Attachment 7191 Details for Bug 8660 – samba log creating new file (no rename)

samba log creating new file (no rename)

wxp-dom_2011-12-15.log (text/x-log), 358.78 KB, created by sven friedmann on 2011-12-15 14:26:03 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: sven friedmann

Created: 2011-12-15 14:26:03 UTC

Size: 358.78 KB

patch

obsolete

>[2011/12/15 15:22:29.093184, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 76
>[2011/12/15 15:22:29.093310,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x4c
>[2011/12/15 15:22:29.093338,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 347 of length 80 (0 toread)
>[2011/12/15 15:22:29.093363,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:29.093378,  5, pid=1905] lib/util.c:342(show_msg)
>  size=76
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=22208
>  smt_wct=15
>  smb_vwv[ 0]=    8 (0x8)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=   40 (0x28)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    8 (0x8)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    5 (0x5)
>  smb_bcc=11
>[2011/12/15 15:22:29.093653, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 00 00 EC 03 00 00 00   00 00 00                 ........ ...
>[2011/12/15 15:22:29.093692,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBtrans2 (pid 1905) conn 0x8bb88d0
>[2011/12/15 15:22:29.093731,  4, pid=1905] smbd/sec_ctx.c:314(set_sec_ctx)
>  setting sec ctx (1129, 513) - sec_ctx_stack_ndx = 0
>[2011/12/15 15:22:29.093759,  5, pid=1905] ../libcli/security/security_token.c:63(security_token_debug)
>  Security token SIDs (13):
>    SID[  0]: S-1-5-21-2132208240-841620863-785830102-3258
>    SID[  1]: S-1-5-21-2132208240-841620863-785830102-513
>    SID[  2]: S-1-5-21-2132208240-841620863-785830102-6666
>    SID[  3]: S-1-5-21-2132208240-841620863-785830102-2000
>    SID[  4]: S-1-5-21-2132208240-841620863-785830102-3000
>    SID[  5]: S-1-1-0
>    SID[  6]: S-1-5-2
>    SID[  7]: S-1-5-11
>    SID[  8]: S-1-22-1-1129
>    SID[  9]: S-1-22-2-513
>    SID[ 10]: S-1-22-2-6666
>    SID[ 11]: S-1-22-2-2000
>    SID[ 12]: S-1-22-2-3000
>   Privileges (0x               0):
>   Rights (0x               0):
>[2011/12/15 15:22:29.093954,  5, pid=1905] auth/token_util.c:527(debug_unix_user_token)
>  UNIX token of user 1129
>  Primary group is 513 and contains 4 supplementary groups
>  Group[  0]: 513
>  Group[  1]: 6666
>  Group[  2]: 2000
>  Group[  3]: 3000
>[2011/12/15 15:22:29.094042,  5, pid=1905] smbd/uid.c:317(change_to_user_internal)
>  Impersonated user: uid=(0,1129), gid=(0,513)
>[2011/12/15 15:22:29.094077,  3, pid=1905] smbd/trans2.c:5116(call_trans2qfilepathinfo)
>  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004
>[2011/12/15 15:22:29.094112,  5, pid=1905] smbd/filename.c:257(unix_convert)
>  unix_convert called on file ""
>[2011/12/15 15:22:29.094813,  5, pid=1905] smbd/filename.c:291(unix_convert)
>  conversion finished "" -> .
>[2011/12/15 15:22:29.094854,  3, pid=1905] smbd/vfs.c:905(check_reduced_name)
>  check_reduced_name [.] [/space/groups/nfs]
>[2011/12/15 15:22:29.094897, 10, pid=1905] smbd/vfs.c:969(check_reduced_name)
>  check_reduced_name realpath [.] -> [/space/groups/nfs]
>[2011/12/15 15:22:29.094924,  3, pid=1905] smbd/vfs.c:1039(check_reduced_name)
>  check_reduced_name: . reduced to /space/groups/nfs
>[2011/12/15 15:22:29.094956, 10, pid=1905] smbd/files.c:618(file_name_hash)
>  file_name_hash: /space/groups/nfs/. hash 0x62ad0565
>[2011/12/15 15:22:29.094999, 10, pid=1905] locking/locking.c:1017(fetch_share_mode_unlocked)
>  fetch_share_mode_unlocked: no share_mode record around (file not open)
>[2011/12/15 15:22:29.095025,  3, pid=1905] smbd/trans2.c:5253(call_trans2qfilepathinfo)
>  call_trans2qfilepathinfo . (fnum = -1) level=1004 call=5 total_data=0
>[2011/12/15 15:22:29.095055,  5, pid=1905] smbd/trans2.c:4228(smbd_do_qfilepathinfo)
>  smbd_do_qfilepathinfo: . (fnum = -1) level=1004 max_data=40
>[2011/12/15 15:22:29.095081,  8, pid=1905] smbd/dosmode.c:621(dos_mode)
>  dos_mode: .
>[2011/12/15 15:22:29.097063, 10, pid=1905] lib/system.c:2426(solaris_attropen)
>  attropen FAILED: path: ., name: user.DOSATTRIB, errno: No such file or directory
>[2011/12/15 15:22:29.097109, 10, pid=1905] smbd/file_access.c:205(can_access_file_data)
>  can_access_file_data: requesting 0x2 on file .
>[2011/12/15 15:22:29.097152, 10, pid=1905] modules/nfs4_acls.c:427(smb_get_nt_acl_nfs4)
>  smb_get_nt_acl_nfs4 invoked for .
>[2011/12/15 15:22:29.097189, 10, pid=1905] modules/nfs4_acls.c:271(smbacl4_nfs42win)
>  smbacl_nfs42win entered
>[2011/12/15 15:22:29.097215, 10, pid=1905] modules/nfs4_acls.c:292(smbacl4_nfs42win)
>  magic: 0x76f8a967, type: 0, iflags: 2, flags: 1003, mask: 1f01ff, who: 1
>[2011/12/15 15:22:29.097240, 10, pid=1905] modules/nfs4_acls.c:319(smbacl4_nfs42win)
>  mapped 1 to S-1-5-21-2132208240-841620863-785830102-1100
>[2011/12/15 15:22:29.097267, 10, pid=1905] modules/nfs4_acls.c:336(smbacl4_nfs42win)
>  Windows mapped ace flags: 0x1003 => 0x3
>[2011/12/15 15:22:29.097291, 10, pid=1905] modules/nfs4_acls.c:292(smbacl4_nfs42win)
>  magic: 0x76f8a967, type: 0, iflags: 2, flags: 2043, mask: 1301bf, who: 2
>[2011/12/15 15:22:29.097316, 10, pid=1905] modules/nfs4_acls.c:319(smbacl4_nfs42win)
>  mapped 2 to S-1-5-21-2132208240-841620863-785830102-3000
>[2011/12/15 15:22:29.097341, 10, pid=1905] modules/nfs4_acls.c:336(smbacl4_nfs42win)
>  Windows mapped ace flags: 0x2043 => 0x3
>[2011/12/15 15:22:29.097365, 10, pid=1905] modules/nfs4_acls.c:292(smbacl4_nfs42win)
>  magic: 0x76f8a967, type: 0, iflags: 0, flags: 3, mask: 1f01ff, who: 10000
>[2011/12/15 15:22:29.097390, 10, pid=1905] modules/nfs4_acls.c:319(smbacl4_nfs42win)
>  mapped 10000 to S-1-5-21-2132208240-841620863-785830102-21000
>[2011/12/15 15:22:29.097416, 10, pid=1905] modules/nfs4_acls.c:336(smbacl4_nfs42win)
>  Windows mapped ace flags: 0x3 => 0x3
>[2011/12/15 15:22:29.097439, 10, pid=1905] modules/nfs4_acls.c:292(smbacl4_nfs42win)
>  magic: 0x76f8a967, type: 0, iflags: 0, flags: 43, mask: 1f01ff, who: 10000
>[2011/12/15 15:22:29.097464, 10, pid=1905] modules/nfs4_acls.c:319(smbacl4_nfs42win)
>  mapped 10000 to S-1-5-21-2132208240-841620863-785830102-1077
>[2011/12/15 15:22:29.097490, 10, pid=1905] modules/nfs4_acls.c:336(smbacl4_nfs42win)
>  Windows mapped ace flags: 0x43 => 0x3
>[2011/12/15 15:22:29.097514, 10, pid=1905] modules/nfs4_acls.c:389(smb_get_nt_acl_nfs4_common)
>  after make sec_acl
>[2011/12/15 15:22:29.097540, 10, pid=1905] modules/nfs4_acls.c:400(smb_get_nt_acl_nfs4_common)
>  smb_get_nt_acl_nfs4_common successfully exited with sd_size 228
>[2011/12/15 15:22:29.097567, 10, pid=1905] smbd/file_access.c:69(can_access_file_acl)
>  can_access_file_acl for file . access_mask 0x2, access_granted 0x2 access ALLOWED
>[2011/12/15 15:22:29.097593,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       secdesc: struct security_descriptor
>          revision                 : SECURITY_DESCRIPTOR_REVISION_1 (1)
>          type                     : 0x8004 (32772)
>                 0: SEC_DESC_OWNER_DEFAULTED 
>                 0: SEC_DESC_GROUP_DEFAULTED 
>                 1: SEC_DESC_DACL_PRESENT    
>                 0: SEC_DESC_DACL_DEFAULTED  
>                 0: SEC_DESC_SACL_PRESENT    
>                 0: SEC_DESC_SACL_DEFAULTED  
>                 0: SEC_DESC_DACL_TRUSTED    
>                 0: SEC_DESC_SERVER_SECURITY 
>                 0: SEC_DESC_DACL_AUTO_INHERIT_REQ
>                 0: SEC_DESC_SACL_AUTO_INHERIT_REQ
>                 0: SEC_DESC_DACL_AUTO_INHERITED
>                 0: SEC_DESC_SACL_AUTO_INHERITED
>                 0: SEC_DESC_DACL_PROTECTED  
>                 0: SEC_DESC_SACL_PROTECTED  
>                 0: SEC_DESC_RM_CONTROL_VALID
>                 1: SEC_DESC_SELF_RELATIVE   
>          owner_sid                : *
>              owner_sid                : S-1-5-21-2132208240-841620863-785830102-1100
>          group_sid                : *
>              group_sid                : S-1-5-21-2132208240-841620863-785830102-3000
>          sacl                     : NULL
>          dacl                     : *
>              dacl: struct security_acl
>                  revision                 : SECURITY_ACL_REVISION_NT4 (2)
>                  size                     : 0x0098 (152)
>                  num_aces                 : 0x00000004 (4)
>                  aces: ARRAY(4)
>                      aces: struct security_ace
>                          type                     : SEC_ACE_TYPE_ACCESS_ALLOWED (0)
>                          flags                    : 0x03 (3)
>                                 1: SEC_ACE_FLAG_OBJECT_INHERIT
>                                 1: SEC_ACE_FLAG_CONTAINER_INHERIT
>                                 0: SEC_ACE_FLAG_NO_PROPAGATE_INHERIT
>                                 0: SEC_ACE_FLAG_INHERIT_ONLY
>                                 0: SEC_ACE_FLAG_INHERITED_ACE
>                              0x03: SEC_ACE_FLAG_VALID_INHERIT (3)
>                                 0: SEC_ACE_FLAG_SUCCESSFUL_ACCESS
>                                 0: SEC_ACE_FLAG_FAILED_ACCESS
>                          size                     : 0x0024 (36)
>                          access_mask              : 0x001f01ff (2032127)
>                          object                   : union security_ace_object_ctr(case 0)
>                          trustee                  : S-1-5-21-2132208240-841620863-785830102-1100
>                      aces: struct security_ace
>                          type                     : SEC_ACE_TYPE_ACCESS_ALLOWED (0)
>                          flags                    : 0x03 (3)
>                                 1: SEC_ACE_FLAG_OBJECT_INHERIT
>                                 1: SEC_ACE_FLAG_CONTAINER_INHERIT
>                                 0: SEC_ACE_FLAG_NO_PROPAGATE_INHERIT
>                                 0: SEC_ACE_FLAG_INHERIT_ONLY
>                                 0: SEC_ACE_FLAG_INHERITED_ACE
>                              0x03: SEC_ACE_FLAG_VALID_INHERIT (3)
>                                 0: SEC_ACE_FLAG_SUCCESSFUL_ACCESS
>                                 0: SEC_ACE_FLAG_FAILED_ACCESS
>                          size                     : 0x0024 (36)
>                          access_mask              : 0x001301ff (1245695)
>                          object                   : union security_ace_object_ctr(case 0)
>                          trustee                  : S-1-5-21-2132208240-841620863-785830102-3000
>                      aces: struct security_ace
>                          type                     : SEC_ACE_TYPE_ACCESS_ALLOWED (0)
>                          flags                    : 0x03 (3)
>                                 1: SEC_ACE_FLAG_OBJECT_INHERIT
>                                 1: SEC_ACE_FLAG_CONTAINER_INHERIT
>                                 0: SEC_ACE_FLAG_NO_PROPAGATE_INHERIT
>                                 0: SEC_ACE_FLAG_INHERIT_ONLY
>                                 0: SEC_ACE_FLAG_INHERITED_ACE
>                              0x03: SEC_ACE_FLAG_VALID_INHERIT (3)
>                                 0: SEC_ACE_FLAG_SUCCESSFUL_ACCESS
>                                 0: SEC_ACE_FLAG_FAILED_ACCESS
>                          size                     : 0x0024 (36)
>                          access_mask              : 0x001f01ff (2032127)
>                          object                   : union security_ace_object_ctr(case 0)
>                          trustee                  : S-1-5-21-2132208240-841620863-785830102-21000
>                      aces: struct security_ace
>                          type                     : SEC_ACE_TYPE_ACCESS_ALLOWED (0)
>                          flags                    : 0x03 (3)
>                                 1: SEC_ACE_FLAG_OBJECT_INHERIT
>                                 1: SEC_ACE_FLAG_CONTAINER_INHERIT
>                                 0: SEC_ACE_FLAG_NO_PROPAGATE_INHERIT
>                                 0: SEC_ACE_FLAG_INHERIT_ONLY
>                                 0: SEC_ACE_FLAG_INHERITED_ACE
>                              0x03: SEC_ACE_FLAG_VALID_INHERIT (3)
>                                 0: SEC_ACE_FLAG_SUCCESSFUL_ACCESS
>                                 0: SEC_ACE_FLAG_FAILED_ACCESS
>                          size                     : 0x0024 (36)
>                          access_mask              : 0x001f01ff (2032127)
>                          object                   : union security_ace_object_ctr(case 0)
>                          trustee                  : S-1-5-21-2132208240-841620863-785830102-1077
>[2011/12/15 15:22:29.098703,  8, pid=1905] smbd/dosmode.c:199(dos_mode_from_sbuf)
>  dos_mode_from_sbuf returning d
>[2011/12/15 15:22:29.098731,  8, pid=1905] smbd/dosmode.c:672(dos_mode)
>  dos_mode returning d
>[2011/12/15 15:22:29.098765, 10, pid=1905] smbd/trans2.c:4457(smbd_do_qfilepathinfo)
>  smbd_do_qfilepathinfo: SMB_FILE_BASIC_INFORMATION
>[2011/12/15 15:22:29.098808,  5, pid=1905] smbd/trans2.c:4467(smbd_do_qfilepathinfo)
>  SMB_QFBI - create: Thu Dec 15 15:19:03 2011
>   access: Thu Dec 15 15:19:03 2011
>   write: Thu Dec 15 15:23:05 2011
>   change: Thu Dec 15 15:23:05 2011
>   mode: 10
>[2011/12/15 15:22:29.098900,  9, pid=1905] smbd/trans2.c:941(send_trans2_replies)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010
>[2011/12/15 15:22:29.098926,  9, pid=1905] smbd/trans2.c:943(send_trans2_replies)
>  t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40
>[2011/12/15 15:22:29.098950,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:29.098964,  5, pid=1905] lib/util.c:342(show_msg)
>  size=100
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=22208
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=   40 (0x28)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   40 (0x28)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=45
>[2011/12/15 15:22:29.099189, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 00 00 00 00 90 F8 C6   7E 34 BB CC 01 90 F8 C6   ........ ~4......
>  [0010] 7E 34 BB CC 01 F9 DA 59   0F 35 BB CC 01 F9 DA 59   ~4.....Y .5.....Y
>  [0020] 0F 35 BB CC 01 10 00 00   00 00 00 00 00           .5...... .....
>[2011/12/15 15:22:29.099657, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 86
>[2011/12/15 15:22:29.099700,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x56
>[2011/12/15 15:22:29.099725,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 348 of length 90 (0 toread)
>[2011/12/15 15:22:29.099749,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:29.099763,  5, pid=1905] lib/util.c:342(show_msg)
>  size=86
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=22272
>  smt_wct=15
>  smb_vwv[ 0]=   18 (0x12)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=   10 (0xA)
>  smb_vwv[ 3]=16384 (0x4000)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   18 (0x12)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    1 (0x1)
>  smb_bcc=21
>[2011/12/15 15:22:29.100069, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 00 00 16 00 56 05 06   00 04 01 00 00 00 00 5C   .....V.. .......\
>  [0010] 00 2A 00 00 00                                    .*... 
>[2011/12/15 15:22:29.100125,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBtrans2 (pid 1905) conn 0x8bb88d0
>[2011/12/15 15:22:29.100150,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:29.100180,  3, pid=1905] smbd/trans2.c:2291(call_trans2findfirst)
>  call_trans2findfirst: dirtype = 16, maxentries = 1366, close_after_first=0, close_if_end = 1 requires_resume_key = 1 level = 0x104, max_data_bytes = 16384
>[2011/12/15 15:22:29.100211,  5, pid=1905] smbd/filename.c:257(unix_convert)
>  unix_convert called on file "*"
>[2011/12/15 15:22:29.100238, 10, pid=1905] smbd/statcache.c:241(stat_cache_lookup)
>  stat_cache_lookup: lookup failed for name [*]
>[2011/12/15 15:22:29.100264,  5, pid=1905] smbd/filename.c:416(unix_convert)
>  unix_convert begin: name = *, dirpath = , start = *
>[2011/12/15 15:22:29.100289, 10, pid=1905] smbd/mangle_hash2.c:418(is_mangled)
>  is_mangled * ?
>[2011/12/15 15:22:29.100312, 10, pid=1905] smbd/mangle_hash2.c:357(is_mangled_component)
>  is_mangled_component * (len 1) ?
>[2011/12/15 15:22:29.100336,  5, pid=1905] smbd/filename.c:609(unix_convert)
>  Wildcard *
>[2011/12/15 15:22:29.100360,  3, pid=1905] smbd/vfs.c:905(check_reduced_name)
>  check_reduced_name [*] [/space/groups/nfs]
>[2011/12/15 15:22:29.100669, 10, pid=1905] smbd/vfs.c:969(check_reduced_name)
>  check_reduced_name realpath [*] -> [/space/groups/nfs/*]
>[2011/12/15 15:22:29.100707,  3, pid=1905] smbd/vfs.c:1039(check_reduced_name)
>  check_reduced_name: * reduced to /space/groups/nfs/*
>[2011/12/15 15:22:29.100733,  5, pid=1905] smbd/trans2.c:2376(call_trans2findfirst)
>  dir=., mask = *
>[2011/12/15 15:22:29.100763,  5, pid=1905] smbd/dir.c:435(dptr_create)
>  dptr_create dir=.
