d 0a 30 34 39 31 30 37 34 34 0d 0a 0743..04910744.. 01a0 30 34 39 31 30 37 34 35 0d 0a 30 34 39 31 30 37 04910745..049107 01b0 34 36 0d 0a 30 34 39 31 30 37 34 37 0d 0a 30 34 46..04910747..04 01c0 39 31 30 37 34 38 0d 0a 30 34 39 31 30 37 34 39 910748..04910749 01d0 0d 0a 30 34 39 31 30 37 35 30 0d 0a 30 34 39 31 ..04910750..0491 01e0 30 37 35 31 0d 0a 30 34 39 31 30 37 35 32 0d 0a 0751..04910752.. 01f0 30 34 39 31 30 37 35 33 0d 0a 30 34 39 31 30 37 04910753..049107 0200 35 34 0d 0a 30 34 39 31 30 37 35 35 0d 0a 30 34 54..04910755..04 0210 39 31 30 37 35 36 0d 0a 30 34 39 31 30 37 35 37 910756..04910757 0220 0d 0a 30 34 39 31 30 37 35 38 0d 0a 30 34 39 31 ..04910758..0491 0230 30 37 35 39 0d 0a 30 34 39 31 30 37 36 30 0d 0a 0759..04910760.. 0240 30 34 39 31 30 37 36 31 0d 0a 30 34 39 31 30 37 04910761..049107 0250 36 32 0d 0a 30 34 39 31 30 37 36 33 0d 0a 30 34 62..04910763..04 0260 39 31 30 37 36 34 0d 0a 30 34 39 31 30 37 36 35 910764..04910765 0270 0d 0a 30 34 39 31 30 37 36 36 0d 0a 30 34 39 31 ..04910766..0491 0280 30 37 36 37 0d 0a 30 34 39 31 30 37 36 38 0d 0a 0767..04910768.. 0290 30 34 39 31 30 37 36 39 0d 0a 30 34 39 31 30 37 04910769..049107 02a0 37 30 0d 0a 30 34 39 31 30 37 37 31 0d 0a 30 34 70..04910771..04 02b0 39 31 30 37 37 32 0d 0a 30 34 39 31 30 37 37 33 910772..04910773 02c0 0d 0a 30 34 39 31 30 37 37 34 0d 0a 30 34 39 31 ..04910774..0491 02d0 30 37 37 35 0d 0a 30 34 39 31 30 37 37 36 0d 0a 0775..04910776.. 02e0 30 34 39 31 30 37 37 37 0d 0a 30 34 39 31 30 37 04910777..049107 02f0 37 38 0d 0a 30 34 39 31 30 37 37 39 0d 0a 30 34 78..04910779..04 0300 39 31 30 37 38 30 0d 0a 30 34 39 31 30 37 38 31 910780..04910781 0310 0d 0a 30 34 39 31 30 37 38 32 0d 0a 30 34 39 31 ..04910782..0491 0320 30 37 38 33 0d 0a 30 34 39 31 30 37 38 34 0d 0a 0783..04910784.. 0330 30 34 39 31 30 37 38 35 0d 0a 30 34 39 31 30 37 04910785..049107 0340 38 36 0d 0a 30 34 39 31 30 37 38 37 0d 0a 30 34 86..04910787..04 0350 39 31 30 37 38 38 0d 0a 30 34 39 31 30 37 38 39 910788..04910789 0360 0d 0a 30 34 39 31 30 37 39 30 0d 0a 30 34 39 31 ..04910790..0491 0370 30 37 39 31 0d 0a 30 34 39 31 30 37 39 32 0d 0a 0791..04910792.. 0380 30 34 39 31 30 37 39 33 0d 0a 30 34 39 31 30 37 04910793..049107 0390 39 34 0d 0a 30 34 39 31 30 37 39 35 0d 0a 30 34 94..04910795..04 03a0 39 31 30 37 39 36 0d 0a 30 34 39 31 30 37 39 37 910796..04910797 03b0 0d 0a 30 34 39 31 30 37 39 38 0d 0a 30 34 39 31 ..04910798..0491 03c0 30 37 39 39 0d 0a 30 34 39 31 30 38 30 30 0d 0a 0799..04910800.. 03d0 30 34 39 31 30 38 30 31 0d 0a 30 34 39 31 30 38 04910801..049108 03e0 30 32 0d 0a 30 34 39 31 30 38 30 33 0d 0a 30 34 02..04910803..04 03f0 39 31 30 38 30 34 0d 0a 30 34 39 31 30 38 30 35 910804..04910805 0400 0d 0a 30 34 39 31 30 38 30 36 0d 0a 30 34 39 31 ..04910806..0491 0410 30 38 30 37 0d 0a 30 34 39 31 30 38 30 38 0d 0a 0807..04910808.. 0420 30 34 39 31 30 38 30 39 0d 0a 30 34 39 31 30 38 04910809..049108 0430 31 30 0d 0a 30 34 39 31 30 38 31 31 0d 0a 30 34 10..04910811..04 0440 39 31 30 38 31 32 0d 0a 30 34 39 31 30 38 31 33 910812..04910813 0450 0d 0a 30 34 39 31 30 38 31 34 0d 0a 30 34 39 31 ..04910814..0491 0460 30 38 31 35 0d 0a 30 34 39 31 30 38 31 36 0d 0a 0815..04910816.. 0470 30 34 39 31 30 38 31 37 0d 0a 30 34 39 31 30 38 04910817..049108 0480 31 38 0d 0a 30 34 39 31 30 38 31 39 0d 0a 30 34 18..04910819..04 0490 39 31 30 38 32 30 0d 0a 30 34 39 31 30 38 32 31 910820..04910821 04a0 0d 0a 30 34 39 31 30 38 32 32 0d 0a 30 34 39 31 ..04910822..0491 04b0 30 38 32 33 0d 0a 30 34 39 31 30 38 32 34 0d 0a 0823..04910824.. 04c0 30 34 39 31 30 38 32 35 0d 0a 30 34 39 31 30 38 04910825..049108 04d0 32 36 0d 0a 30 34 39 31 30 38 32 37 0d 0a 30 34 26..04910827..04 04e0 39 31 30 38 32 38 0d 0a 30 34 39 31 30 38 32 39 910828..04910829 04f0 0d 0a 30 34 39 31 30 38 33 30 0d 0a 30 34 39 31 ..04910830..0491 0500 30 38 33 31 0d 0a 30 34 39 31 30 38 33 32 0d 0a 0831..04910832.. 0510 30 34 39 31 30 38 33 33 0d 0a 30 34 39 31 30 38 04910833..049108 0520 33 34 0d 0a 30 34 39 31 30 38 33 35 0d 0a 30 34 34..04910835..04 0530 39 31 30 38 33 36 0d 0a 30 34 39 31 30 38 33 37 910836..04910837 0540 0d 0a 30 34 39 31 30 38 33 38 0d 0a 30 34 39 31 ..04910838..0491 0550 30 38 33 39 0d 0a 30 34 39 31 30 38 34 30 0d 0a 0839..04910840.. 