Attachment 1362 Details for Bug 2975 – Log of operation at level 6

Log of operation at level 6

fileupload2.log (text/plain), 470.90 KB, created by tarjei on 2005-08-10 05:44:56 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: tarjei

Created: 2005-08-10 05:44:56 UTC

Size: 470.90 KB

patch

obsolete

>  smb_tid=5
>  smb_pid=65279
>  smb_uid=126
>  smb_mid=25028
>  smt_wct=0
>  smb_bcc=0
>[2005/08/10 14:40:52, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,39)
>[2005/08/10 14:40:52, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,39) wrote 39
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0xfa
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150626 of length 254
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=250
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25092
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  166 (0xA6)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  166 (0xA6)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=183
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2005/08/10 14:41:08, 5] auth/auth_util.c:debug_nt_user_token(490)
>  NT user token of user S-1-5-21-2835518385-1596783884-3863852789-2996
>  contains 6 SIDs
>  SID[  0]: S-1-5-21-2835518385-1596783884-3863852789-2996
>  SID[  1]: S-1-5-21-2835518385-1596783884-3863852789-512
>  SID[  2]: S-1-1-0
>  SID[  3]: S-1-5-2
>  SID[  4]: S-1-5-11
>  SID[  5]: S-1-5-21-2835518385-1596783884-3863852789-1001
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2005/08/10 14:41:08, 5] auth/auth_util.c:debug_unix_user_token(506)
>  UNIX token of user 0
>  Primary group is 0 and contains 1 supplementary groups
>  Group[  0]: 0
>[2005/08/10 14:41:08, 5] smbd/uid.c:change_to_user(304)
>  change_to_user uid=(0,0) gid=(0,0)
>[2005/08/10 14:41:08, 4] smbd/vfs.c:vfs_ChDir(660)
>  vfs_ChDir to /var/tmp
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=166 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 166
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 00a6
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000537c
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 0000008e
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0045
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0x45 - api_rpcTNP: rpc command: SPOOLSS_OPENPRINTEREX
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[1].fn == 0x8143160
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_open_printer_ex 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 printername_ptr: 010dfb40
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00001c spoolss_io_printer_default 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          001c datatype_ptr: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 size: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 devmode_ptr: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 access_required: 00020002
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      002c user_switch: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000030 spool_io_user_level 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 level: 00000001
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 ptr: 014cf548
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0038 size: 0000001c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              003c client_name_ptr: 003ecbb0
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0040 user_name_ptr: 014cf5a4
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0044 build: 00000a28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0048 major: 00000003
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              004c minor: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0050 processor: 00610000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0054 uni_max_len: 0000000c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0058 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  005c uni_str_len: 0000000c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0060 buffer     : \.\.B.E.R.Y.L.L.I.U.M...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0078 uni_max_len: 00000005
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  007c offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0080 uni_str_len: 00000005
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0084 buffer     : r.o.o.t...
>  checking name: \\pcb
>[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142)
>  Opened policy hnd[5] [000] 00 00 00 00 61 05 00 00  00 00 00 00 E4 F5 F9 42  ....a... .......B
>  [010] 42 29 00 00                                       B).. 
>[2005/08/10 14:41:08, 3] rpc_server/srv_spoolss_nt.c:set_printer_hnd_printertype(469)
>  Setting printer type=\\pcb
>  Printer is a print server
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:set_printer_hnd_name(505)
>  Setting printer name=\\pcb (len=5)
>[2005/08/10 14:41:08, 5] rpc_server/srv_spoolss_nt.c:open_printer_hnd(642)
>  5 printer handles active
>[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 61 05 00 00  00 00 00 00 E4 F5 F9 42  ....a... .......B
>  [010] 42 29 00 00                                       B).. 