>[2011/12/15 15:22:29.100788,  3, pid=1905] smbd/vfs.c:905(check_reduced_name)
>  check_reduced_name [.] [/space/groups/nfs]
>[2011/12/15 15:22:29.100820, 10, pid=1905] smbd/vfs.c:969(check_reduced_name)
>  check_reduced_name realpath [.] -> [/space/groups/nfs]
>[2011/12/15 15:22:29.100846,  3, pid=1905] smbd/vfs.c:1039(check_reduced_name)
>  check_reduced_name: . reduced to /space/groups/nfs
>[2011/12/15 15:22:29.101146,  3, pid=1905] smbd/dir.c:560(dptr_create)
>  creating new dirptr 256 for path ., expect_close = 1
>[2011/12/15 15:22:29.101187,  4, pid=1905] smbd/trans2.c:2444(call_trans2findfirst)
>  dptr_num is 256, wcard = *, attr = 22
>[2011/12/15 15:22:29.101212,  8, pid=1905] smbd/trans2.c:2453(call_trans2findfirst)
>  dirpath=<.> dontdescend=<>
>[2011/12/15 15:22:29.101244,  6, pid=1905] smbd/dir.c:951(smbd_dirptr_get_entry)
>  smbd_dirptr_get_entry: dirptr 0x8bb55e8 now at offset 0
>[2011/12/15 15:22:29.101280,  8, pid=1905] smbd/dosmode.c:621(dos_mode)
>  dos_mode: ./.
>[2011/12/15 15:22:29.101978, 10, pid=1905] lib/system.c:2426(solaris_attropen)
>  attropen FAILED: path: ./., name: user.DOSATTRIB, errno: No such file or directory
>[2011/12/15 15:22:29.102029, 10, pid=1905] smbd/file_access.c:205(can_access_file_data)
>  can_access_file_data: requesting 0x2 on file ./.
>[2011/12/15 15:22:29.102068, 10, pid=1905] modules/nfs4_acls.c:427(smb_get_nt_acl_nfs4)
>  smb_get_nt_acl_nfs4 invoked for ./.
>[2011/12/15 15:22:29.102102, 10, pid=1905] modules/nfs4_acls.c:271(smbacl4_nfs42win)
>  smbacl_nfs42win entered
>[2011/12/15 15:22:29.102128, 10, pid=1905] modules/nfs4_acls.c:292(smbacl4_nfs42win)
>  magic: 0x76f8a967, type: 0, iflags: 2, flags: 1003, mask: 1f01ff, who: 1
>[2011/12/15 15:22:29.102153, 10, pid=1905] modules/nfs4_acls.c:319(smbacl4_nfs42win)
>  mapped 1 to S-1-5-21-2132208240-841620863-785830102-1100
>[2011/12/15 15:22:29.102179, 10, pid=1905] modules/nfs4_acls.c:336(smbacl4_nfs42win)
>  Windows mapped ace flags: 0x1003 => 0x3
>[2011/12/15 15:22:29.102203, 10, pid=1905] modules/nfs4_acls.c:292(smbacl4_nfs42win)
>  magic: 0x76f8a967, type: 0, iflags: 2, flags: 2043, mask: 1301bf, who: 2
>[2011/12/15 15:22:29.102227, 10, pid=1905] modules/nfs4_acls.c:319(smbacl4_nfs42win)
>  mapped 2 to S-1-5-21-2132208240-841620863-785830102-3000
>[2011/12/15 15:22:29.102253, 10, pid=1905] modules/nfs4_acls.c:336(smbacl4_nfs42win)
>  Windows mapped ace flags: 0x2043 => 0x3
>[2011/12/15 15:22:29.102276, 10, pid=1905] modules/nfs4_acls.c:292(smbacl4_nfs42win)
>  magic: 0x76f8a967, type: 0, iflags: 0, flags: 3, mask: 1f01ff, who: 10000
>[2011/12/15 15:22:29.102302, 10, pid=1905] modules/nfs4_acls.c:319(smbacl4_nfs42win)
>  mapped 10000 to S-1-5-21-2132208240-841620863-785830102-21000
>[2011/12/15 15:22:29.102327, 10, pid=1905] modules/nfs4_acls.c:336(smbacl4_nfs42win)
>  Windows mapped ace flags: 0x3 => 0x3
>[2011/12/15 15:22:29.102351, 10, pid=1905] modules/nfs4_acls.c:292(smbacl4_nfs42win)
>  magic: 0x76f8a967, type: 0, iflags: 0, flags: 43, mask: 1f01ff, who: 10000
>[2011/12/15 15:22:29.102376, 10, pid=1905] modules/nfs4_acls.c:319(smbacl4_nfs42win)
>  mapped 10000 to S-1-5-21-2132208240-841620863-785830102-1077
>[2011/12/15 15:22:29.102401, 10, pid=1905] modules/nfs4_acls.c:336(smbacl4_nfs42win)
>  Windows mapped ace flags: 0x43 => 0x3
>[2011/12/15 15:22:29.102425, 10, pid=1905] modules/nfs4_acls.c:389(smb_get_nt_acl_nfs4_common)
>  after make sec_acl
>[2011/12/15 15:22:29.102450, 10, pid=1905] modules/nfs4_acls.c:400(smb_get_nt_acl_nfs4_common)
>  smb_get_nt_acl_nfs4_common successfully exited with sd_size 228
>[2011/12/15 15:22:29.102476, 10, pid=1905] smbd/file_access.c:69(can_access_file_acl)
>  can_access_file_acl for file ./. access_mask 0x2, access_granted 0x2 access ALLOWED
>[2011/12/15 15:22:29.102519,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       secdesc: struct security_descriptor
>          revision                 : SECURITY_DESCRIPTOR_REVISION_1 (1)
>          type                     : 0x8004 (32772)
>                 0: SEC_DESC_OWNER_DEFAULTED 
>                 0: SEC_DESC_GROUP_DEFAULTED 
>                 1: SEC_DESC_DACL_PRESENT    
>                 0: SEC_DESC_DACL_DEFAULTED  
>                 0: SEC_DESC_SACL_PRESENT    
>                 0: SEC_DESC_SACL_DEFAULTED  
>                 0: SEC_DESC_DACL_TRUSTED    
>                 0: SEC_DESC_SERVER_SECURITY 
>                 0: SEC_DESC_DACL_AUTO_INHERIT_REQ
>                 0: SEC_DESC_SACL_AUTO_INHERIT_REQ
>                 0: SEC_DESC_DACL_AUTO_INHERITED
>                 0: SEC_DESC_SACL_AUTO_INHERITED
>                 0: SEC_DESC_DACL_PROTECTED  
>                 0: SEC_DESC_SACL_PROTECTED  
>                 0: SEC_DESC_RM_CONTROL_VALID
>                 1: SEC_DESC_SELF_RELATIVE   
>          owner_sid                : *
>              owner_sid                : S-1-5-21-2132208240-841620863-785830102-1100
>          group_sid                : *
>              group_sid                : S-1-5-21-2132208240-841620863-785830102-3000
>          sacl                     : NULL
>          dacl                     : *
>              dacl: struct security_acl
>                  revision                 : SECURITY_ACL_REVISION_NT4 (2)
>                  size                     : 0x0098 (152)
>                  num_aces                 : 0x00000004 (4)
>                  aces: ARRAY(4)
>                      aces: struct security_ace
>                          type                     : SEC_ACE_TYPE_ACCESS_ALLOWED (0)
>                          flags                    : 0x03 (3)
>                                 1: SEC_ACE_FLAG_OBJECT_INHERIT
>                                 1: SEC_ACE_FLAG_CONTAINER_INHERIT
>                                 0: SEC_ACE_FLAG_NO_PROPAGATE_INHERIT
>                                 0: SEC_ACE_FLAG_INHERIT_ONLY
>                                 0: SEC_ACE_FLAG_INHERITED_ACE
>                              0x03: SEC_ACE_FLAG_VALID_INHERIT (3)
>                                 0: SEC_ACE_FLAG_SUCCESSFUL_ACCESS
>                                 0: SEC_ACE_FLAG_FAILED_ACCESS
>                          size                     : 0x0024 (36)
>                          access_mask              : 0x001f01ff (2032127)
>                          object                   : union security_ace_object_ctr(case 0)
>                          trustee                  : S-1-5-21-2132208240-841620863-785830102-1100
>                      aces: struct security_ace
>                          type                     : SEC_ACE_TYPE_ACCESS_ALLOWED (0)
>                          flags                    : 0x03 (3)
>                                 1: SEC_ACE_FLAG_OBJECT_INHERIT
>                                 1: SEC_ACE_FLAG_CONTAINER_INHERIT
>                                 0: SEC_ACE_FLAG_NO_PROPAGATE_INHERIT
>                                 0: SEC_ACE_FLAG_INHERIT_ONLY
>                                 0: SEC_ACE_FLAG_INHERITED_ACE
>                              0x03: SEC_ACE_FLAG_VALID_INHERIT (3)
>                                 0: SEC_ACE_FLAG_SUCCESSFUL_ACCESS
>                                 0: SEC_ACE_FLAG_FAILED_ACCESS
>                          size                     : 0x0024 (36)
>                          access_mask              : 0x001301ff (1245695)
>                          object                   : union security_ace_object_ctr(case 0)
>                          trustee                  : S-1-5-21-2132208240-841620863-785830102-3000
>                      aces: struct security_ace
>                          type                     : SEC_ACE_TYPE_ACCESS_ALLOWED (0)
>                          flags                    : 0x03 (3)
>                                 1: SEC_ACE_FLAG_OBJECT_INHERIT
>                                 1: SEC_ACE_FLAG_CONTAINER_INHERIT
>                                 0: SEC_ACE_FLAG_NO_PROPAGATE_INHERIT
>                                 0: SEC_ACE_FLAG_INHERIT_ONLY
>                                 0: SEC_ACE_FLAG_INHERITED_ACE
>                              0x03: SEC_ACE_FLAG_VALID_INHERIT (3)
>                                 0: SEC_ACE_FLAG_SUCCESSFUL_ACCESS
>                                 0: SEC_ACE_FLAG_FAILED_ACCESS
>                          size                     : 0x0024 (36)
>                          access_mask              : 0x001f01ff (2032127)
>                          object                   : union security_ace_object_ctr(case 0)
>                          trustee                  : S-1-5-21-2132208240-841620863-785830102-21000
>                      aces: struct security_ace
>                          type                     : SEC_ACE_TYPE_ACCESS_ALLOWED (0)
>                          flags                    : 0x03 (3)
>                                 1: SEC_ACE_FLAG_OBJECT_INHERIT
>                                 1: SEC_ACE_FLAG_CONTAINER_INHERIT
>                                 0: SEC_ACE_FLAG_NO_PROPAGATE_INHERIT
>                                 0: SEC_ACE_FLAG_INHERIT_ONLY
>                                 0: SEC_ACE_FLAG_INHERITED_ACE
>                              0x03: SEC_ACE_FLAG_VALID_INHERIT (3)
>                                 0: SEC_ACE_FLAG_SUCCESSFUL_ACCESS
>                                 0: SEC_ACE_FLAG_FAILED_ACCESS
>                          size                     : 0x0024 (36)
>                          access_mask              : 0x001f01ff (2032127)
>                          object                   : union security_ace_object_ctr(case 0)
>                          trustee                  : S-1-5-21-2132208240-841620863-785830102-1077
>[2011/12/15 15:22:29.103683,  8, pid=1905] smbd/dosmode.c:199(dos_mode_from_sbuf)
>  dos_mode_from_sbuf returning d
>[2011/12/15 15:22:29.103713,  8, pid=1905] smbd/dosmode.c:672(dos_mode)
>  dos_mode returning d
>[2011/12/15 15:22:29.103747, 10, pid=1905] locking/locking.c:1017(fetch_share_mode_unlocked)
>  fetch_share_mode_unlocked: no share_mode record around (file not open)
>[2011/12/15 15:22:29.103773,  3, pid=1905] smbd/dir.c:1023(smbd_dirptr_get_entry)
>  smbd_dirptr_get_entry mask=[*] found ./. fname=. (.)
>[2011/12/15 15:22:29.103802, 10, pid=1905] smbd/trans2.c:1578(smbd_marshall_dir_entry)
>  smbd_marshall_dir_entry: space_remaining = 16384
>[2011/12/15 15:22:29.103826, 10, pid=1905] smbd/trans2.c:1727(smbd_marshall_dir_entry)
>  smbd_marshall_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO
>[2011/12/15 15:22:29.103854,  6, pid=1905] smbd/dir.c:951(smbd_dirptr_get_entry)
>  smbd_dirptr_get_entry: dirptr 0x8bb55e8 now at offset -2147483648
>[2011/12/15 15:22:29.103890,  8, pid=1905] smbd/dosmode.c:621(dos_mode)
>  dos_mode: ./..
>[2011/12/15 15:22:29.104644, 10, pid=1905] lib/system.c:2426(solaris_attropen)
>  attropen FAILED: path: ./.., name: user.DOSATTRIB, errno: No such file or directory
>[2011/12/15 15:22:29.104695, 10, pid=1905] smbd/file_access.c:205(can_access_file_data)
>  can_access_file_data: requesting 0x2 on file ./..
>[2011/12/15 15:22:29.104739, 10, pid=1905] modules/nfs4_acls.c:427(smb_get_nt_acl_nfs4)
>  smb_get_nt_acl_nfs4 invoked for ./..
>[2011/12/15 15:22:29.104775, 10, pid=1905] modules/nfs4_acls.c:271(smbacl4_nfs42win)
>  smbacl_nfs42win entered
>[2011/12/15 15:22:29.104801, 10, pid=1905] modules/nfs4_acls.c:292(smbacl4_nfs42win)
>  magic: 0x76f8a967, type: 0, iflags: 2, flags: 1003, mask: 1f01ff, who: 1
>[2011/12/15 15:22:29.104827, 10, pid=1905] modules/nfs4_acls.c:319(smbacl4_nfs42win)
>  mapped 1 to S-1-5-21-2132208240-841620863-785830102-21000
>[2011/12/15 15:22:29.104853, 10, pid=1905] modules/nfs4_acls.c:336(smbacl4_nfs42win)
>  Windows mapped ace flags: 0x1003 => 0x3
>[2011/12/15 15:22:29.104876, 10, pid=1905] modules/nfs4_acls.c:292(smbacl4_nfs42win)
>  magic: 0x76f8a967, type: 0, iflags: 0, flags: 43, mask: 1f01ff, who: 10000
>[2011/12/15 15:22:29.104901, 10, pid=1905] modules/nfs4_acls.c:319(smbacl4_nfs42win)
>  mapped 10000 to S-1-5-21-2132208240-841620863-785830102-1077
>[2011/12/15 15:22:29.104927, 10, pid=1905] modules/nfs4_acls.c:336(smbacl4_nfs42win)
>  Windows mapped ace flags: 0x43 => 0x3
>[2011/12/15 15:22:29.104950, 10, pid=1905] modules/nfs4_acls.c:292(smbacl4_nfs42win)
>  magic: 0x76f8a967, type: 0, iflags: 0, flags: 40, mask: 1200a9, who: 513
>[2011/12/15 15:22:29.104975, 10, pid=1905] modules/nfs4_acls.c:319(smbacl4_nfs42win)
>  mapped 513 to S-1-5-21-2132208240-841620863-785830102-513
>[2011/12/15 15:22:29.105000, 10, pid=1905] modules/nfs4_acls.c:336(smbacl4_nfs42win)
>  Windows mapped ace flags: 0x40 => 0x0
>[2011/12/15 15:22:29.105024, 10, pid=1905] modules/nfs4_acls.c:389(smb_get_nt_acl_nfs4_common)
>  after make sec_acl
>[2011/12/15 15:22:29.105049, 10, pid=1905] modules/nfs4_acls.c:400(smb_get_nt_acl_nfs4_common)
>  smb_get_nt_acl_nfs4_common successfully exited with sd_size 192
>[2011/12/15 15:22:29.105074, 10, pid=1905] smbd/file_access.c:69(can_access_file_acl)
>  can_access_file_acl for file ./.. access_mask 0x2, access_granted 0x2 access DENIED
>[2011/12/15 15:22:29.105100,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       secdesc: struct security_descriptor
>          revision                 : SECURITY_DESCRIPTOR_REVISION_1 (1)
>          type                     : 0x8004 (32772)
>                 0: SEC_DESC_OWNER_DEFAULTED 
>                 0: SEC_DESC_GROUP_DEFAULTED 
>                 1: SEC_DESC_DACL_PRESENT    
>                 0: SEC_DESC_DACL_DEFAULTED  
>                 0: SEC_DESC_SACL_PRESENT    
>                 0: SEC_DESC_SACL_DEFAULTED  
>                 0: SEC_DESC_DACL_TRUSTED    
>                 0: SEC_DESC_SERVER_SECURITY 
>                 0: SEC_DESC_DACL_AUTO_INHERIT_REQ
>                 0: SEC_DESC_SACL_AUTO_INHERIT_REQ
>                 0: SEC_DESC_DACL_AUTO_INHERITED
>                 0: SEC_DESC_SACL_AUTO_INHERITED
>                 0: SEC_DESC_DACL_PROTECTED  
>                 0: SEC_DESC_SACL_PROTECTED  
>                 0: SEC_DESC_RM_CONTROL_VALID
>                 1: SEC_DESC_SELF_RELATIVE   
>          owner_sid                : *
>              owner_sid                : S-1-5-21-2132208240-841620863-785830102-21000
>          group_sid                : *
>              group_sid                : S-1-5-21-2132208240-841620863-785830102-513
>          sacl                     : NULL
>          dacl                     : *
>              dacl: struct security_acl
>                  revision                 : SECURITY_ACL_REVISION_NT4 (2)
>                  size                     : 0x0074 (116)
>                  num_aces                 : 0x00000003 (3)
>                  aces: ARRAY(3)
>                      aces: struct security_ace
>                          type                     : SEC_ACE_TYPE_ACCESS_ALLOWED (0)
>                          flags                    : 0x03 (3)
>                                 1: SEC_ACE_FLAG_OBJECT_INHERIT
>                                 1: SEC_ACE_FLAG_CONTAINER_INHERIT
>                                 0: SEC_ACE_FLAG_NO_PROPAGATE_INHERIT
>                                 0: SEC_ACE_FLAG_INHERIT_ONLY
>                                 0: SEC_ACE_FLAG_INHERITED_ACE
>                              0x03: SEC_ACE_FLAG_VALID_INHERIT (3)
>                                 0: SEC_ACE_FLAG_SUCCESSFUL_ACCESS
>                                 0: SEC_ACE_FLAG_FAILED_ACCESS
>                          size                     : 0x0024 (36)
>                          access_mask              : 0x001f01ff (2032127)
>                          object                   : union security_ace_object_ctr(case 0)
>                          trustee                  : S-1-5-21-2132208240-841620863-785830102-21000
>                      aces: struct security_ace
>                          type                     : SEC_ACE_TYPE_ACCESS_ALLOWED (0)
>                          flags                    : 0x03 (3)
>                                 1: SEC_ACE_FLAG_OBJECT_INHERIT
>                                 1: SEC_ACE_FLAG_CONTAINER_INHERIT
>                                 0: SEC_ACE_FLAG_NO_PROPAGATE_INHERIT
>                                 0: SEC_ACE_FLAG_INHERIT_ONLY
>                                 0: SEC_ACE_FLAG_INHERITED_ACE
>                              0x03: SEC_ACE_FLAG_VALID_INHERIT (3)
>                                 0: SEC_ACE_FLAG_SUCCESSFUL_ACCESS
>                                 0: SEC_ACE_FLAG_FAILED_ACCESS
>                          size                     : 0x0024 (36)
>                          access_mask              : 0x001f01ff (2032127)
>                          object                   : union security_ace_object_ctr(case 0)
>                          trustee                  : S-1-5-21-2132208240-841620863-785830102-1077
>                      aces: struct security_ace
>                          type                     : SEC_ACE_TYPE_ACCESS_ALLOWED (0)
>                          flags                    : 0x00 (0)
>                                 0: SEC_ACE_FLAG_OBJECT_INHERIT
>                                 0: SEC_ACE_FLAG_CONTAINER_INHERIT
>                                 0: SEC_ACE_FLAG_NO_PROPAGATE_INHERIT
>                                 0: SEC_ACE_FLAG_INHERIT_ONLY
>                                 0: SEC_ACE_FLAG_INHERITED_ACE
>                              0x00: SEC_ACE_FLAG_VALID_INHERIT (0)
>                                 0: SEC_ACE_FLAG_SUCCESSFUL_ACCESS
>                                 0: SEC_ACE_FLAG_FAILED_ACCESS
>                          size                     : 0x0024 (36)
>                          access_mask              : 0x001200a9 (1179817)
>                          object                   : union security_ace_object_ctr(case 0)
>                          trustee                  : S-1-5-21-2132208240-841620863-785830102-513
>[2011/12/15 15:22:29.106022,  8, pid=1905] smbd/dosmode.c:199(dos_mode_from_sbuf)
>  dos_mode_from_sbuf returning rd
>[2011/12/15 15:22:29.106066,  8, pid=1905] smbd/dosmode.c:672(dos_mode)
>  dos_mode returning rd
>[2011/12/15 15:22:29.106118, 10, pid=1905] locking/locking.c:1017(fetch_share_mode_unlocked)
>  fetch_share_mode_unlocked: no share_mode record around (file not open)
>[2011/12/15 15:22:29.106150,  3, pid=1905] smbd/dir.c:1023(smbd_dirptr_get_entry)
>  smbd_dirptr_get_entry mask=[*] found ./.. fname=.. (..)