0560 30 34 39 31 30 38 34 31 0d 0a 30 34 39 31 30 38 04910841..049108 0570 34 32 0d 0a 30 34 39 31 30 38 34 33 0d 0a 30 34 42..04910843..04 0580 39 31 30 38 34 34 0d 0a 30 34 39 31 30 38 34 35 910844..04910845 0590 0d 0a 30 34 39 31 30 38 34 36 0d 0a 30 34 39 31 ..04910846..0491 05a0 30 38 34 37 0d 0a 30 34 39 31 30 38 34 38 0d 0a 0847..04910848.. 05b0 30 34 39 31 30 38 34 39 0d 0a 30 34 39 31 30 38 04910849..049108 05c0 35 30 0d 0a 30 34 39 31 30 38 35 31 0d 0a 30 34 50..04910851..04 05d0 39 31 30 38 35 32 0d 0a 30 34 39 31 30 38 35 33 910852..04910853 05e0 0d 0a 30 34 39 31 30 38 35 34 ..04910854 No. Time Source Destination Protocol Info 54727 8.974372 10.10.59.4 10.10.59.16 SMB Write Request, FID: 0x2d83, 11700 bytes at offset 49140300 Frame 54727 (1514 bytes on wire, 1514 bytes captured) Arrival Time: May 13, 2005 17:15:24.364293000 Time delta from previous packet: 0.000001000 seconds Time since reference or first frame: 8.974372000 seconds Frame Number: 54727 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:nbss:smb Ethernet II, Src: 00:10:18:0a:d1:01, Dst: 00:e0:81:61:5d:9c Destination: 00:e0:81:61:5d:9c (10.10.59.16) Source: 00:10:18:0a:d1:01 (Broadcom_0a:d1:01) Type: IP (0x0800) Internet Protocol, Src Addr: 10.10.59.4 (10.10.59.4), Dst Addr: 10.10.59.16 (10.10.59.16) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xd99a (55706) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x9159 (correct) Source: 10.10.59.4 (10.10.59.4) Destination: 10.10.59.16 (10.10.59.16) Transmission Control Protocol, Src Port: 2603 (2603), Dst Port: netbios-ssn (139), Seq: 49290845, Ack: 131634, Len: 1460 Source port: 2603 (2603) Destination port: netbios-ssn (139) Sequence number: 49290845 (relative sequence number) Next sequence number: 49292305 (relative sequence number) Acknowledgement number: 131634 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65289 Checksum: 0x6f26 (correct) Last frame of this PDU: 54739 Time until the last segment of this PDU: 0.000977000 seconds SEQ/ACK analysis NetBIOS Session Service Message Type: Session message Flags: 0x00 .... ...0 = Add 0 to length Length: 11748 SMB (Server Message Block Protocol) SMB Header Server Component: SMB Response in: 54740 SMB Command: Write (0x0b) NT Status: STATUS_SUCCESS (0x00000000) Flags: 0x18 0... .... = Request/Response: Message is a request to the server .0.. .... = Notify: Notify client only on open ..0. .... = Oplocks: OpLock not requested/granted ...1 .... = Canonicalized Pathnames: Pathnames are canonicalized .... 1... = Case Sensitivity: Path names are caseless .... ..0. = Receive Buffer Posted: Receive buffer has not been posted .... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported Flags2: 0x4803 0... .... .... .... = Unicode Strings: Strings are ASCII .1.. .... .... .... = Error Code Type: Error codes are NT error codes ..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only ...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs .... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported .... .... .0.. .... = Long Names Used: Path names in request are not long file names .... .... .... .0.. = Security Signatures: Security signatures are not supported .... .... .... ..1. = Extended Attributes: Extended attributes are supported .... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response Process ID High: 0 Signature: 0000000000000000 Reserved: 0000 Tree ID: 1 Process ID: 65279 User ID: 100 Multiplex ID: 65028 Write Request (0x0b) Word Count (WCT): 5 FID: 0x2d83 Count: 11700 Offset: 49140300 Remaining: 0 Byte Count (BCC): 11703 Buffer Format: Data Block (1) Data Length: 11700 File Data: Incomplete. Only 1408 of 11700 bytes 0000 00 e0 81 61 5d 9c 00 10 18 0a d1 01 08 00 45 00 ...a].........E. 0010 05 dc d9 9a 40 00 80 06 91 59 0a 0a 3b 04 0a 0a ....@....Y..;... 0020 3b 10 0a 2b 00 8b 93 24 c0 22 3f 21 13 4a 50 10 ;..+...$."?!.JP. 0030 ff 09 6f 26 00 00 00 00 2d e4 ff 53 4d 42 0b 00 ..o&....-..SMB.. 0040 00 00 00 18 03 48 00 00 00 00 00 00 00 00 00 00 .....H.......... 0050 00 00 01 00 ff fe 64 00 04 fe 05 83 2d b4 2d 4c ......d.....-.-L 0060 d2 ed 02 00 00 b7 2d 01 b4 2d 30 34 39 31 34 30 ......-..-049140 0070 33 30 0d 0a 30 34 39 31 34 30 33 31 0d 0a 30 34 30..04914031..04 0080 39 31 34 30 33 32 0d 0a 30 34 39 31 34 30 33 33 914032..04914033 0090 0d 0a 30 34 39 31 34 30 33 34 0d 0a 30 34 39 31 ..04914034..0491 00a0 34 30 33 35 0d 0a 30 34 39 31 34 30 33 36 0d 0a 4035..04914036.. 