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_open_printer_ex(1734)
>  Setting print server access = SERVER_ACCESS_ENUMERATE
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_open_printer_ex 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_pol_hnd printer handle
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 data1: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 data2: 00000561
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 data3: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          000a data4: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000c data5: e4 f5 f9 42 42 29 00 00 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0014 status code: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 46
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0030
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000537c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000018
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..48]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25092
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,108)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,108) wrote 108
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0xa4
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150627 of length 168
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=164
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25156
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   80 (0x50)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   80 (0x50)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=97
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=80 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 80
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0050
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000537d
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000038
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 001a
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0x1a - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDATA
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[2].fn == 0x8142fb0
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdata 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_pol_hnd printer handle
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 data1: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 data2: 00000561
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 data3: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          000a data4: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000c data5: e4 f5 f9 42 42 29 00 00 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000014 smb_io_unistr2 valuename
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0014 uni_max_len: 0000000a
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0018 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          001c uni_str_len: 0000000a
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0020 buffer     : O.S.V.e.r.s.i.o.n...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0034 size: 00000114
>[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 61 05 00 00  00 00 00 00 E4 F5 F9 42  ....a... .......B
>  [010] 42 29 00 00                                       B).. 
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdata(2503)
>  _spoolss_getprinterdata
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdata 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 type: 00000003
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0004 size: 00000114
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>      0008 data: 14 01 00 00 05 00 00 00 00 00 00 00 93 08 00 00 70 6f 6c 61 72 6d 65 64 69 61 2e 6e 6f 2f 63 67 69 2d 62 69 6e 2f 67 65 74 2d 63 65 72 74 2e 70 79 2f 52 6f 6f 74 2f 63 61 2e 63 72 74 00 00 00 00 00 00 00 d9 00 00 00 c8 cd 32 08 48 1e 36 08 10 00 00 00 20 00 00 00 f8 37 36 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 61 00 00 00 70 2a 36 08 e8 37 36 08 00 00 00 00 51 00 00 00 38 27 34 08 90 47 34 08 72 20 74 6f 6b 65 6e 20 6f 66 20 75 73 65 72 20 53 2d 31 2d 35 2d 32 31 2d 32 38 33 35 35 31 38 33 38 35 2d 31 35 39 36 37 38 33 38 38 34 2d 33 38 36 33 38 35 32 37 38 39 2d 32 39 39 36 0a 00 90 00 00 00 20 00 00 00 10 cf 33 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 29 00 00 00 50 b7 33 08 f8 ce 33 08 10 00 00 00 18 00 00 00 48 2b 36 08 00 00 00 00 48 8d 3e 08 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      011c needed: 00000114
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0120 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 296
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 013c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000537d
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000124
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..316]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=372
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25156
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  316 (0x13C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  316 (0x13C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=317
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,376)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,376) wrote 376
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x80
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150628 of length 132
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=128
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25220
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   44 (0x2C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   44 (0x2C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=61
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=44 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 44
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 002c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000537e
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000014
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 001d
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0x1d - api_rpcTNP: rpc command: SPOOLSS_CLOSEPRINTER
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[3].fn == 0x8142e00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_closeprinter 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_pol_hnd printer handle
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 data1: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 data2: 00000561
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 data3: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          000a data4: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000c data5: e4 f5 f9 42 42 29 00 00 
>[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 61 05 00 00  00 00 00 00 E4 F5 F9 42  ....a... .......B
>  [010] 42 29 00 00                                       B).. 
>[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 61 05 00 00  00 00 00 00 E4 F5 F9 42  ....a... .......B
>  [010] 42 29 00 00                                       B).. 
>[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 61 05 00 00  00 00 00 00 E4 F5 F9 42  ....a... .......B
>  [010] 42 29 00 00                                       B).. 