>[2011/12/15 15:22:29.106178, 10, pid=1905] smbd/trans2.c:1578(smbd_marshall_dir_entry)
>  smbd_marshall_dir_entry: space_remaining = 16288
>[2011/12/15 15:22:29.106202, 10, pid=1905] smbd/trans2.c:1727(smbd_marshall_dir_entry)
>  smbd_marshall_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO
>[2011/12/15 15:22:29.106901,  6, pid=1905] smbd/dir.c:951(smbd_dirptr_get_entry)
>  smbd_dirptr_get_entry: dirptr 0x8bb55e8 now at offset -1
>[2011/12/15 15:22:29.106947,  5, pid=1905] smbd/trans2.c:2510(call_trans2findfirst)
>  call_trans2findfirst - (2) closing dptr_num 256
>[2011/12/15 15:22:29.106971,  4, pid=1905] smbd/dir.c:257(dptr_close_internal)
>  closing dptr key 256
>[2011/12/15 15:22:29.107006,  9, pid=1905] smbd/trans2.c:941(send_trans2_replies)
>  t2_rep: params_sent_thistime = 10, data_sent_thistime = 196, useable_space = 131010
>[2011/12/15 15:22:29.107034,  9, pid=1905] smbd/trans2.c:943(send_trans2_replies)
>  t2_rep: params_to_send = 10, data_to_send = 196, paramsize = 10, datasize = 196
>[2011/12/15 15:22:29.107059,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:29.107072,  5, pid=1905] lib/util.c:342(show_msg)
>  size=264
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=22272
>  smt_wct=10
>  smb_vwv[ 0]=   10 (0xA)
>  smb_vwv[ 1]=  196 (0xC4)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=   10 (0xA)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  196 (0xC4)
>  smb_vwv[ 7]=   68 (0x44)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=209
>[2011/12/15 15:22:29.107299, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 FD FF 02 00 01 00 00   00 60 00 00 00 60 00 00   ........ .`...`..
>  [0010] 00 00 00 00 00 90 F8 C6   7E 34 BB CC 01 90 F8 C6   ........ ~4......
>  [0020] 7E 34 BB CC 01 F9 DA 59   0F 35 BB CC 01 F9 DA 59   ~4.....Y .5.....Y
>  [0030] 0F 35 BB CC 01 00 00 00   00 00 00 00 00 00 00 00   .5...... ........
>  [0040] 00 00 00 00 00 10 00 00   00 02 00 00 00 00 00 00   ........ ........
>  [0050] 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00   ........ ........
>  [0060] 00 00 00 00 00 00 00 00   00 00 00 2E 00 64 00 00   ........ .....d..
>  [0070] 00 00 00 00 00 4D BF 05   BC 4A BA CC 01 2E E9 21   .....M.. .J.....!
>  [0080] F9 C8 BA CC 01 4D BF 05   BC 4A BA CC 01 4D BF 05   .....M.. .J...M..
>  [0090] BC 4A BA CC 01 00 00 00   00 00 00 00 00 00 00 00   .J...... ........
>  [00A0] 00 00 00 00 00 11 00 00   00 04 00 00 00 00 00 00   ........ ........
>  [00B0] 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00   ........ ........
>  [00C0] 00 00 00 00 00 00 00 00   00 00 00 2E 00 2E 00 00   ........ ........
>  [00D0] 00                                                . 
>[2011/12/15 15:22:29.107613,  4, pid=1905] smbd/trans2.c:2554(call_trans2findfirst)
>  SMBtrans2 mask=* directory=. dirtype=22 numentries=2
>[2011/12/15 15:22:29.107647, 10, pid=1905] smbd/mangle_hash2.c:792(hash2_name_to_8_3)
>  hash2_name_to_8_3: * -> 0A877AA5 -> _2X68P~X (cache=1)
>[2011/12/15 15:22:43.718213, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 76
>[2011/12/15 15:22:43.718307,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x4c
>[2011/12/15 15:22:43.718335,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 349 of length 80 (0 toread)
>[2011/12/15 15:22:43.718360,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:43.718374,  5, pid=1905] lib/util.c:342(show_msg)
>  size=76
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=22336
>  smt_wct=15
>  smb_vwv[ 0]=    8 (0x8)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=   40 (0x28)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    8 (0x8)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    5 (0x5)
>  smb_bcc=11
>[2011/12/15 15:22:43.718650, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 00 00 EC 03 00 00 00   00 00 00                 ........ ...
>[2011/12/15 15:22:43.718689,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBtrans2 (pid 1905) conn 0x8bb88d0
>[2011/12/15 15:22:43.718716,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:43.718746,  3, pid=1905] smbd/trans2.c:5116(call_trans2qfilepathinfo)
>  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004
>[2011/12/15 15:22:43.718778,  5, pid=1905] smbd/filename.c:257(unix_convert)
>  unix_convert called on file ""
>[2011/12/15 15:22:43.718818,  5, pid=1905] smbd/filename.c:291(unix_convert)
>  conversion finished "" -> .
>[2011/12/15 15:22:43.718845,  3, pid=1905] smbd/vfs.c:905(check_reduced_name)
>  check_reduced_name [.] [/space/groups/nfs]
>[2011/12/15 15:22:43.718888, 10, pid=1905] smbd/vfs.c:969(check_reduced_name)
>  check_reduced_name realpath [.] -> [/space/groups/nfs]
>[2011/12/15 15:22:43.718915,  3, pid=1905] smbd/vfs.c:1039(check_reduced_name)
>  check_reduced_name: . reduced to /space/groups/nfs
>[2011/12/15 15:22:43.718946, 10, pid=1905] smbd/files.c:618(file_name_hash)
>  file_name_hash: /space/groups/nfs/. hash 0x62ad0565
>[2011/12/15 15:22:43.718988, 10, pid=1905] locking/locking.c:1017(fetch_share_mode_unlocked)
>  fetch_share_mode_unlocked: no share_mode record around (file not open)
>[2011/12/15 15:22:43.719015,  3, pid=1905] smbd/trans2.c:5253(call_trans2qfilepathinfo)
>  call_trans2qfilepathinfo . (fnum = -1) level=1004 call=5 total_data=0
>[2011/12/15 15:22:43.719042,  5, pid=1905] smbd/trans2.c:4228(smbd_do_qfilepathinfo)
>  smbd_do_qfilepathinfo: . (fnum = -1) level=1004 max_data=40
>[2011/12/15 15:22:43.719067,  8, pid=1905] smbd/dosmode.c:621(dos_mode)
>  dos_mode: .
>[2011/12/15 15:22:43.720749, 10, pid=1905] lib/system.c:2426(solaris_attropen)
>  attropen FAILED: path: ., name: user.DOSATTRIB, errno: No such file or directory
>[2011/12/15 15:22:43.720802, 10, pid=1905] smbd/file_access.c:205(can_access_file_data)
>  can_access_file_data: requesting 0x2 on file .
>[2011/12/15 15:22:43.720845, 10, pid=1905] modules/nfs4_acls.c:427(smb_get_nt_acl_nfs4)
>  smb_get_nt_acl_nfs4 invoked for .
>[2011/12/15 15:22:43.720882, 10, pid=1905] modules/nfs4_acls.c:271(smbacl4_nfs42win)
>  smbacl_nfs42win entered
>[2011/12/15 15:22:43.720909, 10, pid=1905] modules/nfs4_acls.c:292(smbacl4_nfs42win)
>  magic: 0x76f8a967, type: 0, iflags: 2, flags: 1003, mask: 1f01ff, who: 1
>[2011/12/15 15:22:43.720934, 10, pid=1905] modules/nfs4_acls.c:319(smbacl4_nfs42win)
>  mapped 1 to S-1-5-21-2132208240-841620863-785830102-1100
>[2011/12/15 15:22:43.720962, 10, pid=1905] modules/nfs4_acls.c:336(smbacl4_nfs42win)
>  Windows mapped ace flags: 0x1003 => 0x3
>[2011/12/15 15:22:43.720986, 10, pid=1905] modules/nfs4_acls.c:292(smbacl4_nfs42win)
>  magic: 0x76f8a967, type: 0, iflags: 2, flags: 2043, mask: 1301bf, who: 2
>[2011/12/15 15:22:43.721011, 10, pid=1905] modules/nfs4_acls.c:319(smbacl4_nfs42win)
>  mapped 2 to S-1-5-21-2132208240-841620863-785830102-3000
>[2011/12/15 15:22:43.721037, 10, pid=1905] modules/nfs4_acls.c:336(smbacl4_nfs42win)
>  Windows mapped ace flags: 0x2043 => 0x3
>[2011/12/15 15:22:43.721061, 10, pid=1905] modules/nfs4_acls.c:292(smbacl4_nfs42win)
>  magic: 0x76f8a967, type: 0, iflags: 0, flags: 3, mask: 1f01ff, who: 10000
>[2011/12/15 15:22:43.721086, 10, pid=1905] modules/nfs4_acls.c:319(smbacl4_nfs42win)
>  mapped 10000 to S-1-5-21-2132208240-841620863-785830102-21000
>[2011/12/15 15:22:43.721112, 10, pid=1905] modules/nfs4_acls.c:336(smbacl4_nfs42win)
>  Windows mapped ace flags: 0x3 => 0x3
>[2011/12/15 15:22:43.721136, 10, pid=1905] modules/nfs4_acls.c:292(smbacl4_nfs42win)
>  magic: 0x76f8a967, type: 0, iflags: 0, flags: 43, mask: 1f01ff, who: 10000
>[2011/12/15 15:22:43.721162, 10, pid=1905] modules/nfs4_acls.c:319(smbacl4_nfs42win)
>  mapped 10000 to S-1-5-21-2132208240-841620863-785830102-1077
>[2011/12/15 15:22:43.721188, 10, pid=1905] modules/nfs4_acls.c:336(smbacl4_nfs42win)
>  Windows mapped ace flags: 0x43 => 0x3
>[2011/12/15 15:22:43.721212, 10, pid=1905] modules/nfs4_acls.c:389(smb_get_nt_acl_nfs4_common)
>  after make sec_acl
>[2011/12/15 15:22:43.721238, 10, pid=1905] modules/nfs4_acls.c:400(smb_get_nt_acl_nfs4_common)
>  smb_get_nt_acl_nfs4_common successfully exited with sd_size 228
>[2011/12/15 15:22:43.721265, 10, pid=1905] smbd/file_access.c:69(can_access_file_acl)
>  can_access_file_acl for file . access_mask 0x2, access_granted 0x2 access ALLOWED
>[2011/12/15 15:22:43.721292,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       secdesc: struct security_descriptor
>          revision                 : SECURITY_DESCRIPTOR_REVISION_1 (1)
>          type                     : 0x8004 (32772)
>                 0: SEC_DESC_OWNER_DEFAULTED 
>                 0: SEC_DESC_GROUP_DEFAULTED 
>                 1: SEC_DESC_DACL_PRESENT    
>                 0: SEC_DESC_DACL_DEFAULTED  
>                 0: SEC_DESC_SACL_PRESENT    
>                 0: SEC_DESC_SACL_DEFAULTED  
>                 0: SEC_DESC_DACL_TRUSTED    
>                 0: SEC_DESC_SERVER_SECURITY 
>                 0: SEC_DESC_DACL_AUTO_INHERIT_REQ
>                 0: SEC_DESC_SACL_AUTO_INHERIT_REQ
>                 0: SEC_DESC_DACL_AUTO_INHERITED
>                 0: SEC_DESC_SACL_AUTO_INHERITED
>                 0: SEC_DESC_DACL_PROTECTED  
>                 0: SEC_DESC_SACL_PROTECTED  
>                 0: SEC_DESC_RM_CONTROL_VALID
>                 1: SEC_DESC_SELF_RELATIVE   
>          owner_sid                : *
>              owner_sid                : S-1-5-21-2132208240-841620863-785830102-1100
>          group_sid                : *
>              group_sid                : S-1-5-21-2132208240-841620863-785830102-3000
>          sacl                     : NULL
>          dacl                     : *
>              dacl: struct security_acl
>                  revision                 : SECURITY_ACL_REVISION_NT4 (2)
>                  size                     : 0x0098 (152)
>                  num_aces                 : 0x00000004 (4)
>                  aces: ARRAY(4)
>                      aces: struct security_ace
>                          type                     : SEC_ACE_TYPE_ACCESS_ALLOWED (0)
>                          flags                    : 0x03 (3)
>                                 1: SEC_ACE_FLAG_OBJECT_INHERIT
>                                 1: SEC_ACE_FLAG_CONTAINER_INHERIT
>                                 0: SEC_ACE_FLAG_NO_PROPAGATE_INHERIT
>                                 0: SEC_ACE_FLAG_INHERIT_ONLY
>                                 0: SEC_ACE_FLAG_INHERITED_ACE
>                              0x03: SEC_ACE_FLAG_VALID_INHERIT (3)
>                                 0: SEC_ACE_FLAG_SUCCESSFUL_ACCESS
>                                 0: SEC_ACE_FLAG_FAILED_ACCESS
>                          size                     : 0x0024 (36)
>                          access_mask              : 0x001f01ff (2032127)
>                          object                   : union security_ace_object_ctr(case 0)
>                          trustee                  : S-1-5-21-2132208240-841620863-785830102-1100
>                      aces: struct security_ace
>                          type                     : SEC_ACE_TYPE_ACCESS_ALLOWED (0)
>                          flags                    : 0x03 (3)
>                                 1: SEC_ACE_FLAG_OBJECT_INHERIT
>                                 1: SEC_ACE_FLAG_CONTAINER_INHERIT
>                                 0: SEC_ACE_FLAG_NO_PROPAGATE_INHERIT
>                                 0: SEC_ACE_FLAG_INHERIT_ONLY
>                                 0: SEC_ACE_FLAG_INHERITED_ACE
>                              0x03: SEC_ACE_FLAG_VALID_INHERIT (3)
>                                 0: SEC_ACE_FLAG_SUCCESSFUL_ACCESS
>                                 0: SEC_ACE_FLAG_FAILED_ACCESS
>                          size                     : 0x0024 (36)
>                          access_mask              : 0x001301ff (1245695)
>                          object                   : union security_ace_object_ctr(case 0)
>                          trustee                  : S-1-5-21-2132208240-841620863-785830102-3000
>                      aces: struct security_ace
>                          type                     : SEC_ACE_TYPE_ACCESS_ALLOWED (0)
>                          flags                    : 0x03 (3)
>                                 1: SEC_ACE_FLAG_OBJECT_INHERIT
>                                 1: SEC_ACE_FLAG_CONTAINER_INHERIT
>                                 0: SEC_ACE_FLAG_NO_PROPAGATE_INHERIT
>                                 0: SEC_ACE_FLAG_INHERIT_ONLY
>                                 0: SEC_ACE_FLAG_INHERITED_ACE
>                              0x03: SEC_ACE_FLAG_VALID_INHERIT (3)
>                                 0: SEC_ACE_FLAG_SUCCESSFUL_ACCESS
>                                 0: SEC_ACE_FLAG_FAILED_ACCESS
>                          size                     : 0x0024 (36)
>                          access_mask              : 0x001f01ff (2032127)
>                          object                   : union security_ace_object_ctr(case 0)
>                          trustee                  : S-1-5-21-2132208240-841620863-785830102-21000
>                      aces: struct security_ace
>                          type                     : SEC_ACE_TYPE_ACCESS_ALLOWED (0)
>                          flags                    : 0x03 (3)
>                                 1: SEC_ACE_FLAG_OBJECT_INHERIT
>                                 1: SEC_ACE_FLAG_CONTAINER_INHERIT
>                                 0: SEC_ACE_FLAG_NO_PROPAGATE_INHERIT
>                                 0: SEC_ACE_FLAG_INHERIT_ONLY
>                                 0: SEC_ACE_FLAG_INHERITED_ACE
>                              0x03: SEC_ACE_FLAG_VALID_INHERIT (3)
>                                 0: SEC_ACE_FLAG_SUCCESSFUL_ACCESS
>                                 0: SEC_ACE_FLAG_FAILED_ACCESS
>                          size                     : 0x0024 (36)
>                          access_mask              : 0x001f01ff (2032127)
>                          object                   : union security_ace_object_ctr(case 0)
>                          trustee                  : S-1-5-21-2132208240-841620863-785830102-1077
>[2011/12/15 15:22:43.722410,  8, pid=1905] smbd/dosmode.c:199(dos_mode_from_sbuf)
>  dos_mode_from_sbuf returning d
>[2011/12/15 15:22:43.722438,  8, pid=1905] smbd/dosmode.c:672(dos_mode)
>  dos_mode returning d
>[2011/12/15 15:22:43.722467, 10, pid=1905] smbd/trans2.c:4457(smbd_do_qfilepathinfo)
>  smbd_do_qfilepathinfo: SMB_FILE_BASIC_INFORMATION
>[2011/12/15 15:22:43.722492,  5, pid=1905] smbd/trans2.c:4467(smbd_do_qfilepathinfo)
>  SMB_QFBI - create: Thu Dec 15 15:19:03 2011
>   access: Thu Dec 15 15:19:03 2011
>   write: Thu Dec 15 15:23:05 2011
>   change: Thu Dec 15 15:23:05 2011
>   mode: 10
>[2011/12/15 15:22:43.722561,  9, pid=1905] smbd/trans2.c:941(send_trans2_replies)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010
>[2011/12/15 15:22:43.722586,  9, pid=1905] smbd/trans2.c:943(send_trans2_replies)
>  t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40
>[2011/12/15 15:22:43.722610,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:43.722624,  5, pid=1905] lib/util.c:342(show_msg)
>  size=100
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=22336
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=   40 (0x28)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   40 (0x28)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=45
>[2011/12/15 15:22:43.722851, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 00 00 00 00 90 F8 C6   7E 34 BB CC 01 90 F8 C6   ........ ~4......
>  [0010] 7E 34 BB CC 01 F9 DA 59   0F 35 BB CC 01 F9 DA 59   ~4.....Y .5.....Y
>  [0020] 0F 35 BB CC 01 10 00 00   00 00 00 00 00           .5...... .....
>[2011/12/15 15:22:43.723308, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 70
>[2011/12/15 15:22:43.723350,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x46
>[2011/12/15 15:22:43.723375,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 350 of length 74 (0 toread)
>[2011/12/15 15:22:43.723400,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:43.723413,  5, pid=1905] lib/util.c:342(show_msg)
>  size=70
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=22400
>  smt_wct=15
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=  560 (0x230)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    2 (0x2)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    3 (0x3)
>  smb_bcc=5
>[2011/12/15 15:22:43.723688, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 00 00 05 01                                    ..... 