00b0 30 34 39 31 34 30 33 37 0d 0a 30 34 39 31 34 30 04914037..049140 00c0 33 38 0d 0a 30 34 39 31 34 30 33 39 0d 0a 30 34 38..04914039..04 00d0 39 31 34 30 34 30 0d 0a 30 34 39 31 34 30 34 31 914040..04914041 00e0 0d 0a 30 34 39 31 34 30 34 32 0d 0a 30 34 39 31 ..04914042..0491 00f0 34 30 34 33 0d 0a 30 34 39 31 34 30 34 34 0d 0a 4043..04914044.. 0100 30 34 39 31 34 30 34 35 0d 0a 30 34 39 31 34 30 04914045..049140 0110 34 36 0d 0a 30 34 39 31 34 30 34 37 0d 0a 30 34 46..04914047..04 0120 39 31 34 30 34 38 0d 0a 30 34 39 31 34 30 34 39 914048..04914049 0130 0d 0a 30 34 39 31 34 30 35 30 0d 0a 30 34 39 31 ..04914050..0491 0140 34 30 35 31 0d 0a 30 34 39 31 34 30 35 32 0d 0a 4051..04914052.. 0150 30 34 39 31 34 30 35 33 0d 0a 30 34 39 31 34 30 04914053..049140 0160 35 34 0d 0a 30 34 39 31 34 30 35 35 0d 0a 30 34 54..04914055..04 0170 39 31 34 30 35 36 0d 0a 30 34 39 31 34 30 35 37 914056..04914057 0180 0d 0a 30 34 39 31 34 30 35 38 0d 0a 30 34 39 31 ..04914058..0491 0190 34 30 35 39 0d 0a 30 34 39 31 34 30 36 30 0d 0a 4059..04914060.. 01a0 30 34 39 31 34 30 36 31 0d 0a 30 34 39 31 34 30 04914061..049140 01b0 36 32 0d 0a 30 34 39 31 34 30 36 33 0d 0a 30 34 62..04914063..04 01c0 39 31 34 30 36 34 0d 0a 30 34 39 31 34 30 36 35 914064..04914065 01d0 0d 0a 30 34 39 31 34 30 36 36 0d 0a 30 34 39 31 ..04914066..0491 01e0 34 30 36 37 0d 0a 30 34 39 31 34 30 36 38 0d 0a 4067..04914068.. 01f0 30 34 39 31 34 30 36 39 0d 0a 30 34 39 31 34 30 04914069..049140 0200 37 30 0d 0a 30 34 39 31 34 30 37 31 0d 0a 30 34 70..04914071..04 0210 39 31 34 30 37 32 0d 0a 30 34 39 31 34 30 37 33 914072..04914073 0220 0d 0a 30 34 39 31 34 30 37 34 0d 0a 30 34 39 31 ..04914074..0491 0230 34 30 37 35 0d 0a 30 34 39 31 34 30 37 36 0d 0a 4075..04914076.. 0240 30 34 39 31 34 30 37 37 0d 0a 30 34 39 31 34 30 04914077..049140 0250 37 38 0d 0a 30 34 39 31 34 30 37 39 0d 0a 30 34 78..04914079..04 0260 39 31 34 30 38 30 0d 0a 30 34 39 31 34 30 38 31 914080..04914081 0270 0d 0a 30 34 39 31 34 30 38 32 0d 0a 30 34 39 31 ..04914082..0491 0280 34 30 38 33 0d 0a 30 34 39 31 34 30 38 34 0d 0a 4083..04914084.. 0290 30 34 39 31 34 30 38 35 0d 0a 30 34 39 31 34 30 04914085..049140 02a0 38 36 0d 0a 30 34 39 31 34 30 38 37 0d 0a 30 34 86..04914087..04 02b0 39 31 34 30 38 38 0d 0a 30 34 39 31 34 30 38 39 914088..04914089 02c0 0d 0a 30 34 39 31 34 30 39 30 0d 0a 30 34 39 31 ..04914090..0491 02d0 34 30 39 31 0d 0a 30 34 39 31 34 30 39 32 0d 0a 4091..04914092.. 02e0 30 34 39 31 34 30 39 33 0d 0a 30 34 39 31 34 30 04914093..049140 02f0 39 34 0d 0a 30 34 39 31 34 30 39 35 0d 0a 30 34 94..04914095..04 0300 39 31 34 30 39 36 0d 0a 30 34 39 31 34 30 39 37 914096..04914097 0310 0d 0a 30 34 39 31 34 30 39 38 0d 0a 30 34 39 31 ..04914098..0491 0320 34 30 39 39 0d 0a 30 34 39 31 34 31 30 30 0d 0a 4099..04914100.. 0330 30 34 39 31 34 31 30 31 0d 0a 30 34 39 31 34 31 04914101..049141 0340 30 32 0d 0a 30 34 39 31 34 31 30 33 0d 0a 30 34 02..04914103..04 0350 39 31 34 31 30 34 0d 0a 30 34 39 31 34 31 30 35 914104..04914105 0360 0d 0a 30 34 39 31 34 31 30 36 0d 0a 30 34 39 31 ..04914106..0491 0370 34 31 30 37 0d 0a 30 34 39 31 34 31 30 38 0d 0a 4107..04914108.. 0380 30 34 39 31 34 31 30 39 0d 0a 30 34 39 31 34 31 04914109..049141 0390 31 30 0d 0a 30 34 39 31 34 31 31 31 0d 0a 30 34 10..04914111..04 03a0 39 31 34 31 31 32 0d 0a 30 34 39 31 34 31 31 33 914112..04914113 03b0 0d 0a 30 34 39 31 34 31 31 34 0d 0a 30 34 39 31 ..04914114..0491 03c0 34 31 31 35 0d 0a 30 34 39 31 34 31 31 36 0d 0a 4115..04914116.. 03d0 30 34 39 31 34 31 31 37 0d 0a 30 34 39 31 34 31 04914117..049141 03e0 31 38 0d 0a 30 34 39 31 34 31 31 39 0d 0a 30 34 18..04914119..04 03f0 39 31 34 31 32 30 0d 0a 30 34 39 31 34 31 32 31 914120..04914121 0400 0d 0a 30 34 39 31 34 31 32 32 0d 0a 30 34 39 31 ..04914122..0491 0410 34 31 32 33 0d 0a 30 34 39 31 34 31 32 34 0d 0a 4123..04914124.. 0420 30 34 39 31 34 31 32 35 0d 0a 30 34 39 31 34 31 04914125..049141 0430 32 36 0d 0a 30 34 39 31 34 31 32 37 0d 0a 30 34 26..04914127..04 0440 39 31 34 31 32 38 0d 0a 30 34 39 31 34 31 32 39 914128..04914129 0450 0d 0a 30 34 39 31 34 31 33 30 0d 0a 30 34 39 31 ..04914130..0491 0460 34 31 33 31 0d 0a 30 34 39 31 34 31 33 32 0d 0a 4131..04914132.. 