>[2005/08/10 14:41:08, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
>  Closed policy
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_closeprinter 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_pol_hnd printer handle
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 data1: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 data2: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 data3: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          000a data4: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000c data5: 00 00 00 00 00 00 00 00 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0014 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0030
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000537e
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000018
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..48]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25220
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,108)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,108) wrote 108
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0xfa
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150629 of length 254
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=250
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25284
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  166 (0xA6)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  166 (0xA6)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=183
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=166 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 166
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 00a6
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000537f
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 0000008e
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0045
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0x45 - api_rpcTNP: rpc command: SPOOLSS_OPENPRINTEREX
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[1].fn == 0x8143160
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_open_printer_ex 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 printername_ptr: 010d22a0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00001c spoolss_io_printer_default 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          001c datatype_ptr: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 size: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 devmode_ptr: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 access_required: 00020002
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      002c user_switch: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000030 spool_io_user_level 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 level: 00000001
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 ptr: 0120f548
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0038 size: 0000001c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              003c client_name_ptr: 003ecbb0
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0040 user_name_ptr: 0120f5a4
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0044 build: 00000a28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0048 major: 00000003
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              004c minor: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0050 processor: 00650000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0054 uni_max_len: 0000000c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0058 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  005c uni_str_len: 0000000c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0060 buffer     : \.\.B.E.R.Y.L.L.I.U.M...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0078 uni_max_len: 00000005
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  007c offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0080 uni_str_len: 00000005
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0084 buffer     : r.o.o.t...
>  checking name: \\pcb
>[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142)
>  Opened policy hnd[5] [000] 00 00 00 00 62 05 00 00  00 00 00 00 E4 F5 F9 42  ....b... .......B
>  [010] 42 29 00 00                                       B).. 
>[2005/08/10 14:41:08, 3] rpc_server/srv_spoolss_nt.c:set_printer_hnd_printertype(469)
>  Setting printer type=\\pcb
>  Printer is a print server
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:set_printer_hnd_name(505)
>  Setting printer name=\\pcb (len=5)
>[2005/08/10 14:41:08, 5] rpc_server/srv_spoolss_nt.c:open_printer_hnd(642)
>  5 printer handles active
>[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 62 05 00 00  00 00 00 00 E4 F5 F9 42  ....b... .......B
>  [010] 42 29 00 00                                       B).. 
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_open_printer_ex(1734)
>  Setting print server access = SERVER_ACCESS_ENUMERATE
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_open_printer_ex 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_pol_hnd printer handle
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 data1: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 data2: 00000562
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 data3: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          000a data4: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000c data5: e4 f5 f9 42 42 29 00 00 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0014 status code: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 46
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0030
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000537f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000018
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..48]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25284
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,108)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,108) wrote 108
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0xa4
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150630 of length 168
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=164
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25348
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   80 (0x50)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   80 (0x50)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=97
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=80 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 80
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0050
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005380
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000038
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 001a
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0x1a - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDATA
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[2].fn == 0x8142fb0
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdata 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_pol_hnd printer handle
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 data1: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 data2: 00000562
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 data3: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          000a data4: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000c data5: e4 f5 f9 42 42 29 00 00 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000014 smb_io_unistr2 valuename
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0014 uni_max_len: 0000000a
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0018 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          001c uni_str_len: 0000000a
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0020 buffer     : O.S.V.e.r.s.i.o.n...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0034 size: 00000114
>[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 62 05 00 00  00 00 00 00 E4 F5 F9 42  ....b... .......B
>  [010] 42 29 00 00                                       B).. 