>[2011/12/15 15:22:43.723722,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBtrans2 (pid 1905) conn 0x8bb88d0
>[2011/12/15 15:22:43.723748,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:43.723780,  3, pid=1905] smbd/trans2.c:3512(call_trans2qfsinfo)
>  call_trans2qfsinfo: level = 261
>[2011/12/15 15:22:43.723812,  3, pid=1905] smbd/trans2.c:2950(smbd_do_qfsinfo)
>  smbd_do_qfsinfo: level = 261
>[2011/12/15 15:22:43.723850,  9, pid=1905] smbd/trans2.c:941(send_trans2_replies)
>  t2_rep: params_sent_thistime = 0, data_sent_thistime = 20, useable_space = 131012
>[2011/12/15 15:22:43.723878,  9, pid=1905] smbd/trans2.c:943(send_trans2_replies)
>  t2_rep: params_to_send = 0, data_to_send = 20, paramsize = 0, datasize = 20
>[2011/12/15 15:22:43.723902,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:43.723916,  5, pid=1905] lib/util.c:342(show_msg)
>  size=76
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=22400
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   20 (0x14)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   20 (0x14)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=21
>[2011/12/15 15:22:43.724143, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 0F 00 01 00 FF 00 00   00 08 00 00 00 4E 00 54   ........ .....N.T
>  [0010] 00 46 00 53 00                                    .F.S. 
>[2011/12/15 15:22:43.724214,  4, pid=1905] smbd/trans2.c:3528(call_trans2qfsinfo)
>  SMBtrans2 info_level = 261
>[2011/12/15 15:22:45.295284, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 70
>[2011/12/15 15:22:45.295374,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x46
>[2011/12/15 15:22:45.295403,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 351 of length 74 (0 toread)
>[2011/12/15 15:22:45.295428,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:45.295442,  5, pid=1905] lib/util.c:342(show_msg)
>  size=70
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=22464
>  smt_wct=15
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=  560 (0x230)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    2 (0x2)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    3 (0x3)
>  smb_bcc=5
>[2011/12/15 15:22:45.295715, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 00 00 05 01                                    ..... 
>[2011/12/15 15:22:45.295751,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBtrans2 (pid 1905) conn 0x8bb88d0
>[2011/12/15 15:22:45.295779,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:45.295808,  3, pid=1905] smbd/trans2.c:3512(call_trans2qfsinfo)
>  call_trans2qfsinfo: level = 261
>[2011/12/15 15:22:45.295840,  3, pid=1905] smbd/trans2.c:2950(smbd_do_qfsinfo)
>  smbd_do_qfsinfo: level = 261
>[2011/12/15 15:22:45.295890,  9, pid=1905] smbd/trans2.c:941(send_trans2_replies)
>  t2_rep: params_sent_thistime = 0, data_sent_thistime = 20, useable_space = 131012
>[2011/12/15 15:22:45.295918,  9, pid=1905] smbd/trans2.c:943(send_trans2_replies)
>  t2_rep: params_to_send = 0, data_to_send = 20, paramsize = 0, datasize = 20
>[2011/12/15 15:22:45.295942,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:45.295956,  5, pid=1905] lib/util.c:342(show_msg)
>  size=76
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=22464
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   20 (0x14)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   20 (0x14)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=21
>[2011/12/15 15:22:45.296184, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 0F 00 01 00 FF 00 00   00 08 00 00 00 4E 00 54   ........ .....N.T
>  [0010] 00 46 00 53 00                                    .F.S. 
>[2011/12/15 15:22:45.296258,  4, pid=1905] smbd/trans2.c:3528(call_trans2qfsinfo)
>  SMBtrans2 info_level = 261
>[2011/12/15 15:22:45.296789, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 128
>[2011/12/15 15:22:45.296843,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x80
>[2011/12/15 15:22:45.296871,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 352 of length 132 (0 toread)
>[2011/12/15 15:22:45.296895,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:45.296909,  5, pid=1905] lib/util.c:342(show_msg)
>  size=128
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=22528
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=10752 (0x2A00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=32768 (0x8000)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]= 1792 (0x700)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  512 (0x200)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  768 (0x300)
>  smb_bcc=45
>[2011/12/15 15:22:45.297265, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 5C 00 4E 00 65 00 75   00 20 00 54 00 65 00 78   .\.N.e.u . .T.e.x
>  [0010] 00 74 00 64 00 6F 00 6B   00 75 00 6D 00 65 00 6E   .t.d.o.k .u.m.e.n
>  [0020] 00 74 00 2E 00 74 00 78   00 74 00 00 00           .t...t.x .t...
>[2011/12/15 15:22:45.297343,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBntcreateX (pid 1905) conn 0x8bb88d0
>[2011/12/15 15:22:45.297368,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:45.297399, 10, pid=1905] smbd/nttrans.c:505(reply_ntcreate_and_X)
>  reply_ntcreate_and_X: flags = 0x16, access_mask = 0x2019f file_attributes = 0x80, share_access = 0x7, create_disposition = 0x2 create_options = 0x40 root_dir_fid = 0x0, fname = Neu Textdokument.txt
>[2011/12/15 15:22:45.297430,  5, pid=1905] smbd/filename.c:257(unix_convert)
>  unix_convert called on file "Neu Textdokument.txt"
>[2011/12/15 15:22:45.297459, 10, pid=1905] smbd/statcache.c:280(stat_cache_lookup)
>  stat_cache_lookup: lookup succeeded for name [NEU TEXTDOKUMENT.TXT] -> [Neu Textdokument.txt]
>[2011/12/15 15:22:45.297822,  5, pid=1905] smbd/filename.c:416(unix_convert)
>  unix_convert begin: name = Neu Textdokument.txt, dirpath = , start = Neu Textdokument.txt
>[2011/12/15 15:22:45.298109, 10, pid=1905] smbd/mangle_hash2.c:418(is_mangled)
>  is_mangled Neu Textdokument.txt ?
>[2011/12/15 15:22:45.298155, 10, pid=1905] smbd/mangle_hash2.c:357(is_mangled_component)
>  is_mangled_component Neu Textdokument.txt (len 20) ?
>[2011/12/15 15:22:45.298367, 10, pid=1905] smbd/mangle_hash2.c:418(is_mangled)
>  is_mangled Neu Textdokument.txt ?
>[2011/12/15 15:22:45.298418, 10, pid=1905] smbd/mangle_hash2.c:357(is_mangled_component)
>  is_mangled_component Neu Textdokument.txt (len 20) ?
>[2011/12/15 15:22:45.298721, 10, pid=1905] smbd/mangle_hash2.c:418(is_mangled)
>  is_mangled Neu Textdokument.txt ?
>[2011/12/15 15:22:45.298759, 10, pid=1905] smbd/mangle_hash2.c:357(is_mangled_component)
>  is_mangled_component Neu Textdokument.txt (len 20) ?
>[2011/12/15 15:22:45.298783,  5, pid=1905] smbd/filename.c:781(unix_convert)
>  New file Neu Textdokument.txt
>[2011/12/15 15:22:45.298809,  3, pid=1905] smbd/vfs.c:905(check_reduced_name)
>  check_reduced_name [Neu Textdokument.txt] [/space/groups/nfs]
>[2011/12/15 15:22:45.299069, 10, pid=1905] smbd/vfs.c:969(check_reduced_name)
>  check_reduced_name realpath [Neu Textdokument.txt] -> [/space/groups/nfs/Neu Textdokument.txt]
>[2011/12/15 15:22:45.299107,  3, pid=1905] smbd/vfs.c:1039(check_reduced_name)
>  check_reduced_name: Neu Textdokument.txt reduced to /space/groups/nfs/Neu Textdokument.txt
>[2011/12/15 15:22:45.299133, 10, pid=1905] smbd/open.c:3596(create_file_default)
>  create_file: access_mask = 0x2019f file_attributes = 0x80, share_access = 0x7, create_disposition = 0x2 create_options = 0x40 oplock_request = 0x3 private_flags = 0x0 root_dir_fid = 0x0, ea_list = 0x0, sd = 0x0, fname = Neu Textdokument.txt
>[2011/12/15 15:22:45.299165,  3, pid=1905] smbd/vfs.c:905(check_reduced_name)
>  check_reduced_name [Neu Textdokument.txt] [/space/groups/nfs]
>[2011/12/15 15:22:45.299428, 10, pid=1905] smbd/vfs.c:969(check_reduced_name)
>  check_reduced_name realpath [Neu Textdokument.txt] -> [/space/groups/nfs/Neu Textdokument.txt]
>[2011/12/15 15:22:45.299471,  3, pid=1905] smbd/vfs.c:1039(check_reduced_name)
>  check_reduced_name: Neu Textdokument.txt reduced to /space/groups/nfs/Neu Textdokument.txt
>[2011/12/15 15:22:45.299496, 10, pid=1905] smbd/open.c:3116(create_file_unixpath)
>  create_file_unixpath: access_mask = 0x2019f file_attributes = 0x80, share_access = 0x7, create_disposition = 0x2 create_options = 0x40 oplock_request = 0x3 private_flags = 0x0 ea_list = 0x0, sd = 0x0, fname = Neu Textdokument.txt
>[2011/12/15 15:22:45.299530,  5, pid=1905] smbd/files.c:126(file_new)
>  allocated file structure 1975, fnum = 6071 (1 used)
>[2011/12/15 15:22:45.299560, 10, pid=1905] smbd/files.c:618(file_name_hash)
>  file_name_hash: /space/groups/nfs/Neu Textdokument.txt hash 0x9638f463
>[2011/12/15 15:22:45.299587,  3, pid=1905] smbd/dosmode.c:159(unix_mode)
>  unix_mode(Neu Textdokument.txt) returning 0644
>[2011/12/15 15:22:45.299613, 10, pid=1905] smbd/open.c:1595(open_file_ntcreate)
>  open_file_ntcreate: fname=Neu Textdokument.txt, dos_attrs=0x80 access_mask=0x2019f share_access=0x7 create_disposition = 0x2 create_options=0x40 unix mode=0644 oplock_request=3 private_flags = 0x0
>[2011/12/15 15:22:45.299642,  3, pid=1905] smbd/vfs.c:905(check_reduced_name)
>  check_reduced_name [Neu Textdokument.txt] [/space/groups/nfs]
>[2011/12/15 15:22:45.299893, 10, pid=1905] smbd/vfs.c:969(check_reduced_name)
>  check_reduced_name realpath [Neu Textdokument.txt] -> [/space/groups/nfs/Neu Textdokument.txt]
>[2011/12/15 15:22:45.299935,  3, pid=1905] smbd/vfs.c:1039(check_reduced_name)
>  check_reduced_name: Neu Textdokument.txt reduced to /space/groups/nfs/Neu Textdokument.txt
>[2011/12/15 15:22:45.299961,  8, pid=1905] lib/util.c:1320(is_in_path)
>  is_in_path: Neu Textdokument.txt
>[2011/12/15 15:22:45.300117,  8, pid=1905] lib/util.c:1344(is_in_path)
>  is_in_path: match not found
>[2011/12/15 15:22:45.300146, 10, pid=1905] smbd/open.c:1773(open_file_ntcreate)
>  open_file_ntcreate: fname=Neu Textdokument.txt, after mapping access_mask=0x2019f
>[2011/12/15 15:22:45.300173,  4, pid=1905] smbd/open.c:2064(open_file_ntcreate)
>  calling open_file with flags=0x2 flags2=0x500 mode=0644, access_mask = 0x2019f, open_access_mask = 0x2019f
>[2011/12/15 15:22:45.332365, 10, pid=1905] smbd/open.c:179(fd_open)
>  fd_open: name Neu Textdokument.txt, flags = 02402 mode = 0644, fd = 29. 
>[2011/12/15 15:22:45.332434, 10, pid=1905] smbd/notify_internal.c:930(notify_trigger)
>  notify_trigger called action=0x1, filter=0x1, path=/space/groups/nfs/Neu Textdokument.txt
>[2011/12/15 15:22:45.332465,  2, pid=1905] smbd/open.c:694(open_file)
>  adtest opened file Neu Textdokument.txt read=Yes write=Yes (numopen=1)
>[2011/12/15 15:22:45.332497, 10, pid=1905] lib/dbwrap_tdb.c:102(db_tdb_fetch_locked)
>  Locking key 01008808000000001FEB
>[2011/12/15 15:22:45.332542, 10, pid=1905] lib/dbwrap_tdb.c:131(db_tdb_fetch_locked)
>  Allocated locked data 0x8bd83e0
>[2011/12/15 15:22:45.332576, 10, pid=1905] locking/brlock.c:1814(brl_get_locks_internal)
>  brl_get_locks_internal: 0 current locks on file_id 8880001:1eb1f:0
>[2011/12/15 15:22:45.332621, 10, pid=1905] lib/dbwrap_tdb.c:44(db_tdb_record_destr)
>  Unlocking key 01008808000000001FEB
>[2011/12/15 15:22:45.332660, 10, pid=1905] lib/dbwrap_tdb.c:102(db_tdb_fetch_locked)
>  Locking key 01008808000000001FEB
>[2011/12/15 15:22:45.332691, 10, pid=1905] lib/dbwrap_tdb.c:131(db_tdb_fetch_locked)
>  Allocated locked data 0x8bd8550
>[2011/12/15 15:22:45.332719, 10, pid=1905] smbd/open.c:1153(grant_fsp_oplock_type)
>  grant_fsp_oplock_type: oplock type 0x3 on file Neu Textdokument.txt
>[2011/12/15 15:22:45.332748,  5, pid=1905] smbd/oplock.c:92(set_file_oplock)
>  set_file_oplock: granted oplock on file Neu Textdokument.txt, 8880001:1eb1f:0/55, tv_sec = 4eea02b5, tv_usec = 49208
>[2011/12/15 15:22:45.332778, 10, pid=1905] smbd/dosmode.c:707(file_set_dosmode)
>  file_set_dosmode: setting dos mode 0x20 on file Neu Textdokument.txt
>[2011/12/15 15:22:45.332804,  8, pid=1905] smbd/dosmode.c:621(dos_mode)
>  dos_mode: Neu Textdokument.txt
>[2011/12/15 15:22:45.333834, 10, pid=1905] lib/system.c:2426(solaris_attropen)
>  attropen FAILED: path: Neu Textdokument.txt, name: user.DOSATTRIB, errno: No such file or directory
>[2011/12/15 15:22:45.333880, 10, pid=1905] smbd/file_access.c:205(can_access_file_data)
>  can_access_file_data: requesting 0x2 on file Neu Textdokument.txt
>[2011/12/15 15:22:45.333907,  8, pid=1905] smbd/dosmode.c:199(dos_mode_from_sbuf)
>  dos_mode_from_sbuf returning 
>[2011/12/15 15:22:45.333933,  8, pid=1905] smbd/dosmode.c:672(dos_mode)
>  dos_mode returning 
>[2011/12/15 15:22:45.333958, 10, pid=1905] smbd/dosmode.c:369(set_ea_dos_attribute)
>  set_ea_dos_attributes: set attribute 0x20, btime = Thu Dec 15 15:23:53 2011
>   on file Neu Textdokument.txt
>[2011/12/15 15:22:45.337212, 10, pid=1905] smbd/dosmode.c:436(set_ea_dos_attribute)
>  set_ea_dos_attribute: set EA 0x20 on file Neu Textdokument.txt
>[2011/12/15 15:22:45.337267, 10, pid=1905] locking/locking.c:806(unparse_share_modes)
>  unparse_share_modes: owrt: Thu Dec 15 15:23:53 2011 CET cwrt: Thu Jan  1 01:00:00 1970 CET, ntok: 0, num: 1
>[2011/12/15 15:22:45.337308, 10, pid=1905] locking/locking.c:535(print_share_mode_table)
>  print_share_mode_table: share_mode_entry[0]:  pid = 1905, share_access = 0x7, private_options = 0x0, access_mask = 0x2019f, mid = 0x5800, type= 0x3, gen_id = 55, uid = 1129, flags = 0, file_id 8880001:1eb1f:0, name_hash = 0x9638f463
>[2011/12/15 15:22:45.337360, 10, pid=1905] lib/dbwrap_tdb.c:44(db_tdb_record_destr)
>  Unlocking key 01008808000000001FEB
>[2011/12/15 15:22:45.337397, 10, pid=1905] smbd/open.c:3408(create_file_unixpath)
>  create_file_unixpath: info=2
>[2011/12/15 15:22:45.337422, 10, pid=1905] smbd/open.c:3691(create_file_default)
>  create_file: info=2
>[2011/12/15 15:22:45.337448,  8, pid=1905] smbd/dosmode.c:621(dos_mode)
>  dos_mode: Neu Textdokument.txt
>[2011/12/15 15:22:45.338527, 10, pid=1905] smbd/dosmode.c:268(get_ea_dos_attribute)
>  get_ea_dos_attribute: Neu Textdokument.txt attr = 0x20
>[2011/12/15 15:22:45.338568, 10, pid=1905] smbd/dosmode.c:310(get_ea_dos_attribute)
>  get_ea_dos_attribute: file Neu Textdokument.txt case 3 set btime Thu Dec 15 15:23:53 2011
>  
>[2011/12/15 15:22:45.338604,  8, pid=1905] smbd/dosmode.c:326(get_ea_dos_attribute)
>  get_ea_dos_attribute returning (0x20)a
>[2011/12/15 15:22:45.338631,  8, pid=1905] smbd/dosmode.c:672(dos_mode)
>  dos_mode returning a
>[2011/12/15 15:22:45.338665, 10, pid=1905] locking/locking.c:666(parse_share_modes)
>  parse_share_modes: owrt: Thu Dec 15 15:23:53 2011 CET, cwrt: Thu Jan  1 01:00:00 1970 CET, ntok: 0, num_share_modes: 1
>[2011/12/15 15:22:45.338705, 10, pid=1905] locking/locking.c:728(parse_share_modes)
>  parse_share_modes: share_mode_entry[0]:  pid = 1905, share_access = 0x7, private_options = 0x0, access_mask = 0x2019f, mid = 0x5800, type= 0x3, gen_id = 55, uid = 1129, flags = 0, file_id 8880001:1eb1f:0, name_hash = 0x9638f463
>[2011/12/15 15:22:45.338744, 10, pid=1905] smbd/file_access.c:205(can_access_file_data)
>  can_access_file_data: requesting 0x2 on file Neu Textdokument.txt
>[2011/12/15 15:22:45.338771,  5, pid=1905] smbd/nttrans.c:730(reply_ntcreate_and_X)
>  reply_ntcreate_and_X: fnum = 6071, open name = Neu Textdokument.txt
>[2011/12/15 15:22:45.339111, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 72
>[2011/12/15 15:22:45.339154,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x48
>[2011/12/15 15:22:45.339180,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 353 of length 76 (0 toread)
>[2011/12/15 15:22:45.339205,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:45.339219,  5, pid=1905] lib/util.c:342(show_msg)
>  size=72
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=22592
>  smt_wct=15
>  smb_vwv[ 0]=    4 (0x4)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=    8 (0x8)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    4 (0x4)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    7 (0x7)
>  smb_bcc=7
>[2011/12/15 15:22:45.339490, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 00 00 B7 17 EE 03                              ....... 