0470 30 34 39 31 34 31 33 33 0d 0a 30 34 39 31 34 31 04914133..049141 0480 33 34 0d 0a 30 34 39 31 34 31 33 35 0d 0a 30 34 34..04914135..04 0490 39 31 34 31 33 36 0d 0a 30 34 39 31 34 31 33 37 914136..04914137 04a0 0d 0a 30 34 39 31 34 31 33 38 0d 0a 30 34 39 31 ..04914138..0491 04b0 34 31 33 39 0d 0a 30 34 39 31 34 31 34 30 0d 0a 4139..04914140.. 04c0 30 34 39 31 34 31 34 31 0d 0a 30 34 39 31 34 31 04914141..049141 04d0 34 32 0d 0a 30 34 39 31 34 31 34 33 0d 0a 30 34 42..04914143..04 04e0 39 31 34 31 34 34 0d 0a 30 34 39 31 34 31 34 35 914144..04914145 04f0 0d 0a 30 34 39 31 34 31 34 36 0d 0a 30 34 39 31 ..04914146..0491 0500 34 31 34 37 0d 0a 30 34 39 31 34 31 34 38 0d 0a 4147..04914148.. 0510 30 34 39 31 34 31 34 39 0d 0a 30 34 39 31 34 31 04914149..049141 0520 35 30 0d 0a 30 34 39 31 34 31 35 31 0d 0a 30 34 50..04914151..04 0530 39 31 34 31 35 32 0d 0a 30 34 39 31 34 31 35 33 914152..04914153 0540 0d 0a 30 34 39 31 34 31 35 34 0d 0a 30 34 39 31 ..04914154..0491 0550 34 31 35 35 0d 0a 30 34 39 31 34 31 35 36 0d 0a 4155..04914156.. 0560 30 34 39 31 34 31 35 37 0d 0a 30 34 39 31 34 31 04914157..049141 0570 35 38 0d 0a 30 34 39 31 34 31 35 39 0d 0a 30 34 58..04914159..04 0580 39 31 34 31 36 30 0d 0a 30 34 39 31 34 31 36 31 914160..04914161 0590 0d 0a 30 34 39 31 34 31 36 32 0d 0a 30 34 39 31 ..04914162..0491 05a0 34 31 36 33 0d 0a 30 34 39 31 34 31 36 34 0d 0a 4163..04914164.. 05b0 30 34 39 31 34 31 36 35 0d 0a 30 34 39 31 34 31 04914165..049141 05c0 36 36 0d 0a 30 34 39 31 34 31 36 37 0d 0a 30 34 66..04914167..04 05d0 39 31 34 31 36 38 0d 0a 30 34 39 31 34 31 36 39 914168..04914169 05e0 0d 0a 30 34 39 31 34 31 37 30 ..04914170 No. Time Source Destination Protocol Info 54741 8.975828 10.10.59.4 10.10.59.16 SMB Write Request, FID: 0x2d83, 16580 bytes at offset 49123720 Frame 54741 (1514 bytes on wire, 1514 bytes captured) Arrival Time: May 13, 2005 17:15:24.365749000 Time delta from previous packet: 0.000243000 seconds Time since reference or first frame: 8.975828000 seconds Frame Number: 54741 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:nbss:smb Ethernet II, Src: 00:10:18:0a:d1:01, Dst: 00:e0:81:61:5d:9c Destination: 00:e0:81:61:5d:9c (10.10.59.16) Source: 00:10:18:0a:d1:01 (Broadcom_0a:d1:01) Type: IP (0x0800) Internet Protocol, Src Addr: 10.10.59.4 (10.10.59.4), Dst Addr: 10.10.59.16 (10.10.59.16) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xd9a3 (55715) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x9150 (correct) Source: 10.10.59.4 (10.10.59.4) Destination: 10.10.59.16 (10.10.59.16) Transmission Control Protocol, Src Port: 2603 (2603), Dst Port: netbios-ssn (139), Seq: 49302597, Ack: 131675, Len: 1460 Source port: 2603 (2603) Destination port: netbios-ssn (139) Sequence number: 49302597 (relative sequence number) Next sequence number: 49304057 (relative sequence number) Acknowledgement number: 131675 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65248 Checksum: 0xa9df (correct) Last frame of this PDU: 54757 Time until the last segment of this PDU: 0.001461000 seconds SEQ/ACK analysis NetBIOS Session Service Message Type: Session message Flags: 0x00 .... ...0 = Add 0 to length Length: 16628 SMB (Server Message Block Protocol) SMB Header Server Component: SMB Response in: 54759 SMB Command: Write (0x0b) NT Status: STATUS_SUCCESS (0x00000000) Flags: 0x18 0... .... = Request/Response: Message is a request to the server .0.. .... = Notify: Notify client only on open ..0. .... = Oplocks: OpLock not requested/granted ...1 .... = Canonicalized Pathnames: Pathnames are canonicalized .... 1... = Case Sensitivity: Path names are caseless .... ..0. = Receive Buffer Posted: Receive buffer has not been posted .... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported Flags2: 0x4803 0... .... .... .... = Unicode Strings: Strings are ASCII .1.. .... .... .... = Error Code Type: Error codes are NT error codes ..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only ...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs .... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported .... .... .0.. .... = Long Names Used: Path names in request are not long file names .... .... .... .0.. = Security Signatures: Security signatures are not supported .... .... .... ..1. = Extended Attributes: Extended attributes are supported .... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response Process ID High: 0 Signature: 0000000000000000 Reserved: 0000 Tree ID: 1 Process ID: 65279 User ID: 100 Multiplex ID: 65153 Write Request (0x0b) Word Count (WCT): 5 FID: 0x2d83 Count: 16580 Offset: 49123720 Remaining: 0 Byte Count (BCC): 16583 Buffer Format: Data Block (1) Data Length: 16580 File Data: Incomplete. Only 1408 of 16580 bytes 0000 00 e0 81 61 5d 9c 00 10 18 0a d1 01 08 00 45 00 ...a].........E. 0010 05 dc d9 a3 40 00 80 06 91 50 0a 0a 3b 04 0a 0a ....@....P..;... 0020 3b 10 0a 2b 00 8b 93 24 ee 0a 3f 21 13 73 50 10 ;..+...$..?!.sP. 0030 fe e0 a9 df 00 00 00 00 40 f4 ff 53 4d 42 0b 00 ........@..SMB.. 0040 00 00 00 18 03 48 00 00 00 00 00 00 00 00 00 00 .....H.......... 0050 00 00 01 00 ff fe 64 00 81 fe 05 83 2d c4 40 88 ......d.....-.@. 0060 91 ed 02 00 00 c7 40 01 c4 40 30 34 39 31 32 33 ......@..@049123 0070 37 32 0d 0a 30 34 39 31 32 33 37 33 0d 0a 30 34 72..04912373..04 0080 39 31 32 33 37 34 0d 0a 30 34 39 31 32 33 37 35 912374..04912375 0090 0d 0a 30 34 39 31 32 33 37 36 0d 0a 30 34 39 31 ..04912376..0491 00a0 32 33 37 37 0d 0a 30 34 39 31 32 33 37 38 0d 0a 2377..04912378.. 00b0 30 34 39 31 32 33 37 39 0d 0a 30 34 39 31 32 33 04912379..049123 00c0 38 30 0d 0a 30 34 39 31 32 33 38 31 0d 0a 30 34 80..04912381..04 00d0 39 31 32 33 38 32 0d 0a 30 34 39 31 32 33 38 33 912382..04912383 00e0 0d 0a 30 34 39 31 32 33 38 34 0d 0a 30 34 39 31 ..04912384..0491 00f0 32 33 38 35 0d 0a 30 34 39 31 32 33 38 36 0d 0a 2385..04912386.. 0100 30 34 39 31 32 33 38 37 0d 0a 30 34 39 31 32 33 04912387..049123 0110 38 38 0d 0a 30 34 39 31 32 33 38 39 0d 0a 30 34 88..04912389..04 0120 39 31 32 33 39 30 0d 0a 30 34 39 31 32 33 39 31 912390..04912391 0130 0d 0a 30 34 39 31 32 33 39 32 0d 0a 30 34 39 31 ..04912392..0491 0140 32 33 39 33 0d 0a 30 34 39 31 32 33 39 34 0d 0a 2393..04912394.. 0150 30 34 39 31 32 33 39 35 0d 0a 30 34 39 31 32 33 04912395..049123 0160 39 36 0d 0a 30 34 39 31 32 33 39 37 0d 0a 30 34 96..04912397..04 0170 39 31 32 33 39 38 0d 0a 30 34 39 31 32 33 39 39 912398..04912399 0180 0d 0a 30 34 39 31 32 34 30 30 0d 0a 30 34 39 31 ..04912400..0491 0190 32 34 30 31 0d 0a 30 34 39 31 32 34 30 32 0d 0a 2401..04912402.. 01a0 30 34 39 31 32 34 30 33 0d 0a 30 34 39 31 32 34 04912403..049124 01b0 30 34 0d 0a 30 34 39 31 32 34 30 35 0d 0a 30 34 04..04912405..04 01c0 39 31 32 34 30 36 0d 0a 30 34 39 31 32 34 30 37 912406..04912407 01d0 0d 0a 30 34 39 31 32 34 30 38 0d 0a 30 34 39 31 ..04912408..0491 01e0 32 34 30 39 0d 0a 30 34 39 31 32 34 31 30 0d 0a 2409..04912410.. 01f0 30 34 39 31 32 34 31 31 0d 0a 30 34 39 31 32 34 04912411..049124 0200 31 32 0d 0a 30 34 39 31 32 34 31 33 0d 0a 30 34 12..04912413..04 0210 39 31 32 34 31 34 0d 0a 30 34 39 31 32 34 31 35 912414..04912415 0220 0d 0a 30 34 39 31 32 34 31 36 0d 0a 30 34 39 31 ..04912416..0491 0230 32 34 31 37 0d 0a 30 34 39 31 32 34 31 38 0d 0a 2417..04912418.. 0240 30 34 39 31 32 34 31 39 0d 0a 30 34 39 31 32 34 04912419..049124 0250 32 30 0d 0a 30 34 39 31 32 34 32 31 0d 0a 30 34 20..04912421..04 0260 39 31 32 34 32 32 0d 0a 30 34 39 31 32 34 32 33 912422..04912423 0270 0d 0a 30 34 39 31 32 34 32 34 0d 0a 30 34 39 31 ..04912424..0491 0280 32 34 32 35 0d 0a 30 34 39 31 32 34 32 36 0d 0a 2425..04912426.. 0290 30 34 39 31 32 34 32 37 0d 0a 30 34 39 31 32 34 04912427..049124 02a0 32 38 0d 0a 30 34 39 31 32 34 32 39 0d 0a 30 34 28..04912429..04 02b0 39 31 32 34 33 30 0d 0a 30 34 39 31 32 34 33 31 912430..04912431 02c0 0d 0a 30 34 39 31 32 34 33 32 0d 0a 30 34 39 31 ..04912432..0491 02d0 32 34 33 33 0d 0a 30 34 39 31 32 34 33 34 0d 0a 2433..04912434.. 02e0 30 34 39 31 32 34 33 35 0d 0a 30 34 39 31 32 34 04912435..049124 02f0 33 36 0d 0a 30 34 39 31 32 34 33 37 0d 0a 30 34 36..04912437..04 0300 39 31 32 34 33 38 0d 0a 30 34 39 31 32 34 33 39 912438..04912439 0310 0d 0a 30 34 39 31 32 34 34 30 0d 0a 30 34 39 31 ..04912440..0491 0320 32 34 34 31 0d 0a 30 34 39 31 32 34 34 32 0d 0a 2441..04912442.. 0330 30 34 39 31 32 34 34 33 0d 0a 30 34 39 31 32 34 04912443..049124 0340 34 34 0d 0a 30 34 39 31 32 34 34 35 0d 0a 30 34 44..04912445..04 0350 39 31 32 34 34 36 0d 0a 30 34 39 31 32 34 34 37 912446..04912447 0360 0d 0a 30 34 39 31 32 34 34 38 0d 0a 30 34 39 31 ..04912448..0491 0370 32 34 34 39 0d 0a 30 34 39 31 32 34 35 30 0d 0a 2449..04912450.. 