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdata(2503)
>  _spoolss_getprinterdata
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdata 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 type: 00000003
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0004 size: 00000114
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>      0008 data: 14 01 00 00 05 00 00 00 00 00 00 00 93 08 00 00 70 6f 6c 61 72 6d 65 64 69 61 2e 6e 6f 2f 63 67 69 2d 62 69 6e 2f 67 65 74 2d 63 65 72 74 2e 70 79 2f 52 6f 6f 74 2f 63 61 2e 63 72 74 00 00 00 00 00 00 00 d9 00 00 00 c8 cd 32 08 48 1e 36 08 10 00 00 00 20 00 00 00 f8 37 36 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 61 00 00 00 70 2a 36 08 e8 37 36 08 00 00 00 00 51 00 00 00 38 27 34 08 90 47 34 08 72 20 74 6f 6b 65 6e 20 6f 66 20 75 73 65 72 20 53 2d 31 2d 35 2d 32 31 2d 32 38 33 35 35 31 38 33 38 35 2d 31 35 39 36 37 38 33 38 38 34 2d 33 38 36 33 38 35 32 37 38 39 2d 32 39 39 36 0a 00 90 00 00 00 20 00 00 00 10 cf 33 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 29 00 00 00 50 b7 33 08 f8 ce 33 08 10 00 00 00 18 00 00 00 48 2b 36 08 00 00 00 00 48 8d 3e 08 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      011c needed: 00000114
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0120 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 296
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 013c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005380
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000124
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..316]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=372
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25348
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  316 (0x13C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  316 (0x13C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=317
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,376)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,376) wrote 376
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x80
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150631 of length 132
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=128
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25412
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   44 (0x2C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   44 (0x2C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=61
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=44 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 44
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 002c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005381
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000014
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 001d
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0x1d - api_rpcTNP: rpc command: SPOOLSS_CLOSEPRINTER
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[3].fn == 0x8142e00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_closeprinter 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_pol_hnd printer handle
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 data1: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 data2: 00000562
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 data3: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          000a data4: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000c data5: e4 f5 f9 42 42 29 00 00 
>[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 62 05 00 00  00 00 00 00 E4 F5 F9 42  ....b... .......B
>  [010] 42 29 00 00                                       B).. 
>[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 62 05 00 00  00 00 00 00 E4 F5 F9 42  ....b... .......B
>  [010] 42 29 00 00                                       B).. 
>[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 62 05 00 00  00 00 00 00 E4 F5 F9 42  ....b... .......B
>  [010] 42 29 00 00                                       B).. 
>[2005/08/10 14:41:08, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
>  Closed policy
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_closeprinter 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_pol_hnd printer handle
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 data1: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 data2: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 data3: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          000a data4: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000c data5: 00 00 00 00 00 00 00 00 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0014 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0030
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005381
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000018
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..48]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25412
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,108)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,108) wrote 108
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0xfa
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150632 of length 254
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=250
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25476
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  166 (0xA6)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  166 (0xA6)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=183
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=166 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 166
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 00a6
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005382
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 0000008e
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0045
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0x45 - api_rpcTNP: rpc command: SPOOLSS_OPENPRINTEREX
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[1].fn == 0x8143160
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_open_printer_ex 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 printername_ptr: 010dfb40
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00001c spoolss_io_printer_default 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          001c datatype_ptr: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 size: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 devmode_ptr: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 access_required: 00020002
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      002c user_switch: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000030 spool_io_user_level 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 level: 00000001
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 ptr: 0148f548
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0038 size: 0000001c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              003c client_name_ptr: 003ecbb0
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0040 user_name_ptr: 0148f5a4
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0044 build: 00000a28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0048 major: 00000003
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              004c minor: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0050 processor: 00730000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0054 uni_max_len: 0000000c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0058 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  005c uni_str_len: 0000000c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0060 buffer     : \.\.B.E.R.Y.L.L.I.U.M...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0078 uni_max_len: 00000005
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  007c offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0080 uni_str_len: 00000005
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0084 buffer     : r.o.o.t...
>  checking name: \\pcb
>[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142)
>  Opened policy hnd[5] [000] 00 00 00 00 63 05 00 00  00 00 00 00 E4 F5 F9 42  ....c... .......B
>  [010] 42 29 00 00                                       B).. 
>[2005/08/10 14:41:08, 3] rpc_server/srv_spoolss_nt.c:set_printer_hnd_printertype(469)
>  Setting printer type=\\pcb
>  Printer is a print server
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:set_printer_hnd_name(505)
>  Setting printer name=\\pcb (len=5)
>[2005/08/10 14:41:08, 5] rpc_server/srv_spoolss_nt.c:open_printer_hnd(642)
>  5 printer handles active
>[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 63 05 00 00  00 00 00 00 E4 F5 F9 42  ....c... .......B
>  [010] 42 29 00 00                                       B).. 