>[2011/12/15 15:22:45.339524,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBtrans2 (pid 1905) conn 0x8bb88d0
>[2011/12/15 15:22:45.339549,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:45.339577,  3, pid=1905] smbd/trans2.c:5032(call_trans2qfilepathinfo)
>  call_trans2qfilepathinfo: TRANSACT2_QFILEINFO: level = 1006
>[2011/12/15 15:22:45.339615, 10, pid=1905] locking/locking.c:666(parse_share_modes)
>  parse_share_modes: owrt: Thu Dec 15 15:23:53 2011 CET, cwrt: Thu Jan  1 01:00:00 1970 CET, ntok: 0, num_share_modes: 1
>[2011/12/15 15:22:45.339655, 10, pid=1905] locking/locking.c:728(parse_share_modes)
>  parse_share_modes: share_mode_entry[0]:  pid = 1905, share_access = 0x7, private_options = 0x0, access_mask = 0x2019f, mid = 0x5800, type= 0x3, gen_id = 55, uid = 1129, flags = 0, file_id 8880001:1eb1f:0, name_hash = 0x9638f463
>[2011/12/15 15:22:45.339682, 10, pid=1905] locking/locking.c:1618(get_delete_on_close_token)
>  get_delete_on_close_token: name_hash = 0x9638f463
>[2011/12/15 15:22:45.339708,  3, pid=1905] smbd/trans2.c:5253(call_trans2qfilepathinfo)
>  call_trans2qfilepathinfo Neu Textdokument.txt (fnum = 6071) level=1006 call=7 total_data=0
>[2011/12/15 15:22:45.339735,  5, pid=1905] smbd/trans2.c:4228(smbd_do_qfilepathinfo)
>  smbd_do_qfilepathinfo: Neu Textdokument.txt (fnum = 6071) level=1006 max_data=8
>[2011/12/15 15:22:45.339760,  8, pid=1905] smbd/dosmode.c:621(dos_mode)
>  dos_mode: Neu Textdokument.txt
>[2011/12/15 15:22:45.340593, 10, pid=1905] smbd/dosmode.c:268(get_ea_dos_attribute)
>  get_ea_dos_attribute: Neu Textdokument.txt attr = 0x20
>[2011/12/15 15:22:45.340639, 10, pid=1905] smbd/dosmode.c:310(get_ea_dos_attribute)
>  get_ea_dos_attribute: file Neu Textdokument.txt case 3 set btime Thu Dec 15 15:23:53 2011
>  
>[2011/12/15 15:22:45.340675,  8, pid=1905] smbd/dosmode.c:326(get_ea_dos_attribute)
>  get_ea_dos_attribute returning (0x20)a
>[2011/12/15 15:22:45.340700,  8, pid=1905] smbd/dosmode.c:672(dos_mode)
>  dos_mode returning a
>[2011/12/15 15:22:45.340729, 10, pid=1905] smbd/trans2.c:4620(smbd_do_qfilepathinfo)
>  smbd_do_qfilepathinfo: SMB_FILE_INTERNAL_INFORMATION
>[2011/12/15 15:22:45.340755,  9, pid=1905] smbd/trans2.c:941(send_trans2_replies)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 8, useable_space = 131010
>[2011/12/15 15:22:45.340779,  9, pid=1905] smbd/trans2.c:943(send_trans2_replies)
>  t2_rep: params_to_send = 2, data_to_send = 8, paramsize = 2, datasize = 8
>[2011/12/15 15:22:45.340803,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:45.340817,  5, pid=1905] lib/util.c:342(show_msg)
>  size=68
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=22592
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=    8 (0x8)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    8 (0x8)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=13
>[2011/12/15 15:22:45.341041, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 00 00 00 00 1F EB 01   00 00 00 00 00           ........ .....
>[2011/12/15 15:22:45.341920, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 70
>[2011/12/15 15:22:45.341962,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x46
>[2011/12/15 15:22:45.341988,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 354 of length 74 (0 toread)
>[2011/12/15 15:22:45.342012,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:45.342026,  5, pid=1905] lib/util.c:342(show_msg)
>  size=70
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=22656
>  smt_wct=15
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=  560 (0x230)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    2 (0x2)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    3 (0x3)
>  smb_bcc=5
>[2011/12/15 15:22:45.342298, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 00 00 02 01                                    ..... 
>[2011/12/15 15:22:45.342331,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBtrans2 (pid 1905) conn 0x8bb88d0
>[2011/12/15 15:22:45.342357,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:45.342383,  3, pid=1905] smbd/trans2.c:3512(call_trans2qfsinfo)
>  call_trans2qfsinfo: level = 258
>[2011/12/15 15:22:45.342411,  3, pid=1905] smbd/trans2.c:2950(smbd_do_qfsinfo)
>  smbd_do_qfsinfo: level = 258
>[2011/12/15 15:22:45.342446,  5, pid=1905] smbd/trans2.c:3092(smbd_do_qfsinfo)
>  smbd_do_qfsinfo : SMB_QUERY_FS_VOLUME_INFO namelen = 3, vol=nfs serv=nfs
>[2011/12/15 15:22:45.342476,  9, pid=1905] smbd/trans2.c:941(send_trans2_replies)
>  t2_rep: params_sent_thistime = 0, data_sent_thistime = 24, useable_space = 131012
>[2011/12/15 15:22:45.342500,  9, pid=1905] smbd/trans2.c:943(send_trans2_replies)
>  t2_rep: params_to_send = 0, data_to_send = 24, paramsize = 0, datasize = 24
>[2011/12/15 15:22:45.342524,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:45.342537,  5, pid=1905] lib/util.c:342(show_msg)
>  size=80
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=22656
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   24 (0x18)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   24 (0x18)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=25
>[2011/12/15 15:22:45.342761, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 00 00 00 00 00 00 00   00 B1 8F 88 DC 06 00 00   ........ ........
>  [0010] 00 00 00 6E 00 66 00 73   00                       ...n.f.s .
>[2011/12/15 15:22:45.342828,  4, pid=1905] smbd/trans2.c:3528(call_trans2qfsinfo)
>  SMBtrans2 info_level = 258
>[2011/12/15 15:22:45.343130, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 72
>[2011/12/15 15:22:45.343171,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x48
>[2011/12/15 15:22:45.343197,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 355 of length 76 (0 toread)
>[2011/12/15 15:22:45.343220,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:45.343234,  5, pid=1905] lib/util.c:342(show_msg)
>  size=72
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=22720
>  smt_wct=15
>  smb_vwv[ 0]=    4 (0x4)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=  104 (0x68)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    4 (0x4)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    7 (0x7)
>  smb_bcc=7
>[2011/12/15 15:22:45.343556, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 00 00 B7 17 EC 03                              ....... 
>[2011/12/15 15:22:45.343594,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBtrans2 (pid 1905) conn 0x8bb88d0
>[2011/12/15 15:22:45.343619,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:45.343646,  3, pid=1905] smbd/trans2.c:5032(call_trans2qfilepathinfo)
>  call_trans2qfilepathinfo: TRANSACT2_QFILEINFO: level = 1004
>[2011/12/15 15:22:45.343683, 10, pid=1905] locking/locking.c:666(parse_share_modes)
>  parse_share_modes: owrt: Thu Dec 15 15:23:53 2011 CET, cwrt: Thu Jan  1 01:00:00 1970 CET, ntok: 0, num_share_modes: 1
>[2011/12/15 15:22:45.343724, 10, pid=1905] locking/locking.c:728(parse_share_modes)
>  parse_share_modes: share_mode_entry[0]:  pid = 1905, share_access = 0x7, private_options = 0x0, access_mask = 0x2019f, mid = 0x5800, type= 0x3, gen_id = 55, uid = 1129, flags = 0, file_id 8880001:1eb1f:0, name_hash = 0x9638f463
>[2011/12/15 15:22:45.343751, 10, pid=1905] locking/locking.c:1618(get_delete_on_close_token)
>  get_delete_on_close_token: name_hash = 0x9638f463
>[2011/12/15 15:22:45.343776,  3, pid=1905] smbd/trans2.c:5253(call_trans2qfilepathinfo)
>  call_trans2qfilepathinfo Neu Textdokument.txt (fnum = 6071) level=1004 call=7 total_data=0
>[2011/12/15 15:22:45.343802,  5, pid=1905] smbd/trans2.c:4228(smbd_do_qfilepathinfo)
>  smbd_do_qfilepathinfo: Neu Textdokument.txt (fnum = 6071) level=1004 max_data=104
>[2011/12/15 15:22:45.343827,  8, pid=1905] smbd/dosmode.c:621(dos_mode)
>  dos_mode: Neu Textdokument.txt
>[2011/12/15 15:22:45.344661, 10, pid=1905] smbd/dosmode.c:268(get_ea_dos_attribute)
>  get_ea_dos_attribute: Neu Textdokument.txt attr = 0x20
>[2011/12/15 15:22:45.344706, 10, pid=1905] smbd/dosmode.c:310(get_ea_dos_attribute)
>  get_ea_dos_attribute: file Neu Textdokument.txt case 3 set btime Thu Dec 15 15:23:53 2011
>  
>[2011/12/15 15:22:45.344742,  8, pid=1905] smbd/dosmode.c:326(get_ea_dos_attribute)
>  get_ea_dos_attribute returning (0x20)a
>[2011/12/15 15:22:45.344767,  8, pid=1905] smbd/dosmode.c:672(dos_mode)
>  dos_mode returning a
>[2011/12/15 15:22:45.344795, 10, pid=1905] smbd/trans2.c:4457(smbd_do_qfilepathinfo)
>  smbd_do_qfilepathinfo: SMB_FILE_BASIC_INFORMATION
>[2011/12/15 15:22:45.344820,  5, pid=1905] smbd/trans2.c:4467(smbd_do_qfilepathinfo)
>  SMB_QFBI - create: Thu Dec 15 15:23:53 2011
>   access: Thu Dec 15 15:23:53 2011
>   write: Thu Dec 15 15:23:53 2011
>   change: Thu Dec 15 15:23:53 2011
>   mode: 20
>[2011/12/15 15:22:45.344887,  9, pid=1905] smbd/trans2.c:941(send_trans2_replies)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010
>[2011/12/15 15:22:45.344911,  9, pid=1905] smbd/trans2.c:943(send_trans2_replies)
>  t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40
>[2011/12/15 15:22:45.344936,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:45.344949,  5, pid=1905] lib/util.c:342(show_msg)
>  size=100
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=22720
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=   40 (0x28)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   40 (0x28)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=45
>[2011/12/15 15:22:45.345173, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 00 00 00 00 07 69 17   2C 35 BB CC 01 07 69 17   ......i. ,5....i.
>  [0010] 2C 35 BB CC 01 09 69 17   2C 35 BB CC 01 09 69 17   ,5....i. ,5....i.
>  [0020] 2C 35 BB CC 01 20 00 00   00 00 00 00 00           ,5... .. .....
>[2011/12/15 15:22:45.345916, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 124
>[2011/12/15 15:22:45.345959,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x7c
>[2011/12/15 15:22:45.345985,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 356 of length 128 (0 toread)
>[2011/12/15 15:22:45.346009,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:45.346022,  5, pid=1905] lib/util.c:342(show_msg)
>  size=124
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=22784
>  smt_wct=15
>  smb_vwv[ 0]=   56 (0x38)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=   10 (0xA)
>  smb_vwv[ 3]=16384 (0x4000)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   56 (0x38)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    1 (0x1)
>  smb_bcc=59
>[2011/12/15 15:22:45.346296, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 00 00 16 00 56 05 07   00 04 01 00 00 00 00 5C   .....V.. .......\
>  [0010] 00 4E 00 65 00 75 00 20   00 54 00 65 00 78 00 74   .N.e.u.  .T.e.x.t
>  [0020] 00 64 00 6F 00 6B 00 75   00 6D 00 65 00 6E 00 74   .d.o.k.u .m.e.n.t
>  [0030] 00 2E 00 74 00 78 00 74   00 00 00                 ...t.x.t ...
>[2011/12/15 15:22:45.346394,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBtrans2 (pid 1905) conn 0x8bb88d0
>[2011/12/15 15:22:45.346420,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:45.346449,  3, pid=1905] smbd/trans2.c:2291(call_trans2findfirst)
>  call_trans2findfirst: dirtype = 16, maxentries = 1366, close_after_first=1, close_if_end = 1 requires_resume_key = 1 level = 0x104, max_data_bytes = 16384
>[2011/12/15 15:22:45.346480,  5, pid=1905] smbd/filename.c:257(unix_convert)
>  unix_convert called on file "Neu Textdokument.txt"
>[2011/12/15 15:22:45.346507, 10, pid=1905] smbd/statcache.c:241(stat_cache_lookup)
>  stat_cache_lookup: lookup failed for name [NEU TEXTDOKUMENT.TXT]
>[2011/12/15 15:22:45.346533,  5, pid=1905] smbd/filename.c:416(unix_convert)
>  unix_convert begin: name = Neu Textdokument.txt, dirpath = , start = Neu Textdokument.txt
>[2011/12/15 15:22:45.346566,  5, pid=1905] smbd/statcache.c:143(stat_cache_add)
>  stat_cache_add: Added entry (8bd8cd8:size 14) NEU TEXTDOKUMENT.TXT -> Neu Textdokument.txt
>[2011/12/15 15:22:45.346594,  5, pid=1905] smbd/filename.c:439(unix_convert)
>  conversion of base_name finished Neu Textdokument.txt -> Neu Textdokument.txt
>[2011/12/15 15:22:45.346618,  3, pid=1905] smbd/vfs.c:905(check_reduced_name)
>  check_reduced_name [Neu Textdokument.txt] [/space/groups/nfs]
>[2011/12/15 15:22:45.346653, 10, pid=1905] smbd/vfs.c:969(check_reduced_name)
>  check_reduced_name realpath [Neu Textdokument.txt] -> [/space/groups/nfs/Neu Textdokument.txt]
>[2011/12/15 15:22:45.346679,  3, pid=1905] smbd/vfs.c:1039(check_reduced_name)
>  check_reduced_name: Neu Textdokument.txt reduced to /space/groups/nfs/Neu Textdokument.txt
>[2011/12/15 15:22:45.346705,  5, pid=1905] smbd/trans2.c:2376(call_trans2findfirst)
>  dir=., mask = Neu Textdokument.txt
>[2011/12/15 15:22:45.346735,  5, pid=1905] smbd/dir.c:435(dptr_create)
>  dptr_create dir=.
>[2011/12/15 15:22:45.346760,  3, pid=1905] smbd/vfs.c:905(check_reduced_name)
>  check_reduced_name [.] [/space/groups/nfs]
>[2011/12/15 15:22:45.346792, 10, pid=1905] smbd/vfs.c:969(check_reduced_name)
>  check_reduced_name realpath [.] -> [/space/groups/nfs]
>[2011/12/15 15:22:45.346818,  3, pid=1905] smbd/vfs.c:1039(check_reduced_name)
>  check_reduced_name: . reduced to /space/groups/nfs
>[2011/12/15 15:22:45.347108,  3, pid=1905] smbd/dir.c:560(dptr_create)
>  creating new dirptr 256 for path ., expect_close = 1
>[2011/12/15 15:22:45.347146,  4, pid=1905] smbd/trans2.c:2444(call_trans2findfirst)
>  dptr_num is 256, wcard = Neu Textdokument.txt, attr = 22
>[2011/12/15 15:22:45.347171,  8, pid=1905] smbd/trans2.c:2453(call_trans2findfirst)
>  dirpath=<.> dontdescend=<>
>[2011/12/15 15:22:45.347209,  6, pid=1905] smbd/dir.c:951(smbd_dirptr_get_entry)
>  smbd_dirptr_get_entry: dirptr 0x8bb4fa0 now at offset -1
>[2011/12/15 15:22:45.347240,  8, pid=1905] smbd/dosmode.c:621(dos_mode)
>  dos_mode: ./Neu Textdokument.txt
>[2011/12/15 15:22:45.348110, 10, pid=1905] smbd/dosmode.c:268(get_ea_dos_attribute)
>  get_ea_dos_attribute: ./Neu Textdokument.txt attr = 0x20
>[2011/12/15 15:22:45.348151, 10, pid=1905] smbd/dosmode.c:310(get_ea_dos_attribute)
>  get_ea_dos_attribute: file ./Neu Textdokument.txt case 3 set btime Thu Dec 15 15:23:53 2011
>  
>[2011/12/15 15:22:45.348188,  8, pid=1905] smbd/dosmode.c:326(get_ea_dos_attribute)
>  get_ea_dos_attribute returning (0x20)a
>[2011/12/15 15:22:45.348214,  8, pid=1905] smbd/dosmode.c:672(dos_mode)
>  dos_mode returning a
>[2011/12/15 15:22:45.348247, 10, pid=1905] locking/locking.c:666(parse_share_modes)
>  parse_share_modes: owrt: Thu Dec 15 15:23:53 2011 CET, cwrt: Thu Jan  1 01:00:00 1970 CET, ntok: 0, num_share_modes: 1
>[2011/12/15 15:22:45.348287, 10, pid=1905] locking/locking.c:728(parse_share_modes)
>  parse_share_modes: share_mode_entry[0]:  pid = 1905, share_access = 0x7, private_options = 0x0, access_mask = 0x2019f, mid = 0x5800, type= 0x3, gen_id = 55, uid = 1129, flags = 0, file_id 8880001:1eb1f:0, name_hash = 0x9638f463
>[2011/12/15 15:22:45.348314,  3, pid=1905] smbd/dir.c:1023(smbd_dirptr_get_entry)
>  smbd_dirptr_get_entry mask=[Neu Textdokument.txt] found ./Neu Textdokument.txt fname=Neu Textdokument.txt (Neu Textdokument.txt)
>[2011/12/15 15:22:45.348346, 10, pid=1905] smbd/trans2.c:1578(smbd_marshall_dir_entry)
>  smbd_marshall_dir_entry: space_remaining = 16384
>[2011/12/15 15:22:45.348370, 10, pid=1905] smbd/trans2.c:1727(smbd_marshall_dir_entry)
>  smbd_marshall_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO
>[2011/12/15 15:22:45.348400, 10, pid=1905] smbd/mangle_hash2.c:792(hash2_name_to_8_3)
>  hash2_name_to_8_3: Neu Textdokument.txt -> 5C835803 -> NPO34Z~N.TXT (cache=1)
>[2011/12/15 15:22:45.348428,  5, pid=1905] smbd/trans2.c:2510(call_trans2findfirst)
>  call_trans2findfirst - (2) closing dptr_num 256
>[2011/12/15 15:22:45.348452,  4, pid=1905] smbd/dir.c:257(dptr_close_internal)
>  closing dptr key 256
>[2011/12/15 15:22:45.348486,  9, pid=1905] smbd/trans2.c:941(send_trans2_replies)
>  t2_rep: params_sent_thistime = 10, data_sent_thistime = 136, useable_space = 131010
>[2011/12/15 15:22:45.348515,  9, pid=1905] smbd/trans2.c:943(send_trans2_replies)
>  t2_rep: params_to_send = 10, data_to_send = 136, paramsize = 10, datasize = 136
>[2011/12/15 15:22:45.348539,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:45.348552,  5, pid=1905] lib/util.c:342(show_msg)
>  size=204
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=22784
>  smt_wct=10
>  smb_vwv[ 0]=   10 (0xA)
>  smb_vwv[ 1]=  136 (0x88)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=   10 (0xA)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  136 (0x88)
>  smb_vwv[ 7]=   68 (0x44)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=149
>[2011/12/15 15:22:45.348778, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 FD FF 01 00 01 00 00   00 00 00 00 00 88 00 00   ........ ........
>  [0010] 00 00 00 00 00 07 69 17   2C 35 BB CC 01 07 69 17   ......i. ,5....i.
>  [0020] 2C 35 BB CC 01 09 69 17   2C 35 BB CC 01 09 69 17   ,5....i. ,5....i.
>  [0030] 2C 35 BB CC 01 00 00 00   00 00 00 00 00 00 00 10   ,5...... ........
>  [0040] 00 00 00 00 00 20 00 00   00 28 00 00 00 00 00 00   ..... .. .(......