0380 30 34 39 31 32 34 35 31 0d 0a 30 34 39 31 32 34 04912451..049124 0390 35 32 0d 0a 30 34 39 31 32 34 35 33 0d 0a 30 34 52..04912453..04 03a0 39 31 32 34 35 34 0d 0a 30 34 39 31 32 34 35 35 912454..04912455 03b0 0d 0a 30 34 39 31 32 34 35 36 0d 0a 30 34 39 31 ..04912456..0491 03c0 32 34 35 37 0d 0a 30 34 39 31 32 34 35 38 0d 0a 2457..04912458.. 03d0 30 34 39 31 32 34 35 39 0d 0a 30 34 39 31 32 34 04912459..049124 03e0 36 30 0d 0a 30 34 39 31 32 34 36 31 0d 0a 30 34 60..04912461..04 03f0 39 31 32 34 36 32 0d 0a 30 34 39 31 32 34 36 33 912462..04912463 0400 0d 0a 30 34 39 31 32 34 36 34 0d 0a 30 34 39 31 ..04912464..0491 0410 32 34 36 35 0d 0a 30 34 39 31 32 34 36 36 0d 0a 2465..04912466.. 0420 30 34 39 31 32 34 36 37 0d 0a 30 34 39 31 32 34 04912467..049124 0430 36 38 0d 0a 30 34 39 31 32 34 36 39 0d 0a 30 34 68..04912469..04 0440 39 31 32 34 37 30 0d 0a 30 34 39 31 32 34 37 31 912470..04912471 0450 0d 0a 30 34 39 31 32 34 37 32 0d 0a 30 34 39 31 ..04912472..0491 0460 32 34 37 33 0d 0a 30 34 39 31 32 34 37 34 0d 0a 2473..04912474.. 0470 30 34 39 31 32 34 37 35 0d 0a 30 34 39 31 32 34 04912475..049124 0480 37 36 0d 0a 30 34 39 31 32 34 37 37 0d 0a 30 34 76..04912477..04 0490 39 31 32 34 37 38 0d 0a 30 34 39 31 32 34 37 39 912478..04912479 04a0 0d 0a 30 34 39 31 32 34 38 30 0d 0a 30 34 39 31 ..04912480..0491 04b0 32 34 38 31 0d 0a 30 34 39 31 32 34 38 32 0d 0a 2481..04912482.. 04c0 30 34 39 31 32 34 38 33 0d 0a 30 34 39 31 32 34 04912483..049124 04d0 38 34 0d 0a 30 34 39 31 32 34 38 35 0d 0a 30 34 84..04912485..04 04e0 39 31 32 34 38 36 0d 0a 30 34 39 31 32 34 38 37 912486..04912487 04f0 0d 0a 30 34 39 31 32 34 38 38 0d 0a 30 34 39 31 ..04912488..0491 0500 32 34 38 39 0d 0a 30 34 39 31 32 34 39 30 0d 0a 2489..04912490.. 0510 30 34 39 31 32 34 39 31 0d 0a 30 34 39 31 32 34 04912491..049124 0520 39 32 0d 0a 30 34 39 31 32 34 39 33 0d 0a 30 34 92..04912493..04 0530 39 31 32 34 39 34 0d 0a 30 34 39 31 32 34 39 35 912494..04912495 0540 0d 0a 30 34 39 31 32 34 39 36 0d 0a 30 34 39 31 ..04912496..0491 0550 32 34 39 37 0d 0a 30 34 39 31 32 34 39 38 0d 0a 2497..04912498.. 0560 30 34 39 31 32 34 39 39 0d 0a 30 34 39 31 32 35 04912499..049125 0570 30 30 0d 0a 30 34 39 31 32 35 30 31 0d 0a 30 34 00..04912501..04 0580 39 31 32 35 30 32 0d 0a 30 34 39 31 32 35 30 33 912502..04912503 0590 0d 0a 30 34 39 31 32 35 30 34 0d 0a 30 34 39 31 ..04912504..0491 05a0 32 35 30 35 0d 0a 30 34 39 31 32 35 30 36 0d 0a 2505..04912506.. 05b0 30 34 39 31 32 35 30 37 0d 0a 30 34 39 31 32 35 04912507..049125 05c0 30 38 0d 0a 30 34 39 31 32 35 30 39 0d 0a 30 34 08..04912509..04 05d0 39 31 32 35 31 30 0d 0a 30 34 39 31 32 35 31 31 912510..04912511 05e0 0d 0a 30 34 39 31 32 35 31 32 ..04912512 No. Time Source Destination Protocol Info 54760 8.978508 10.10.59.4 10.10.59.16 SMB Write Request, FID: 0x2d83, 16580 bytes at offset 49152000 Frame 54760 (1514 bytes on wire, 1514 bytes captured) Arrival Time: May 13, 2005 17:15:24.368429000 Time delta from previous packet: 0.000978000 seconds Time since reference or first frame: 8.978508000 seconds Frame Number: 54760 Packet Length: 1514 bytes Capture Length: 1514 bytes Protocols in frame: eth:ip:tcp:nbss:smb Ethernet II, Src: 00:10:18:0a:d1:01, Dst: 00:e0:81:61:5d:9c Destination: 00:e0:81:61:5d:9c (10.10.59.16) Source: 00:10:18:0a:d1:01 (Broadcom_0a:d1:01) Type: IP (0x0800) Internet Protocol, Src Addr: 10.10.59.4 (10.10.59.4), Dst Addr: 10.10.59.16 (10.10.59.16) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1500 Identification: 0xd9af (55727) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x9144 (correct) Source: 10.10.59.4 (10.10.59.4) Destination: 10.10.59.16 (10.10.59.16) Transmission Control Protocol, Src Port: 2603 (2603), Dst Port: netbios-ssn (139), Seq: 49319229, Ack: 131757, Len: 1460 Source port: 2603 (2603) Destination port: netbios-ssn (139) Sequence number: 49319229 (relative sequence number) Next sequence number: 49320689 (relative sequence number) Acknowledgement number: 131757 (relative ack number) Header length: 20 bytes Flags: 0x0010 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 65166 Checksum: 0xb951 (correct) Last