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_open_printer_ex(1734)
>  Setting print server access = SERVER_ACCESS_ENUMERATE
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_open_printer_ex 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_pol_hnd printer handle
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 data1: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 data2: 00000563
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 data3: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          000a data4: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000c data5: e4 f5 f9 42 42 29 00 00 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0014 status code: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 46
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0030
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005382
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000018
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..48]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25476
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,108)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,108) wrote 108
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0xac
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150633 of length 176
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=172
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25540
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   88 (0x58)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   88 (0x58)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=105
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=88 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 88
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0058
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005383
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000040
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 001a
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0x1a - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDATA
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[2].fn == 0x8142fb0
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdata 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_pol_hnd printer handle
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 data1: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 data2: 00000563
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 data3: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          000a data4: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000c data5: e4 f5 f9 42 42 29 00 00 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000014 smb_io_unistr2 valuename
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0014 uni_max_len: 0000000d
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0018 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          001c uni_str_len: 0000000d
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0020 buffer     : A.r.c.h.i.t.e.c.t.u.r.e...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      003c size: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 63 05 00 00  00 00 00 00 E4 F5 F9 42  ....c... .......B
>  [010] 42 29 00 00                                       B).. 
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdata(2503)
>  _spoolss_getprinterdata
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdata 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 type: 00000001
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>      0008 data: 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 4e 00 54 00 20 00 78 00 38 00 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0 +>
>  0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 0000001e
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 546
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005383
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25540
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x80
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150634 of length 132
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=128
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25604
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   44 (0x2C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   44 (0x2C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=61
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=44 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 44
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 002c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005384
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000014
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 001d
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0x1d - api_rpcTNP: rpc command: SPOOLSS_CLOSEPRINTER
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[3].fn == 0x8142e00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_closeprinter 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_pol_hnd printer handle
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 data1: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 data2: 00000563
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 data3: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          000a data4: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000c data5: e4 f5 f9 42 42 29 00 00 
>[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 63 05 00 00  00 00 00 00 E4 F5 F9 42  ....c... .......B
>  [010] 42 29 00 00                                       B).. 
>[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 63 05 00 00  00 00 00 00 E4 F5 F9 42  ....c... .......B
>  [010] 42 29 00 00                                       B).. 
>[2005/08/10 14:41:08, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 63 05 00 00  00 00 00 00 E4 F5 F9 42  ....c... .......B
>  [010] 42 29 00 00                                       B).. 
>[2005/08/10 14:41:08, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
>  Closed policy
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_closeprinter 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_pol_hnd printer handle
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 data1: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 data2: 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 data3: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          000a data4: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000c data5: 00 00 00 00 00 00 00 00 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0014 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0030
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005384
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000018
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..48]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25604
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,108)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,108) wrote 108
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150635 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25668
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005385
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005385
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25668
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150636 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25732
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005386
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005386
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25732
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150637 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25796
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005387
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005387
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25796
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150638 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25860
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005388
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005388
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25860
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150639 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25924
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005389
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005389
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25924
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150640 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25988
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000538a
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000538a
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=25988
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150641 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26052
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000538b
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000538b
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26052
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150642 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26116
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000538c
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000538c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26116
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150643 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26180
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000538d
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000538d
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26180
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150644 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26244
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000538e
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000538e
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26244
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150645 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26308
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000538f
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000538f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26308
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150646 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26372
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005390
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005390
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26372
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150647 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26436
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005391
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005391
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26436
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150648 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26500
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005392
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005392
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26500
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150649 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26564
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005393
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005393
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26564
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150650 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26628
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005394
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005394
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26628
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150651 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26692