>  [0050] 00 18 00 4E 00 50 00 4F   00 33 00 34 00 5A 00 7E   ...N.P.O .3.4.Z.~
>  [0060] 00 4E 00 2E 00 54 00 58   00 54 00 4E 00 65 00 75   .N...T.X .T.N.e.u
>  [0070] 00 20 00 54 00 65 00 78   00 74 00 64 00 6F 00 6B   . .T.e.x .t.d.o.k
>  [0080] 00 75 00 6D 00 65 00 6E   00 74 00 2E 00 74 00 78   .u.m.e.n .t...t.x
>  [0090] 00 74 00 00 00                                    .t... 
>[2011/12/15 15:22:45.349012,  4, pid=1905] smbd/trans2.c:2554(call_trans2findfirst)
>  SMBtrans2 mask=Neu Textdokument.txt directory=. dirtype=22 numentries=1
>[2011/12/15 15:22:45.349045, 10, pid=1905] smbd/mangle_hash2.c:792(hash2_name_to_8_3)
>  hash2_name_to_8_3: Neu Textdokument.txt -> 5C835803 -> NPO34Z~N.TXT (cache=1)
>[2011/12/15 15:22:45.349816, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 124
>[2011/12/15 15:22:45.349858,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x7c
>[2011/12/15 15:22:45.349884,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 357 of length 128 (0 toread)
>[2011/12/15 15:22:45.349909,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:45.349922,  5, pid=1905] lib/util.c:342(show_msg)
>  size=124
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=22848
>  smt_wct=15
>  smb_vwv[ 0]=   56 (0x38)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=   10 (0xA)
>  smb_vwv[ 3]=16384 (0x4000)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   56 (0x38)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    1 (0x1)
>  smb_bcc=59
>[2011/12/15 15:22:45.350251, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 00 00 16 00 56 05 07   00 04 01 00 00 00 00 5C   .....V.. .......\
>  [0010] 00 4E 00 65 00 75 00 20   00 54 00 65 00 78 00 74   .N.e.u.  .T.e.x.t
>  [0020] 00 64 00 6F 00 6B 00 75   00 6D 00 65 00 6E 00 74   .d.o.k.u .m.e.n.t
>  [0030] 00 2E 00 74 00 78 00 74   00 00 00                 ...t.x.t ...
>[2011/12/15 15:22:45.350352,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBtrans2 (pid 1905) conn 0x8bb88d0
>[2011/12/15 15:22:45.350378,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:45.350407,  3, pid=1905] smbd/trans2.c:2291(call_trans2findfirst)
>  call_trans2findfirst: dirtype = 16, maxentries = 1366, close_after_first=1, close_if_end = 1 requires_resume_key = 1 level = 0x104, max_data_bytes = 16384
>[2011/12/15 15:22:45.350438,  5, pid=1905] smbd/filename.c:257(unix_convert)
>  unix_convert called on file "Neu Textdokument.txt"
>[2011/12/15 15:22:45.350465, 10, pid=1905] smbd/statcache.c:280(stat_cache_lookup)
>  stat_cache_lookup: lookup succeeded for name [NEU TEXTDOKUMENT.TXT] -> [Neu Textdokument.txt]
>[2011/12/15 15:22:45.350498,  3, pid=1905] smbd/vfs.c:905(check_reduced_name)
>  check_reduced_name [Neu Textdokument.txt] [/space/groups/nfs]
>[2011/12/15 15:22:45.350535, 10, pid=1905] smbd/vfs.c:969(check_reduced_name)
>  check_reduced_name realpath [Neu Textdokument.txt] -> [/space/groups/nfs/Neu Textdokument.txt]
>[2011/12/15 15:22:45.350562,  3, pid=1905] smbd/vfs.c:1039(check_reduced_name)
>  check_reduced_name: Neu Textdokument.txt reduced to /space/groups/nfs/Neu Textdokument.txt
>[2011/12/15 15:22:45.350587,  5, pid=1905] smbd/trans2.c:2376(call_trans2findfirst)
>  dir=., mask = Neu Textdokument.txt
>[2011/12/15 15:22:45.350613,  5, pid=1905] smbd/dir.c:435(dptr_create)
>  dptr_create dir=.
>[2011/12/15 15:22:45.350637,  3, pid=1905] smbd/vfs.c:905(check_reduced_name)
>  check_reduced_name [.] [/space/groups/nfs]
>[2011/12/15 15:22:45.350668, 10, pid=1905] smbd/vfs.c:969(check_reduced_name)
>  check_reduced_name realpath [.] -> [/space/groups/nfs]
>[2011/12/15 15:22:45.350693,  3, pid=1905] smbd/vfs.c:1039(check_reduced_name)
>  check_reduced_name: . reduced to /space/groups/nfs
>[2011/12/15 15:22:45.351042,  3, pid=1905] smbd/dir.c:560(dptr_create)
>  creating new dirptr 256 for path ., expect_close = 1
>[2011/12/15 15:22:45.351080,  4, pid=1905] smbd/trans2.c:2444(call_trans2findfirst)
>  dptr_num is 256, wcard = Neu Textdokument.txt, attr = 22
>[2011/12/15 15:22:45.351105,  8, pid=1905] smbd/trans2.c:2453(call_trans2findfirst)
>  dirpath=<.> dontdescend=<>
>[2011/12/15 15:22:45.351141,  6, pid=1905] smbd/dir.c:951(smbd_dirptr_get_entry)
>  smbd_dirptr_get_entry: dirptr 0x8bb4fa0 now at offset -1
>[2011/12/15 15:22:45.351171,  8, pid=1905] smbd/dosmode.c:621(dos_mode)
>  dos_mode: ./Neu Textdokument.txt
>[2011/12/15 15:22:45.352017, 10, pid=1905] smbd/dosmode.c:268(get_ea_dos_attribute)
>  get_ea_dos_attribute: ./Neu Textdokument.txt attr = 0x20
>[2011/12/15 15:22:45.352057, 10, pid=1905] smbd/dosmode.c:310(get_ea_dos_attribute)
>  get_ea_dos_attribute: file ./Neu Textdokument.txt case 3 set btime Thu Dec 15 15:23:53 2011
>  
>[2011/12/15 15:22:45.352094,  8, pid=1905] smbd/dosmode.c:326(get_ea_dos_attribute)
>  get_ea_dos_attribute returning (0x20)a
>[2011/12/15 15:22:45.352120,  8, pid=1905] smbd/dosmode.c:672(dos_mode)
>  dos_mode returning a
>[2011/12/15 15:22:45.352153, 10, pid=1905] locking/locking.c:666(parse_share_modes)
>  parse_share_modes: owrt: Thu Dec 15 15:23:53 2011 CET, cwrt: Thu Jan  1 01:00:00 1970 CET, ntok: 0, num_share_modes: 1
>[2011/12/15 15:22:45.352192, 10, pid=1905] locking/locking.c:728(parse_share_modes)
>  parse_share_modes: share_mode_entry[0]:  pid = 1905, share_access = 0x7, private_options = 0x0, access_mask = 0x2019f, mid = 0x5800, type= 0x3, gen_id = 55, uid = 1129, flags = 0, file_id 8880001:1eb1f:0, name_hash = 0x9638f463
>[2011/12/15 15:22:45.352220,  3, pid=1905] smbd/dir.c:1023(smbd_dirptr_get_entry)
>  smbd_dirptr_get_entry mask=[Neu Textdokument.txt] found ./Neu Textdokument.txt fname=Neu Textdokument.txt (Neu Textdokument.txt)
>[2011/12/15 15:22:45.352250, 10, pid=1905] smbd/trans2.c:1578(smbd_marshall_dir_entry)
>  smbd_marshall_dir_entry: space_remaining = 16384
>[2011/12/15 15:22:45.352274, 10, pid=1905] smbd/trans2.c:1727(smbd_marshall_dir_entry)
>  smbd_marshall_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO
>[2011/12/15 15:22:45.352303, 10, pid=1905] smbd/mangle_hash2.c:792(hash2_name_to_8_3)
>  hash2_name_to_8_3: Neu Textdokument.txt -> 5C835803 -> NPO34Z~N.TXT (cache=1)
>[2011/12/15 15:22:45.352330,  5, pid=1905] smbd/trans2.c:2510(call_trans2findfirst)
>  call_trans2findfirst - (2) closing dptr_num 256
>[2011/12/15 15:22:45.352354,  4, pid=1905] smbd/dir.c:257(dptr_close_internal)
>  closing dptr key 256
>[2011/12/15 15:22:45.352387,  9, pid=1905] smbd/trans2.c:941(send_trans2_replies)
>  t2_rep: params_sent_thistime = 10, data_sent_thistime = 136, useable_space = 131010
>[2011/12/15 15:22:45.352415,  9, pid=1905] smbd/trans2.c:943(send_trans2_replies)
>  t2_rep: params_to_send = 10, data_to_send = 136, paramsize = 10, datasize = 136
>[2011/12/15 15:22:45.352439,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:45.352453,  5, pid=1905] lib/util.c:342(show_msg)
>  size=204
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=22848
>  smt_wct=10
>  smb_vwv[ 0]=   10 (0xA)
>  smb_vwv[ 1]=  136 (0x88)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=   10 (0xA)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  136 (0x88)
>  smb_vwv[ 7]=   68 (0x44)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=149
>[2011/12/15 15:22:45.352679, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 FD FF 01 00 01 00 00   00 00 00 00 00 88 00 00   ........ ........
>  [0010] 00 00 00 00 00 07 69 17   2C 35 BB CC 01 07 69 17   ......i. ,5....i.
>  [0020] 2C 35 BB CC 01 09 69 17   2C 35 BB CC 01 09 69 17   ,5....i. ,5....i.
>  [0030] 2C 35 BB CC 01 00 00 00   00 00 00 00 00 00 00 10   ,5...... ........
>  [0040] 00 00 00 00 00 20 00 00   00 28 00 00 00 00 00 00   ..... .. .(......
>  [0050] 00 18 00 4E 00 50 00 4F   00 33 00 34 00 5A 00 7E   ...N.P.O .3.4.Z.~
>  [0060] 00 4E 00 2E 00 54 00 58   00 54 00 4E 00 65 00 75   .N...T.X .T.N.e.u
>  [0070] 00 20 00 54 00 65 00 78   00 74 00 64 00 6F 00 6B   . .T.e.x .t.d.o.k
>  [0080] 00 75 00 6D 00 65 00 6E   00 74 00 2E 00 74 00 78   .u.m.e.n .t...t.x
>  [0090] 00 74 00 00 00                                    .t... 
>[2011/12/15 15:22:45.352912,  4, pid=1905] smbd/trans2.c:2554(call_trans2findfirst)
>  SMBtrans2 mask=Neu Textdokument.txt directory=. dirtype=22 numentries=1
>[2011/12/15 15:22:45.352944, 10, pid=1905] smbd/mangle_hash2.c:792(hash2_name_to_8_3)
>  hash2_name_to_8_3: Neu Textdokument.txt -> 5C835803 -> NPO34Z~N.TXT (cache=1)
>[2011/12/15 15:22:45.353970, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 124
>[2011/12/15 15:22:45.354013,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x7c
>[2011/12/15 15:22:45.354039,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 358 of length 128 (0 toread)
>[2011/12/15 15:22:45.354064,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:45.354077,  5, pid=1905] lib/util.c:342(show_msg)
>  size=124
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=22912
>  smt_wct=15
>  smb_vwv[ 0]=   56 (0x38)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=   10 (0xA)
>  smb_vwv[ 3]=16384 (0x4000)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   56 (0x38)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    1 (0x1)
>  smb_bcc=59
>[2011/12/15 15:22:45.354353, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 00 00 16 00 56 05 07   00 04 01 00 00 00 00 5C   .....V.. .......\
>  [0010] 00 4E 00 65 00 75 00 20   00 54 00 65 00 78 00 74   .N.e.u.  .T.e.x.t
>  [0020] 00 64 00 6F 00 6B 00 75   00 6D 00 65 00 6E 00 74   .d.o.k.u .m.e.n.t
>  [0030] 00 2E 00 74 00 78 00 74   00 00 00                 ...t.x.t ...
>[2011/12/15 15:22:45.354451,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBtrans2 (pid 1905) conn 0x8bb88d0
>[2011/12/15 15:22:45.354477,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:45.354505,  3, pid=1905] smbd/trans2.c:2291(call_trans2findfirst)
>  call_trans2findfirst: dirtype = 16, maxentries = 1366, close_after_first=1, close_if_end = 1 requires_resume_key = 1 level = 0x104, max_data_bytes = 16384
>[2011/12/15 15:22:45.354536,  5, pid=1905] smbd/filename.c:257(unix_convert)
>  unix_convert called on file "Neu Textdokument.txt"
>[2011/12/15 15:22:45.354563, 10, pid=1905] smbd/statcache.c:280(stat_cache_lookup)
>  stat_cache_lookup: lookup succeeded for name [NEU TEXTDOKUMENT.TXT] -> [Neu Textdokument.txt]
>[2011/12/15 15:22:45.354596,  3, pid=1905] smbd/vfs.c:905(check_reduced_name)
>  check_reduced_name [Neu Textdokument.txt] [/space/groups/nfs]
>[2011/12/15 15:22:45.354632, 10, pid=1905] smbd/vfs.c:969(check_reduced_name)
>  check_reduced_name realpath [Neu Textdokument.txt] -> [/space/groups/nfs/Neu Textdokument.txt]
>[2011/12/15 15:22:45.354659,  3, pid=1905] smbd/vfs.c:1039(check_reduced_name)
>  check_reduced_name: Neu Textdokument.txt reduced to /space/groups/nfs/Neu Textdokument.txt
>[2011/12/15 15:22:45.354684,  5, pid=1905] smbd/trans2.c:2376(call_trans2findfirst)
>  dir=., mask = Neu Textdokument.txt
>[2011/12/15 15:22:45.354710,  5, pid=1905] smbd/dir.c:435(dptr_create)
>  dptr_create dir=.
>[2011/12/15 15:22:45.354734,  3, pid=1905] smbd/vfs.c:905(check_reduced_name)
>  check_reduced_name [.] [/space/groups/nfs]
>[2011/12/15 15:22:45.354765, 10, pid=1905] smbd/vfs.c:969(check_reduced_name)
>  check_reduced_name realpath [.] -> [/space/groups/nfs]
>[2011/12/15 15:22:45.354791,  3, pid=1905] smbd/vfs.c:1039(check_reduced_name)
>  check_reduced_name: . reduced to /space/groups/nfs
>[2011/12/15 15:22:45.355091,  3, pid=1905] smbd/dir.c:560(dptr_create)
>  creating new dirptr 256 for path ., expect_close = 1
>[2011/12/15 15:22:45.355129,  4, pid=1905] smbd/trans2.c:2444(call_trans2findfirst)
>  dptr_num is 256, wcard = Neu Textdokument.txt, attr = 22
>[2011/12/15 15:22:45.355154,  8, pid=1905] smbd/trans2.c:2453(call_trans2findfirst)
>  dirpath=<.> dontdescend=<>
>[2011/12/15 15:22:45.355190,  6, pid=1905] smbd/dir.c:951(smbd_dirptr_get_entry)
>  smbd_dirptr_get_entry: dirptr 0x8bb4fa0 now at offset -1
>[2011/12/15 15:22:45.355220,  8, pid=1905] smbd/dosmode.c:621(dos_mode)
>  dos_mode: ./Neu Textdokument.txt
>[2011/12/15 15:22:45.356021, 10, pid=1905] smbd/dosmode.c:268(get_ea_dos_attribute)
>  get_ea_dos_attribute: ./Neu Textdokument.txt attr = 0x20
>[2011/12/15 15:22:45.356062, 10, pid=1905] smbd/dosmode.c:310(get_ea_dos_attribute)
>  get_ea_dos_attribute: file ./Neu Textdokument.txt case 3 set btime Thu Dec 15 15:23:53 2011
>  
>[2011/12/15 15:22:45.356098,  8, pid=1905] smbd/dosmode.c:326(get_ea_dos_attribute)
>  get_ea_dos_attribute returning (0x20)a
>[2011/12/15 15:22:45.356124,  8, pid=1905] smbd/dosmode.c:672(dos_mode)
>  dos_mode returning a
>[2011/12/15 15:22:45.356158, 10, pid=1905] locking/locking.c:666(parse_share_modes)
>  parse_share_modes: owrt: Thu Dec 15 15:23:53 2011 CET, cwrt: Thu Jan  1 01:00:00 1970 CET, ntok: 0, num_share_modes: 1
>[2011/12/15 15:22:45.356197, 10, pid=1905] locking/locking.c:728(parse_share_modes)
>  parse_share_modes: share_mode_entry[0]:  pid = 1905, share_access = 0x7, private_options = 0x0, access_mask = 0x2019f, mid = 0x5800, type= 0x3, gen_id = 55, uid = 1129, flags = 0, file_id 8880001:1eb1f:0, name_hash = 0x9638f463
>[2011/12/15 15:22:45.356225,  3, pid=1905] smbd/dir.c:1023(smbd_dirptr_get_entry)
>  smbd_dirptr_get_entry mask=[Neu Textdokument.txt] found ./Neu Textdokument.txt fname=Neu Textdokument.txt (Neu Textdokument.txt)
>[2011/12/15 15:22:45.356255, 10, pid=1905] smbd/trans2.c:1578(smbd_marshall_dir_entry)
>  smbd_marshall_dir_entry: space_remaining = 16384
>[2011/12/15 15:22:45.356279, 10, pid=1905] smbd/trans2.c:1727(smbd_marshall_dir_entry)
>  smbd_marshall_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO
>[2011/12/15 15:22:45.356307, 10, pid=1905] smbd/mangle_hash2.c:792(hash2_name_to_8_3)
>  hash2_name_to_8_3: Neu Textdokument.txt -> 5C835803 -> NPO34Z~N.TXT (cache=1)
>[2011/12/15 15:22:45.356335,  5, pid=1905] smbd/trans2.c:2510(call_trans2findfirst)
>  call_trans2findfirst - (2) closing dptr_num 256
>[2011/12/15 15:22:45.356359,  4, pid=1905] smbd/dir.c:257(dptr_close_internal)
>  closing dptr key 256
>[2011/12/15 15:22:45.356392,  9, pid=1905] smbd/trans2.c:941(send_trans2_replies)
>  t2_rep: params_sent_thistime = 10, data_sent_thistime = 136, useable_space = 131010
>[2011/12/15 15:22:45.356420,  9, pid=1905] smbd/trans2.c:943(send_trans2_replies)
>  t2_rep: params_to_send = 10, data_to_send = 136, paramsize = 10, datasize = 136
>[2011/12/15 15:22:45.356444,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:45.356458,  5, pid=1905] lib/util.c:342(show_msg)
>  size=204
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=22912
>  smt_wct=10
>  smb_vwv[ 0]=   10 (0xA)
>  smb_vwv[ 1]=  136 (0x88)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=   10 (0xA)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  136 (0x88)
>  smb_vwv[ 7]=   68 (0x44)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=149
>[2011/12/15 15:22:45.356683, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 FD FF 01 00 01 00 00   00 00 00 00 00 88 00 00   ........ ........
>  [0010] 00 00 00 00 00 07 69 17   2C 35 BB CC 01 07 69 17   ......i. ,5....i.
>  [0020] 2C 35 BB CC 01 09 69 17   2C 35 BB CC 01 09 69 17   ,5....i. ,5....i.
>  [0030] 2C 35 BB CC 01 00 00 00   00 00 00 00 00 00 00 10   ,5...... ........
>  [0040] 00 00 00 00 00 20 00 00   00 28 00 00 00 00 00 00   ..... .. .(......