frame of this PDU: 54775 Time until the last segment of this PDU: 0.001217000 seconds SEQ/ACK analysis This is an ACK to the segment in frame: 54759 The RTT to ACK the segment was: 0.000978000 seconds NetBIOS Session Service Message Type: Session message Flags: 0x00 .... ...0 = Add 0 to length Length: 16628 SMB (Server Message Block Protocol) SMB Header Server Component: SMB Response in: 54778 SMB Command: Write (0x0b) NT Status: STATUS_SUCCESS (0x00000000) Flags: 0x18 0... .... = Request/Response: Message is a request to the server .0.. .... = Notify: Notify client only on open ..0. .... = Oplocks: OpLock not requested/granted ...1 .... = Canonicalized Pathnames: Pathnames are canonicalized .... 1... = Case Sensitivity: Path names are caseless .... ..0. = Receive Buffer Posted: Receive buffer has not been posted .... ...0 = Lock and Read: Lock&Read, Write&Unlock are not supported Flags2: 0x4803 0... .... .... .... = Unicode Strings: Strings are ASCII .1.. .... .... .... = Error Code Type: Error codes are NT error codes ..0. .... .... .... = Execute-only Reads: Don't permit reads if execute-only ...0 .... .... .... = Dfs: Don't resolve pathnames with Dfs .... 1... .... .... = Extended Security Negotiation: Extended security negotiation is supported .... .... .0.. .... = Long Names Used: Path names in request are not long file names .... .... .... .0.. = Security Signatures: Security signatures are not supported .... .... .... ..1. = Extended Attributes: Extended attributes are supported .... .... .... ...1 = Long Names Allowed: Long file names are allowed in the response Process ID High: 0 Signature: 0000000000000000 Reserved: 0000 Tree ID: 1 Process ID: 65279 User ID: 100 Multiplex ID: 65217 Write Request (0x0b) Word Count (WCT): 5 FID: 0x2d83 Count: 16580 Offset: 49152000 Remaining: 0 Byte Count (BCC): 16583 Buffer Format: Data Block (1) Data Length: 16580 File Data: Incomplete. Only 1408 of 16580 bytes 0000 00 e0 81 61 5d 9c 00 10 18 0a d1 01 08 00 45 00 ...a].........E. 0010 05 dc d9 af 40 00 80 06 91 44 0a 0a 3b 04 0a 0a ....@....D..;... 0020 3b 10 0a 2b 00 8b 93 25 2f 02 3f 21 13 c5 50 10 ;..+...%/.?!..P. 0030 fe 8e b9 51 00 00 00 00 40 f4 ff 53 4d 42 0b 00 ...Q....@..SMB.. 0040 00 00 00 18 03 48 00 00 00 00 00 00 00 00 00 00 .....H.......... 0050 00 00 01 00 ff fe 64 00 c1 fe 05 83 2d c4 40 00 ......d.....-.@. 0060 00 ee 02 00 00 c7 40 01 c4 40 30 34 39 31 35 32 ......@..@049152 0070 30 30 0d 0a 30 34 39 31 35 32 30 31 0d 0a 30 34 00..04915201..04 0080 39 31 35 32 30 32 0d 0a 30 34 39 31 35 32 30 33 915202..04915203 0090 0d 0a 30 34 39 31 35 32 30 34 0d 0a 30 34 39 31 ..04915204..0491 00a0 35 32 30 35 0d 0a 30 34 39 31 35 32 30 36 0d 0a 5205..04915206.. 00b0 30 34 39 31 35 32 30 37 0d 0a 30 34 39 31 35 32 04915207..049152 00c0 30 38 0d 0a 30 34 39 31 35 32 30 39 0d 0a 30 34 08..04915209..04 00d0 39 31 35 32 31 30 0d 0a 30 34 39 31 35 32 31 31 915210..04915211 00e0 0d 0a 30 34 39 31 35 32 31 32 0d 0a 30 34 39 31 ..04915212..0491 00f0 35 32 31 33 0d 0a 30 34 39 31 35 32 31 34 0d 0a 5213..04915214.. 0100 30 34 39 31 35 32 31 35 0d 0a 30 34 39 31 35 32 04915215..049152 0110 31 36 0d 0a 30 34 39 31 35 32 31 37 0d 0a 30 34 16..04915217..04 0120 39 31 35 32 31 38 0d 0a 30 34 39 31 35 32 31 39 915218..04915219 0130 0d 0a 30 34 39 31 35 32 32 30 0d 0a 30 34 39 31 ..04915220..0491 0140 35 32 32 31 0d 0a 30 34 39 31 35 32 32 32 0d 0a 5221..04915222.. 0150 30 34 39 31 35 32 32 33 0d 0a 30 34 39 31 35 32 04915223..049152 0160 32 34 0d 0a 30 34 39 31 35 32 32 35 0d 0a 30 34 24..04915225..04 0170 39 31 35 32 32 36 0d 0a 30 34 39 31 35 32 32 37 915226..04915227 0180 0d 0a 30 34 39 31 35 32 32 38 0d 0a 30 34 39 31 ..04915228..0491 0190 35 32 32 39 0d 0a 30 34 39 31 35 32 33 30 0d 0a 5229..04915230.. 01a0 30 34 39 31 35 32 33 31 0d 0a 30 34 39 31 35 32 04915231..049152 01b0 33 32 0d 0a 30 34 39 31 35 32 33 33 0d 0a 30 34 32..04915233..04 01c0 39 31 35 32 33 34 0d 0a 30 34 39 31 35 32 33 35 915234..04915235 01d0 0d 0a 30 34 39 31 35 32 33 36 0d 0a 30 34 39 31 ..04915236..0491 01e0 35 32 33 37 0d 0a 30 34 39 31 35 32 33 38 0d 0a 5237..04915238.. 