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005395
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005395
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26692
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150652 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26756
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005396
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005396
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26756
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150653 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26820
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005397
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005397
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26820
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150654 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26884
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005398
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005398
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26884
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150655 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26948
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005399
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00005399
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=26948
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150656 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27012
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000539a
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000539a
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27012
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150657 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27076
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000539b
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000539b
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27076
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150658 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27140
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000539c
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000539c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27140
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150659 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27204
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000539d
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000539d
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27204
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150660 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27268
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000539e
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000539e
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27268
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150661 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27332
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000539f
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 0000539f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27332
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150662 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27396
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053a0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053a0
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27396
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150663 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27460
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053a1
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053a1
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27460
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150664 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27524
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053a2
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053a2
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27524
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150665 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27588
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053a3
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053a3
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27588
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150666 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27652
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053a4
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053a4
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27652
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150667 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27716
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053a5
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053a5
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27716
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150668 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27780
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053a6
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053a6
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27780
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150669 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27844
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053a7
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053a7
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27844
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150670 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27908
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053a8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053a8
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27908
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150671 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27972
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053a9
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053a9
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=27972
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150672 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=28036
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053aa
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053aa
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=28036
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150673 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=28100
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053ab
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053ab
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=28100
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150674 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=28164
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053ac
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053ac
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/08/10 14:41:08, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..560]
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=616
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=28164
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  560 (0x230)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  560 (0x230)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=561
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(449)
>  write_socket(30,620)
>[2005/08/10 14:41:08, 6] lib/util_sock.c:write_socket(452)
>  write_socket(30,620) wrote 620
>[2005/08/10 14:41:08, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x2d0
>[2005/08/10 14:41:08, 3] smbd/process.c:process_smb(1091)
>  Transaction 150675 of length 724
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(464)
>[2005/08/10 14:41:08, 5] lib/util.c:show_msg(474)
>  size=720
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=1236
>  smb_uid=126
>  smb_mid=28228
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  636 (0x27C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4140 (0x102C)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  636 (0x27C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29688 (0x73F8)
>  smb_bcc=653
>[2005/08/10 14:41:08, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 10562) conn 0x83b1568
>[2005/08/10 14:41:08, 4] smbd/uid.c:change_to_user(217)
>  change_to_user: Skipping user change - already user
>[2005/08/10 14:41:08, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=636 params=0 setup=2
>[2005/08/10 14:41:08, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/08/10 14:41:08, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/08/10 14:41:08, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=73f8
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=73f8 (pipes_open=1)
>[2005/08/10 14:41:08, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 73f8)
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 73f8 name: spoolss open: Yes len: 636
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 027c
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053ad
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000264
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000c
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/08/10 14:41:08, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0xc - api_rpcTNP: rpc command: SPOOLSS_GETPRINTERDRIVERDIRECTORY
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[28].fn == 0x8140300
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_getprinterdriverdir 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 name_ptr: 000a3ee0
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000006
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.p.c.b...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      001c : 000a3efc
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_unistr2 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 0000000f
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : W.i.n.d.o.w.s. .N.T. .x.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      004c level: 00000001
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000050 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0050 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0054 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0260 offered: 00000208
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:_spoolss_getprinterdriverdirectory(7812)
>  _spoolss_getprinterdriverdirectory
>[2005/08/10 14:41:08, 4] rpc_server/srv_spoolss_nt.c:getprinterdriverdir_level_1(7775)
>  printer driver directory: [\\pcb\print$\W32X86]
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_driverdir_1 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_unistr 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_unistr(1102)
>          0000 unistr: \.\.p.c.b.\.p.r.i.n.t.$.\.W.3.2.X.8.6...
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_getprinterdriverdir 
>[2005/08/10 14:41:08, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 spoolss_io_buffer 
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 ptr: 000a3f28
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 size: 00000208
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0210 needed: 00000028
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0214 status: WERR_OK
>[2005/08/10 14:41:08, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/08/10 14:41:08, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 134
>[2005/08/10 14:41:08, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 73f8 name: spoolss len: 4140
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0230
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 000053ad
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000218
>[2005/08/10 14:41:08, 5] rpc_parse/parse_prs.c:prs_uint16(613)

Actions: View

Attachments on bug 2975: 1362