>  [0050] 00 18 00 4E 00 50 00 4F   00 33 00 34 00 5A 00 7E   ...N.P.O .3.4.Z.~
>  [0060] 00 4E 00 2E 00 54 00 58   00 54 00 4E 00 65 00 75   .N...T.X .T.N.e.u
>  [0070] 00 20 00 54 00 65 00 78   00 74 00 64 00 6F 00 6B   . .T.e.x .t.d.o.k
>  [0080] 00 75 00 6D 00 65 00 6E   00 74 00 2E 00 74 00 78   .u.m.e.n .t...t.x
>  [0090] 00 74 00 00 00                                    .t... 
>[2011/12/15 15:22:45.356916,  4, pid=1905] smbd/trans2.c:2554(call_trans2findfirst)
>  SMBtrans2 mask=Neu Textdokument.txt directory=. dirtype=22 numentries=1
>[2011/12/15 15:22:45.356949, 10, pid=1905] smbd/mangle_hash2.c:792(hash2_name_to_8_3)
>  hash2_name_to_8_3: Neu Textdokument.txt -> 5C835803 -> NPO34Z~N.TXT (cache=1)
>[2011/12/15 15:22:45.359424, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 124
>[2011/12/15 15:22:45.359465,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x7c
>[2011/12/15 15:22:45.359491,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 359 of length 128 (0 toread)
>[2011/12/15 15:22:45.359516,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:45.359530,  5, pid=1905] lib/util.c:342(show_msg)
>  size=124
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=22976
>  smt_wct=15
>  smb_vwv[ 0]=   56 (0x38)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=   10 (0xA)
>  smb_vwv[ 3]=16384 (0x4000)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   56 (0x38)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    1 (0x1)
>  smb_bcc=59
>[2011/12/15 15:22:45.359802, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 00 00 16 00 56 05 07   00 04 01 00 00 00 00 5C   .....V.. .......\
>  [0010] 00 4E 00 65 00 75 00 20   00 54 00 65 00 78 00 74   .N.e.u.  .T.e.x.t
>  [0020] 00 64 00 6F 00 6B 00 75   00 6D 00 65 00 6E 00 74   .d.o.k.u .m.e.n.t
>  [0030] 00 2E 00 74 00 78 00 74   00 00 00                 ...t.x.t ...
>[2011/12/15 15:22:45.359900,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBtrans2 (pid 1905) conn 0x8bb88d0
>[2011/12/15 15:22:45.359925,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:45.359953,  3, pid=1905] smbd/trans2.c:2291(call_trans2findfirst)
>  call_trans2findfirst: dirtype = 16, maxentries = 1366, close_after_first=1, close_if_end = 1 requires_resume_key = 1 level = 0x104, max_data_bytes = 16384
>[2011/12/15 15:22:45.360006,  5, pid=1905] smbd/filename.c:257(unix_convert)
>  unix_convert called on file "Neu Textdokument.txt"
>[2011/12/15 15:22:45.360039, 10, pid=1905] smbd/statcache.c:280(stat_cache_lookup)
>  stat_cache_lookup: lookup succeeded for name [NEU TEXTDOKUMENT.TXT] -> [Neu Textdokument.txt]
>[2011/12/15 15:22:45.360072,  3, pid=1905] smbd/vfs.c:905(check_reduced_name)
>  check_reduced_name [Neu Textdokument.txt] [/space/groups/nfs]
>[2011/12/15 15:22:45.360108, 10, pid=1905] smbd/vfs.c:969(check_reduced_name)
>  check_reduced_name realpath [Neu Textdokument.txt] -> [/space/groups/nfs/Neu Textdokument.txt]
>[2011/12/15 15:22:45.360135,  3, pid=1905] smbd/vfs.c:1039(check_reduced_name)
>  check_reduced_name: Neu Textdokument.txt reduced to /space/groups/nfs/Neu Textdokument.txt
>[2011/12/15 15:22:45.360160,  5, pid=1905] smbd/trans2.c:2376(call_trans2findfirst)
>  dir=., mask = Neu Textdokument.txt
>[2011/12/15 15:22:45.360185,  5, pid=1905] smbd/dir.c:435(dptr_create)
>  dptr_create dir=.
>[2011/12/15 15:22:45.360209,  3, pid=1905] smbd/vfs.c:905(check_reduced_name)
>  check_reduced_name [.] [/space/groups/nfs]
>[2011/12/15 15:22:45.360240, 10, pid=1905] smbd/vfs.c:969(check_reduced_name)
>  check_reduced_name realpath [.] -> [/space/groups/nfs]
>[2011/12/15 15:22:45.360266,  3, pid=1905] smbd/vfs.c:1039(check_reduced_name)
>  check_reduced_name: . reduced to /space/groups/nfs
>[2011/12/15 15:22:45.360561,  3, pid=1905] smbd/dir.c:560(dptr_create)
>  creating new dirptr 256 for path ., expect_close = 1
>[2011/12/15 15:22:45.360601,  4, pid=1905] smbd/trans2.c:2444(call_trans2findfirst)
>  dptr_num is 256, wcard = Neu Textdokument.txt, attr = 22
>[2011/12/15 15:22:45.360626,  8, pid=1905] smbd/trans2.c:2453(call_trans2findfirst)
>  dirpath=<.> dontdescend=<>
>[2011/12/15 15:22:45.360662,  6, pid=1905] smbd/dir.c:951(smbd_dirptr_get_entry)
>  smbd_dirptr_get_entry: dirptr 0x8bb4fa0 now at offset -1
>[2011/12/15 15:22:45.360691,  8, pid=1905] smbd/dosmode.c:621(dos_mode)
>  dos_mode: ./Neu Textdokument.txt
>[2011/12/15 15:22:45.361536, 10, pid=1905] smbd/dosmode.c:268(get_ea_dos_attribute)
>  get_ea_dos_attribute: ./Neu Textdokument.txt attr = 0x20
>[2011/12/15 15:22:45.361578, 10, pid=1905] smbd/dosmode.c:310(get_ea_dos_attribute)
>  get_ea_dos_attribute: file ./Neu Textdokument.txt case 3 set btime Thu Dec 15 15:23:53 2011
>  
>[2011/12/15 15:22:45.361614,  8, pid=1905] smbd/dosmode.c:326(get_ea_dos_attribute)
>  get_ea_dos_attribute returning (0x20)a
>[2011/12/15 15:22:45.361640,  8, pid=1905] smbd/dosmode.c:672(dos_mode)
>  dos_mode returning a
>[2011/12/15 15:22:45.361673, 10, pid=1905] locking/locking.c:666(parse_share_modes)
>  parse_share_modes: owrt: Thu Dec 15 15:23:53 2011 CET, cwrt: Thu Jan  1 01:00:00 1970 CET, ntok: 0, num_share_modes: 1
>[2011/12/15 15:22:45.361712, 10, pid=1905] locking/locking.c:728(parse_share_modes)
>  parse_share_modes: share_mode_entry[0]:  pid = 1905, share_access = 0x7, private_options = 0x0, access_mask = 0x2019f, mid = 0x5800, type= 0x3, gen_id = 55, uid = 1129, flags = 0, file_id 8880001:1eb1f:0, name_hash = 0x9638f463
>[2011/12/15 15:22:45.361740,  3, pid=1905] smbd/dir.c:1023(smbd_dirptr_get_entry)
>  smbd_dirptr_get_entry mask=[Neu Textdokument.txt] found ./Neu Textdokument.txt fname=Neu Textdokument.txt (Neu Textdokument.txt)
>[2011/12/15 15:22:45.361770, 10, pid=1905] smbd/trans2.c:1578(smbd_marshall_dir_entry)
>  smbd_marshall_dir_entry: space_remaining = 16384
>[2011/12/15 15:22:45.361795, 10, pid=1905] smbd/trans2.c:1727(smbd_marshall_dir_entry)
>  smbd_marshall_dir_entry: SMB_FIND_FILE_BOTH_DIRECTORY_INFO
>[2011/12/15 15:22:45.361822, 10, pid=1905] smbd/mangle_hash2.c:792(hash2_name_to_8_3)
>  hash2_name_to_8_3: Neu Textdokument.txt -> 5C835803 -> NPO34Z~N.TXT (cache=1)
>[2011/12/15 15:22:45.361850,  5, pid=1905] smbd/trans2.c:2510(call_trans2findfirst)
>  call_trans2findfirst - (2) closing dptr_num 256
>[2011/12/15 15:22:45.361874,  4, pid=1905] smbd/dir.c:257(dptr_close_internal)
>  closing dptr key 256
>[2011/12/15 15:22:45.361907,  9, pid=1905] smbd/trans2.c:941(send_trans2_replies)
>  t2_rep: params_sent_thistime = 10, data_sent_thistime = 136, useable_space = 131010
>[2011/12/15 15:22:45.361936,  9, pid=1905] smbd/trans2.c:943(send_trans2_replies)
>  t2_rep: params_to_send = 10, data_to_send = 136, paramsize = 10, datasize = 136
>[2011/12/15 15:22:45.361960,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:45.361973,  5, pid=1905] lib/util.c:342(show_msg)
>  size=204
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=22976
>  smt_wct=10
>  smb_vwv[ 0]=   10 (0xA)
>  smb_vwv[ 1]=  136 (0x88)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=   10 (0xA)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  136 (0x88)
>  smb_vwv[ 7]=   68 (0x44)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=149
>[2011/12/15 15:22:45.362199, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 FD FF 01 00 01 00 00   00 00 00 00 00 88 00 00   ........ ........
>  [0010] 00 00 00 00 00 07 69 17   2C 35 BB CC 01 07 69 17   ......i. ,5....i.
>  [0020] 2C 35 BB CC 01 09 69 17   2C 35 BB CC 01 09 69 17   ,5....i. ,5....i.
>  [0030] 2C 35 BB CC 01 00 00 00   00 00 00 00 00 00 00 10   ,5...... ........
>  [0040] 00 00 00 00 00 20 00 00   00 28 00 00 00 00 00 00   ..... .. .(......
>  [0050] 00 18 00 4E 00 50 00 4F   00 33 00 34 00 5A 00 7E   ...N.P.O .3.4.Z.~
>  [0060] 00 4E 00 2E 00 54 00 58   00 54 00 4E 00 65 00 75   .N...T.X .T.N.e.u
>  [0070] 00 20 00 54 00 65 00 78   00 74 00 64 00 6F 00 6B   . .T.e.x .t.d.o.k
>  [0080] 00 75 00 6D 00 65 00 6E   00 74 00 2E 00 74 00 78   .u.m.e.n .t...t.x
>  [0090] 00 74 00 00 00                                    .t... 
>[2011/12/15 15:22:45.362432,  4, pid=1905] smbd/trans2.c:2554(call_trans2findfirst)
>  SMBtrans2 mask=Neu Textdokument.txt directory=. dirtype=22 numentries=1
>[2011/12/15 15:22:45.362465, 10, pid=1905] smbd/mangle_hash2.c:792(hash2_name_to_8_3)
>  hash2_name_to_8_3: Neu Textdokument.txt -> 5C835803 -> NPO34Z~N.TXT (cache=1)
>[2011/12/15 15:22:45.362925, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 118
>[2011/12/15 15:22:45.362968,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x76
>[2011/12/15 15:22:45.362993,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 360 of length 122 (0 toread)
>[2011/12/15 15:22:45.363018,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:45.363032,  5, pid=1905] lib/util.c:342(show_msg)
>  size=118
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=23040
>  smt_wct=15
>  smb_vwv[ 0]=   50 (0x32)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=   40 (0x28)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   50 (0x32)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    5 (0x5)
>  smb_bcc=53
>[2011/12/15 15:22:45.363317, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 00 00 EC 03 00 00 00   00 5C 00 4E 00 65 00 75   ........ .\.N.e.u
>  [0010] 00 20 00 54 00 65 00 78   00 74 00 64 00 6F 00 6B   . .T.e.x .t.d.o.k
>  [0020] 00 75 00 6D 00 65 00 6E   00 74 00 2E 00 74 00 78   .u.m.e.n .t...t.x
>  [0030] 00 74 00 00 00                                    .t... 
>[2011/12/15 15:22:45.363414,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBtrans2 (pid 1905) conn 0x8bb88d0
>[2011/12/15 15:22:45.363440,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:45.363467,  3, pid=1905] smbd/trans2.c:5116(call_trans2qfilepathinfo)
>  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004
>[2011/12/15 15:22:45.363495,  5, pid=1905] smbd/filename.c:257(unix_convert)
>  unix_convert called on file "Neu Textdokument.txt"
>[2011/12/15 15:22:45.363522, 10, pid=1905] smbd/statcache.c:280(stat_cache_lookup)
>  stat_cache_lookup: lookup succeeded for name [NEU TEXTDOKUMENT.TXT] -> [Neu Textdokument.txt]
>[2011/12/15 15:22:45.363554,  3, pid=1905] smbd/vfs.c:905(check_reduced_name)
>  check_reduced_name [Neu Textdokument.txt] [/space/groups/nfs]
>[2011/12/15 15:22:45.363590, 10, pid=1905] smbd/vfs.c:969(check_reduced_name)
>  check_reduced_name realpath [Neu Textdokument.txt] -> [/space/groups/nfs/Neu Textdokument.txt]
>[2011/12/15 15:22:45.363617,  3, pid=1905] smbd/vfs.c:1039(check_reduced_name)
>  check_reduced_name: Neu Textdokument.txt reduced to /space/groups/nfs/Neu Textdokument.txt
>[2011/12/15 15:22:45.363647, 10, pid=1905] smbd/files.c:618(file_name_hash)
>  file_name_hash: /space/groups/nfs/Neu Textdokument.txt hash 0x9638f463
>[2011/12/15 15:22:45.363682, 10, pid=1905] locking/locking.c:666(parse_share_modes)
>  parse_share_modes: owrt: Thu Dec 15 15:23:53 2011 CET, cwrt: Thu Jan  1 01:00:00 1970 CET, ntok: 0, num_share_modes: 1
>[2011/12/15 15:22:45.363721, 10, pid=1905] locking/locking.c:728(parse_share_modes)
>  parse_share_modes: share_mode_entry[0]:  pid = 1905, share_access = 0x7, private_options = 0x0, access_mask = 0x2019f, mid = 0x5800, type= 0x3, gen_id = 55, uid = 1129, flags = 0, file_id 8880001:1eb1f:0, name_hash = 0x9638f463
>[2011/12/15 15:22:45.363748, 10, pid=1905] locking/locking.c:1618(get_delete_on_close_token)
>  get_delete_on_close_token: name_hash = 0x9638f463
>[2011/12/15 15:22:45.363773,  3, pid=1905] smbd/trans2.c:5253(call_trans2qfilepathinfo)
>  call_trans2qfilepathinfo Neu Textdokument.txt (fnum = -1) level=1004 call=5 total_data=0
>[2011/12/15 15:22:45.363800,  5, pid=1905] smbd/trans2.c:4228(smbd_do_qfilepathinfo)
>  smbd_do_qfilepathinfo: Neu Textdokument.txt (fnum = -1) level=1004 max_data=40
>[2011/12/15 15:22:45.363825,  8, pid=1905] smbd/dosmode.c:621(dos_mode)
>  dos_mode: Neu Textdokument.txt
>[2011/12/15 15:22:45.364688, 10, pid=1905] smbd/dosmode.c:268(get_ea_dos_attribute)
>  get_ea_dos_attribute: Neu Textdokument.txt attr = 0x20
>[2011/12/15 15:22:45.364730, 10, pid=1905] smbd/dosmode.c:310(get_ea_dos_attribute)
>  get_ea_dos_attribute: file Neu Textdokument.txt case 3 set btime Thu Dec 15 15:23:53 2011
>  
>[2011/12/15 15:22:45.364766,  8, pid=1905] smbd/dosmode.c:326(get_ea_dos_attribute)
>  get_ea_dos_attribute returning (0x20)a
>[2011/12/15 15:22:45.364793,  8, pid=1905] smbd/dosmode.c:672(dos_mode)
>  dos_mode returning a
>[2011/12/15 15:22:45.364822, 10, pid=1905] smbd/trans2.c:4457(smbd_do_qfilepathinfo)
>  smbd_do_qfilepathinfo: SMB_FILE_BASIC_INFORMATION
>[2011/12/15 15:22:45.364846,  5, pid=1905] smbd/trans2.c:4467(smbd_do_qfilepathinfo)
>  SMB_QFBI - create: Thu Dec 15 15:23:53 2011
>   access: Thu Dec 15 15:23:53 2011
>   write: Thu Dec 15 15:23:53 2011
>   change: Thu Dec 15 15:23:53 2011
>   mode: 20
>[2011/12/15 15:22:45.364914,  9, pid=1905] smbd/trans2.c:941(send_trans2_replies)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010
>[2011/12/15 15:22:45.364939,  9, pid=1905] smbd/trans2.c:943(send_trans2_replies)
>  t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40
>[2011/12/15 15:22:45.364963,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:45.364976,  5, pid=1905] lib/util.c:342(show_msg)
>  size=100
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=23040
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=   40 (0x28)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   40 (0x28)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=45
>[2011/12/15 15:22:45.365200, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 00 00 00 00 07 69 17   2C 35 BB CC 01 07 69 17   ......i. ,5....i.
>  [0010] 2C 35 BB CC 01 09 69 17   2C 35 BB CC 01 09 69 17   ,5....i. ,5....i.
>  [0020] 2C 35 BB CC 01 20 00 00   00 00 00 00 00           ,5... .. .....
>[2011/12/15 15:22:45.365604, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 118
>[2011/12/15 15:22:45.365646,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x76
>[2011/12/15 15:22:45.365672,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 361 of length 122 (0 toread)
>[2011/12/15 15:22:45.365697,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:45.365711,  5, pid=1905] lib/util.c:342(show_msg)
>  size=118
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=23104
>  smt_wct=15
>  smb_vwv[ 0]=   50 (0x32)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    2 (0x2)
>  smb_vwv[ 3]=   40 (0x28)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=   50 (0x32)
>  smb_vwv[10]=   68 (0x44)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    1 (0x1)
>  smb_vwv[14]=    5 (0x5)
>  smb_bcc=53
>[2011/12/15 15:22:45.365986, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 00 00 EC 03 00 00 00   00 5C 00 4E 00 65 00 75   ........ .\.N.e.u
>  [0010] 00 20 00 54 00 65 00 78   00 74 00 64 00 6F 00 6B   . .T.e.x .t.d.o.k
>  [0020] 00 75 00 6D 00 65 00 6E   00 74 00 2E 00 74 00 78   .u.m.e.n .t...t.x
>  [0030] 00 74 00 00 00                                    .t... 