01f0 30 34 39 31 35 32 33 39 0d 0a 30 34 39 31 35 32 04915239..049152 0200 34 30 0d 0a 30 34 39 31 35 32 34 31 0d 0a 30 34 40..04915241..04 0210 39 31 35 32 34 32 0d 0a 30 34 39 31 35 32 34 33 915242..04915243 0220 0d 0a 30 34 39 31 35 32 34 34 0d 0a 30 34 39 31 ..04915244..0491 0230 35 32 34 35 0d 0a 30 34 39 31 35 32 34 36 0d 0a 5245..04915246.. 0240 30 34 39 31 35 32 34 37 0d 0a 30 34 39 31 35 32 04915247..049152 0250 34 38 0d 0a 30 34 39 31 35 32 34 39 0d 0a 30 34 48..04915249..04 0260 39 31 35 32 35 30 0d 0a 30 34 39 31 35 32 35 31 915250..04915251 0270 0d 0a 30 34 39 31 35 32 35 32 0d 0a 30 34 39 31 ..04915252..0491 0280 35 32 35 33 0d 0a 30 34 39 31 35 32 35 34 0d 0a 5253..04915254.. 0290 30 34 39 31 35 32 35 35 0d 0a 30 34 39 31 35 32 04915255..049152 02a0 35 36 0d 0a 30 34 39 31 35 32 35 37 0d 0a 30 34 56..04915257..04 02b0 39 31 35 32 35 38 0d 0a 30 34 39 31 35 32 35 39 915258..04915259 02c0 0d 0a 30 34 39 31 35 32 36 30 0d 0a 30 34 39 31 ..04915260..0491 02d0 35 32 36 31 0d 0a 30 34 39 31 35 32 36 32 0d 0a 5261..04915262.. 02e0 30 34 39 31 35 32 36 33 0d 0a 30 34 39 31 35 32 04915263..049152 02f0 36 34 0d 0a 30 34 39 31 35 32 36 35 0d 0a 30 34 64..04915265..04 0300 39 31 35 32 36 36 0d 0a 30 34 39 31 35 32 36 37 915266..04915267 0310 0d 0a 30 34 39 31 35 32 36 38 0d 0a 30 34 39 31 ..04915268..0491 0320 35 32 36 39 0d 0a 30 34 39 31 35 32 37 30 0d 0a 5269..04915270.. 0330 30 34 39 31 35 32 37 31 0d 0a 30 34 39 31 35 32 04915271..049152 0340 37 32 0d 0a 30 34 39 31 35 32 37 33 0d 0a 30 34 72..04915273..04 0350 39 31 35 32 37 34 0d 0a 30 34 39 31 35 32 37 35 915274..04915275 0360 0d 0a 30 34 39 31 35 32 37 36 0d 0a 30 34 39 31 ..04915276..0491 0370 35 32 37 37 0d 0a 30 34 39 31 35 32 37 38 0d 0a 5277..04915278.. 0380 30 34 39 31 35 32 37 39 0d 0a 30 34 39 31 35 32 04915279..049152 0390 38 30 0d 0a 30 34 39 31 35 32 38 31 0d 0a 30 34 80..04915281..04 03a0 39 31 35 32 38 32 0d 0a 30 34 39 31 35 32 38 33 915282..04915283 03b0 0d 0a 30 34 39 31 35 32 38 34 0d 0a 30 34 39 31 ..04915284..0491 03c0 35 32 38 35 0d 0a 30 34 39 31 35 32 38 36 0d 0a 5285..04915286.. 03d0 30 34 39 31 35 32 38 37 0d 0a 30 34 39 31 35 32 04915287..049152 03e0 38 38 0d 0a 30 34 39 31 35 32 38 39 0d 0a 30 34 88..04915289..04 03f0 39 31 35 32 39 30 0d 0a 30 34 39 31 35 32 39 31 915290..04915291 0400 0d 0a 30 34 39 31 35 32 39 32 0d 0a 30 34 39 31 ..04915292..0491 0410 35 32 39 33 0d 0a 30 34 39 31 35 32 39 34 0d 0a 5293..04915294.. 0420 30 34 39 31 35 32 39 35 0d 0a 30 34 39 31 35 32 04915295..049152 0430 39 36 0d 0a 30 34 39 31 35 32 39 37 0d 0a 30 34 96..04915297..04 0440 39 31 35 32 39 38 0d 0a 30 34 39 31 35 32 39 39 915298..04915299 0450 0d 0a 30 34 39 31 35 33 30 30 0d 0a 30 34 39 31 ..04915300..0491 0460 35 33 30 31 0d 0a 30 34 39 31 35 33 30 32 0d 0a 5301..04915302.. 0470 30 34 39 31 35 33 30 33 0d 0a 30 34 39 31 35 33 04915303..049153 0480 30 34 0d 0a 30 34 39 31 35 33 30 35 0d 0a 30 34 04..04915305..04 0490 39 31 35 33 30 36 0d 0a 30 34 39 31 35 33 30 37 915306..04915307 04a0 0d 0a 30 34 39 31 35 33 30 38 0d 0a 30 34 39 31 ..04915308..0491 04b0 35 33 30 39 0d 0a 30 34 39 31 35 33 31 30 0d 0a 5309..04915310.. 04c0 30 34 39 31 35 33 31 31 0d 0a 30 34 39 31 35 33 04915311..049153 04d0 31 32 0d 0a 30 34 39 31 35 33 31 33 0d 0a 30 34 12..04915313..04 04e0 39 31 35 33 31 34 0d 0a 30 34 39 31 35 33 31 35 915314..04915315 04f0 0d 0a 30 34 39 31 35 33 31 36 0d 0a 30 34 39 31 ..04915316..0491 0500 35 33 31 37 0d 0a 30 34 39 31 35 33 31 38 0d 0a 5317..04915318.. 0510 30 34 39 31 35 33 31 39 0d 0a 30 34 39 31 35 33 04915319..049153 0520 32 30 0d 0a 30 34 39 31 35 33 32 31 0d 0a 30 34 20..04915321..04 0530 39 31 35 33 32 32 0d 0a 30 34 39 31 35 33 32 33 915322..04915323 0540 0d 0a 30 34 39 31 35 33 32 34 0d 0a 30 34 39 31 ..04915324..0491 0550 35 33 32 35 0d 0a 30 34 39 31 35 33 32 36 0d 0a 5325..04915326.. 0560 30 34 39 31 35 33 32 37 0d 0a 30 34 39 31 35 33 04915327..049153 0570 32 38 0d 0a 30 34 39 31 35 33 32 39 0d 0a 30 34 28..04915329..04 0580 39 31 35 33 33 30 0d 0a 30 34 39 31 35 33 33 31 915330..04915331 0590 0d 0a 30 34 39 31 35 33 33 32 0d 0a 30 34 39 31 ..04915332..0491 05a0 35 33 33 33 0d 0a 30 34 39 31 35 33 33 34 0d 0a 5333..04915334.. 05b0 30 34 39 31 35 33 33 35 0d 0a 30 34 39 31 35 33 04915335..049153 05c0 33 36 0d 0a 30 34 39 31 35 33 33 37 0d 0a 30 34 36..04915337..04 05d0 39 31 35 33 33 38 0d 0a 30 34 39 31 35 33 33 39 915338..04915339 05e0 0d 0a 30 34 39 31 35 33 34 30 ..04915340