>[2011/12/15 15:22:45.366083,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBtrans2 (pid 1905) conn 0x8bb88d0
>[2011/12/15 15:22:45.366109,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:45.366135,  3, pid=1905] smbd/trans2.c:5116(call_trans2qfilepathinfo)
>  call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = 1004
>[2011/12/15 15:22:45.366162,  5, pid=1905] smbd/filename.c:257(unix_convert)
>  unix_convert called on file "Neu Textdokument.txt"
>[2011/12/15 15:22:45.366189, 10, pid=1905] smbd/statcache.c:280(stat_cache_lookup)
>  stat_cache_lookup: lookup succeeded for name [NEU TEXTDOKUMENT.TXT] -> [Neu Textdokument.txt]
>[2011/12/15 15:22:45.366221,  3, pid=1905] smbd/vfs.c:905(check_reduced_name)
>  check_reduced_name [Neu Textdokument.txt] [/space/groups/nfs]
>[2011/12/15 15:22:45.366257, 10, pid=1905] smbd/vfs.c:969(check_reduced_name)
>  check_reduced_name realpath [Neu Textdokument.txt] -> [/space/groups/nfs/Neu Textdokument.txt]
>[2011/12/15 15:22:45.366284,  3, pid=1905] smbd/vfs.c:1039(check_reduced_name)
>  check_reduced_name: Neu Textdokument.txt reduced to /space/groups/nfs/Neu Textdokument.txt
>[2011/12/15 15:22:45.366313, 10, pid=1905] smbd/files.c:618(file_name_hash)
>  file_name_hash: /space/groups/nfs/Neu Textdokument.txt hash 0x9638f463
>[2011/12/15 15:22:45.366348, 10, pid=1905] locking/locking.c:666(parse_share_modes)
>  parse_share_modes: owrt: Thu Dec 15 15:23:53 2011 CET, cwrt: Thu Jan  1 01:00:00 1970 CET, ntok: 0, num_share_modes: 1
>[2011/12/15 15:22:45.366386, 10, pid=1905] locking/locking.c:728(parse_share_modes)
>  parse_share_modes: share_mode_entry[0]:  pid = 1905, share_access = 0x7, private_options = 0x0, access_mask = 0x2019f, mid = 0x5800, type= 0x3, gen_id = 55, uid = 1129, flags = 0, file_id 8880001:1eb1f:0, name_hash = 0x9638f463
>[2011/12/15 15:22:45.366413, 10, pid=1905] locking/locking.c:1618(get_delete_on_close_token)
>  get_delete_on_close_token: name_hash = 0x9638f463
>[2011/12/15 15:22:45.366437,  3, pid=1905] smbd/trans2.c:5253(call_trans2qfilepathinfo)
>  call_trans2qfilepathinfo Neu Textdokument.txt (fnum = -1) level=1004 call=5 total_data=0
>[2011/12/15 15:22:45.366464,  5, pid=1905] smbd/trans2.c:4228(smbd_do_qfilepathinfo)
>  smbd_do_qfilepathinfo: Neu Textdokument.txt (fnum = -1) level=1004 max_data=40
>[2011/12/15 15:22:45.366489,  8, pid=1905] smbd/dosmode.c:621(dos_mode)
>  dos_mode: Neu Textdokument.txt
>[2011/12/15 15:22:45.367336, 10, pid=1905] smbd/dosmode.c:268(get_ea_dos_attribute)
>  get_ea_dos_attribute: Neu Textdokument.txt attr = 0x20
>[2011/12/15 15:22:45.367382, 10, pid=1905] smbd/dosmode.c:310(get_ea_dos_attribute)
>  get_ea_dos_attribute: file Neu Textdokument.txt case 3 set btime Thu Dec 15 15:23:53 2011
>  
>[2011/12/15 15:22:45.367417,  8, pid=1905] smbd/dosmode.c:326(get_ea_dos_attribute)
>  get_ea_dos_attribute returning (0x20)a
>[2011/12/15 15:22:45.367443,  8, pid=1905] smbd/dosmode.c:672(dos_mode)
>  dos_mode returning a
>[2011/12/15 15:22:45.367472, 10, pid=1905] smbd/trans2.c:4457(smbd_do_qfilepathinfo)
>  smbd_do_qfilepathinfo: SMB_FILE_BASIC_INFORMATION
>[2011/12/15 15:22:45.367497,  5, pid=1905] smbd/trans2.c:4467(smbd_do_qfilepathinfo)
>  SMB_QFBI - create: Thu Dec 15 15:23:53 2011
>   access: Thu Dec 15 15:23:53 2011
>   write: Thu Dec 15 15:23:53 2011
>   change: Thu Dec 15 15:23:53 2011
>   mode: 20
>[2011/12/15 15:22:45.367563,  9, pid=1905] smbd/trans2.c:941(send_trans2_replies)
>  t2_rep: params_sent_thistime = 2, data_sent_thistime = 40, useable_space = 131010
>[2011/12/15 15:22:45.367588,  9, pid=1905] smbd/trans2.c:943(send_trans2_replies)
>  t2_rep: params_to_send = 2, data_to_send = 40, paramsize = 2, datasize = 40
>[2011/12/15 15:22:45.367612,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:45.367626,  5, pid=1905] lib/util.c:342(show_msg)
>  size=100
>  smb_com=0x32
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=2
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=23104
>  smt_wct=10
>  smb_vwv[ 0]=    2 (0x2)
>  smb_vwv[ 1]=   40 (0x28)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    2 (0x2)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   40 (0x28)
>  smb_vwv[ 7]=   60 (0x3C)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=45
>[2011/12/15 15:22:45.367851, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 00 00 00 00 07 69 17   2C 35 BB CC 01 07 69 17   ......i. ,5....i.
>  [0010] 2C 35 BB CC 01 09 69 17   2C 35 BB CC 01 09 69 17   ,5....i. ,5....i.
>  [0020] 2C 35 BB CC 01 20 00 00   00 00 00 00 00           ,5... .. .....
>[2011/12/15 15:22:45.379626, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 41
>[2011/12/15 15:22:45.379674,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x29
>[2011/12/15 15:22:45.379700,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 362 of length 45 (0 toread)
>[2011/12/15 15:22:45.379725,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:45.379739,  5, pid=1905] lib/util.c:342(show_msg)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=2
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=23168
>  smt_wct=3
>  smb_vwv[ 0]= 6071 (0x17B7)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2011/12/15 15:22:45.379898, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>[2011/12/15 15:22:45.379914,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBclose (pid 1905) conn 0x8bb88d0
>[2011/12/15 15:22:45.379940,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:45.379969,  3, pid=1905] smbd/reply.c:4851(reply_close)
>  close fd=29 fnum=6071 (numopen=1)
>[2011/12/15 15:22:45.380025,  6, pid=1905] smbd/close.c:527(set_close_write_time)
>  close_write_time: Thu Jan  1 00:59:59 1970
>[2011/12/15 15:22:45.380060, 10, pid=1905] lib/dbwrap_tdb.c:102(db_tdb_fetch_locked)
>  Locking key 01008808000000001FEB
>[2011/12/15 15:22:45.380092, 10, pid=1905] lib/dbwrap_tdb.c:131(db_tdb_fetch_locked)
>  Allocated locked data 0x8bd8b98
>[2011/12/15 15:22:45.380119, 10, pid=1905] locking/locking.c:666(parse_share_modes)
>  parse_share_modes: owrt: Thu Dec 15 15:23:53 2011 CET, cwrt: Thu Jan  1 01:00:00 1970 CET, ntok: 0, num_share_modes: 1
>[2011/12/15 15:22:45.380157, 10, pid=1905] locking/locking.c:728(parse_share_modes)
>  parse_share_modes: share_mode_entry[0]:  pid = 1905, share_access = 0x7, private_options = 0x0, access_mask = 0x2019f, mid = 0x5800, type= 0x3, gen_id = 55, uid = 1129, flags = 0, file_id 8880001:1eb1f:0, name_hash = 0x9638f463
>[2011/12/15 15:22:45.380185, 10, pid=1905] locking/locking.c:1618(get_delete_on_close_token)
>  get_delete_on_close_token: name_hash = 0x9638f463
>[2011/12/15 15:22:45.380213, 10, pid=1905] lib/dbwrap_tdb.c:44(db_tdb_record_destr)
>  Unlocking key 01008808000000001FEB
>[2011/12/15 15:22:45.380535,  2, pid=1905] smbd/close.c:691(close_normal_file)
>  adtest closed file Neu Textdokument.txt (numopen=0) NT_STATUS_OK
>[2011/12/15 15:22:45.380579,  5, pid=1905] smbd/files.c:464(file_free)
>  freed files structure 6071 (0 used)
>[2011/12/15 15:22:45.380606,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:45.380621,  5, pid=1905] lib/util.c:342(show_msg)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=2
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=23168
>  smt_wct=0
>  smb_bcc=0
>[2011/12/15 15:22:45.380752, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>[2011/12/15 15:22:54.876392, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 100
>[2011/12/15 15:22:54.876506,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x64
>[2011/12/15 15:22:54.876538,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 363 of length 104 (0 toread)
>[2011/12/15 15:22:54.876565,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.876581,  5, pid=1905] lib/util.c:342(show_msg)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=23232
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2011/12/15 15:22:54.876995, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 5C 00 73 00 72 00 76   00 73 00 76 00 63 00 00   .\.s.r.v .s.v.c..
>  [0010] 00                                                . 
>[2011/12/15 15:22:54.877056,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBntcreateX (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.877093,  4, pid=1905] smbd/sec_ctx.c:314(set_sec_ctx)
>  setting sec ctx (1129, 513) - sec_ctx_stack_ndx = 0
>[2011/12/15 15:22:54.877123,  5, pid=1905] ../libcli/security/security_token.c:63(security_token_debug)
>  Security token SIDs (13):
>    SID[  0]: S-1-5-21-2132208240-841620863-785830102-3258
>    SID[  1]: S-1-5-21-2132208240-841620863-785830102-513
>    SID[  2]: S-1-5-21-2132208240-841620863-785830102-6666
>    SID[  3]: S-1-5-21-2132208240-841620863-785830102-2000
>    SID[  4]: S-1-5-21-2132208240-841620863-785830102-3000
>    SID[  5]: S-1-1-0
>    SID[  6]: S-1-5-2
>    SID[  7]: S-1-5-11
>    SID[  8]: S-1-22-1-1129
>    SID[  9]: S-1-22-2-513
>    SID[ 10]: S-1-22-2-6666
>    SID[ 11]: S-1-22-2-2000
>    SID[ 12]: S-1-22-2-3000
>   Privileges (0x               0):
>   Rights (0x               0):
>[2011/12/15 15:22:54.877356,  5, pid=1905] auth/token_util.c:527(debug_unix_user_token)
>  UNIX token of user 1129
>  Primary group is 513 and contains 4 supplementary groups
>  Group[  0]: 513
>  Group[  1]: 6666
>  Group[  2]: 2000
>  Group[  3]: 3000
>[2011/12/15 15:22:54.877450,  5, pid=1905] smbd/uid.c:317(change_to_user_internal)
>  Impersonated user: uid=(0,1129), gid=(0,513)
>[2011/12/15 15:22:54.877480,  4, pid=1905] smbd/vfs.c:780(vfs_ChDir)
>  vfs_ChDir to /tmp
>[2011/12/15 15:22:54.877524, 10, pid=1905] smbd/nttrans.c:505(reply_ntcreate_and_X)
>  reply_ntcreate_and_X: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0, fname = srvsvc
>[2011/12/15 15:22:54.877557,  4, pid=1905] smbd/nttrans.c:293(nt_open_pipe)
>  nt_open_pipe: Opening pipe \srvsvc.
>[2011/12/15 15:22:54.877587,  5, pid=1905] smbd/files.c:126(file_new)
>  allocated file structure 1976, fnum = 6072 (1 used)
>[2011/12/15 15:22:54.877617, 10, pid=1905] smbd/files.c:618(file_name_hash)
>  file_name_hash: /tmp/srvsvc hash 0x8e98a76a
>[2011/12/15 15:22:54.877650,  4, pid=1905] rpc_server/rpc_ncacn_np.c:132(make_internal_rpc_pipe_p)
>  Create pipe requested \srvsvc
>[2011/12/15 15:22:54.877683, 10, pid=1905] rpc_server/rpc_handles.c:116(init_pipe_handles)
>  init_pipe_handle_list: created handle list for pipe \srvsvc
>[2011/12/15 15:22:54.877709, 10, pid=1905] rpc_server/rpc_handles.c:133(init_pipe_handles)
>  init_pipe_handle_list: pipe_handles ref count = 1 for pipe \srvsvc
>[2011/12/15 15:22:54.877778,  4, pid=1905] rpc_server/rpc_ncacn_np.c:176(make_internal_rpc_pipe_p)
>  Created internal pipe \srvsvc (pipes_open=0)
>[2011/12/15 15:22:54.877810,  5, pid=1905] smbd/nttrans.c:382(do_ntcreate_pipe_open)
>  do_ntcreate_pipe_open: open pipe = \srvsvc
>[2011/12/15 15:22:54.878296, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 136
>[2011/12/15 15:22:54.878340,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x88
>[2011/12/15 15:22:54.878366,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 364 of length 140 (0 toread)
>[2011/12/15 15:22:54.878392,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.878406,  5, pid=1905] lib/util.c:342(show_msg)
>  size=136
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=23296
>  smt_wct=14
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 6072 (0x17B8)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=65535 (0xFFFF)
>  smb_vwv[ 6]=65535 (0xFFFF)
>  smb_vwv[ 7]=    8 (0x8)
>  smb_vwv[ 8]=   72 (0x48)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   72 (0x48)
>  smb_vwv[11]=   64 (0x40)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_bcc=73
>[2011/12/15 15:22:54.878682, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] EE 05 00 0B 03 10 00 00   00 48 00 00 00 01 00 00   ........ .H......
>  [0010] 00 B8 10 B8 10 00 00 00   00 01 00 00 00 00 00 01   ........ ........
>  [0020] 00 C8 4F 32 4B 70 16 D3   01 12 78 5A 47 BF 6E E1   ..O2Kp.. ..xZG.n.
>  [0030] 88 03 00 00 00 04 5D 88   8A EB 1C C9 11 9F E8 08   ......]. ........
>  [0040] 00 2B 10 48 60 02 00 00   00                       .+.H`... .
>[2011/12/15 15:22:54.878803,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBwriteX (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.878830,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.878861,  6, pid=1905] smbd/pipes.c:300(reply_pipe_write_and_X)
>  reply_pipe_write_and_X: 17b8 name: srvsvc len: 72
>[2011/12/15 15:22:54.878889,  6, pid=1905] rpc_server/srv_pipe_hnd.c:520(np_write_send)
>  np_write_send: len: 72
>[2011/12/15 15:22:54.878916, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 72
>[2011/12/15 15:22:54.878941, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 72
>[2011/12/15 15:22:54.878967, 10, pid=1905] rpc_server/srv_pipe_hnd.c:50(fill_rpc_header)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2011/12/15 15:22:54.878992, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 16
>[2011/12/15 15:22:54.879017, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 56
>[2011/12/15 15:22:54.879041, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 56
>[2011/12/15 15:22:54.879068, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 0
>[2011/12/15 15:22:54.879092, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 56
>[2011/12/15 15:22:54.879116, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 56, incoming data = 56
>[2011/12/15 15:22:54.879142, 10, pid=1905] rpc_server/srv_pipe.c:1877(process_complete_pdu)
>  PDU is in Little Endian format!
>[2011/12/15 15:22:54.879178,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_BIND (11)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0048 (72)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 11)
>          bind: struct dcerpc_bind
>              max_xmit_frag            : 0x10b8 (4280)
>              max_recv_frag            : 0x10b8 (4280)
>              assoc_group_id           : 0x00000000 (0)
>              num_contexts             : 0x01 (1)
>              ctx_list: ARRAY(1)
>                  ctx_list: struct dcerpc_ctx_list
>                      context_id               : 0x0000 (0)
>                      num_transfer_syntaxes    : 0x01 (1)
>                      abstract_syntax: struct ndr_syntax_id
>                          uuid                     : 4b324fc8-1670-01d3-1278-5a47bf6ee188
>                          if_version               : 0x00000003 (3)
>                      transfer_syntaxes: ARRAY(1)
>                          transfer_syntaxes: struct ndr_syntax_id
>                              uuid                     : 8a885d04-1ceb-11c9-9fe8-08002b104860
>                              if_version               : 0x00000002 (2)
>              auth_info                : DATA_BLOB length=0
>[2011/12/15 15:22:54.879577, 10, pid=1905] rpc_server/srv_pipe.c:1890(process_complete_pdu)
>  Processing packet type 11
>[2011/12/15 15:22:54.879606,  3, pid=1905] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
>  api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\srvsvc
>[2011/12/15 15:22:54.879633,  5, pid=1905] rpc_server/srv_pipe.c:923(api_pipe_bind_req)
>  api_pipe_bind_req: make response. 923
>[2011/12/15 15:22:54.879657,  3, pid=1905] rpc_server/srv_pipe.c:339(check_bind_req)
>  check_bind_req for \srvsvc
>[2011/12/15 15:22:54.879684,  3, pid=1905] rpc_server/srv_pipe.c:346(check_bind_req)
>  check_bind_req: \PIPE\srvsvc -> \PIPE\srvsvc
>[2011/12/15 15:22:54.879719,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       &r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_BIND_ACK (12)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0044 (68)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 12)
>          bind_ack: struct dcerpc_bind_ack
>              max_xmit_frag            : 0x10b8 (4280)
>              max_recv_frag            : 0x10b8 (4280)
>              assoc_group_id           : 0x000053f0 (21488)
>              secondary_address_size   : 0x000d (13)
>              secondary_address        : '\PIPE\srvsvc'
>              _pad1                    : DATA_BLOB length=0
>              num_results              : 0x01 (1)
>              ctx_list: ARRAY(1)
>                  ctx_list: struct dcerpc_ack_ctx
>                      result                   : 0x0000 (0)
>                      reason                   : 0x0000 (0)
>                      syntax: struct ndr_syntax_id
>                          uuid                     : 8a885d04-1ceb-11c9-9fe8-08002b104860
>                          if_version               : 0x00000002 (2)
>              auth_info                : DATA_BLOB length=0
>[2011/12/15 15:22:54.880125, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 56
>[2011/12/15 15:22:54.880162,  3, pid=1905] smbd/pipes.c:361(pipe_write_andx_done)
>  writeX-IPC nwritten=72
>[2011/12/15 15:22:54.880543, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 59
>[2011/12/15 15:22:54.880593,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x3b
>[2011/12/15 15:22:54.880621,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 365 of length 63 (0 toread)
>[2011/12/15 15:22:54.880646,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.880661,  5, pid=1905] lib/util.c:342(show_msg)
>  size=59
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=23360
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 6072 (0x17B8)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]= 1024 (0x400)
>  smb_vwv[ 6]= 1024 (0x400)
>  smb_vwv[ 7]=65535 (0xFFFF)
>  smb_vwv[ 8]=65535 (0xFFFF)
>  smb_vwv[ 9]= 1024 (0x400)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=0
>[2011/12/15 15:22:54.880915, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>[2011/12/15 15:22:54.880931,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBreadX (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.880957,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.880987,  6, pid=1905] rpc_server/srv_pipe_hnd.c:284(read_from_internal_pipe)
>   name: \srvsvc len: 1024
>[2011/12/15 15:22:54.881015, 10, pid=1905] rpc_server/srv_pipe_hnd.c:325(read_from_internal_pipe)
>  read_from_pipe: \srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2011/12/15 15:22:54.881042,  3, pid=1905] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
>  free_pipe_context: destroying talloc pool of size 21
>[2011/12/15 15:22:54.881075, 10, pid=1905] rpc_server/srv_pipe_hnd.c:788(np_read_recv)
>  Received 68 bytes. There is no more data outstanding
>[2011/12/15 15:22:54.881102,  3, pid=1905] smbd/pipes.c:485(pipe_read_andx_done)
>  readX-IPC min=1024 max=1024 nread=68
>[2011/12/15 15:22:54.881410, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 180
>[2011/12/15 15:22:54.881453,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0xb4
>[2011/12/15 15:22:54.881479,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 366 of length 184 (0 toread)
>[2011/12/15 15:22:54.881504,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.881518,  5, pid=1905] lib/util.c:342(show_msg)
>  size=180
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=23424
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   96 (0x60)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   96 (0x60)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]= 6072 (0x17B8)
>  smb_bcc=113
>[2011/12/15 15:22:54.881812, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 5C 00 50 00 49 00 50   00 45 00 5C 00 00 00 00   .\.P.I.P .E.\....
>  [0010] 00 05 00 00 03 10 00 00   00 60 00 00 00 01 00 00   ........ .`......
>  [0020] 00 48 00 00 00 00 00 0F   00 00 00 02 00 0D 00 00   .H...... ........
>  [0030] 00 00 00 00 00 0D 00 00   00 5C 00 5C 00 31 00 30   ........ .\.\.1.0
>  [0040] 00 2E 00 31 00 2E 00 30   00 2E 00 31 00 30 00 32   ...1...0 ...1.0.2
>  [0050] 00 00 00 48 60 01 00 00   00 01 00 00 00 04 00 02   ...H`... ........
>  [0060] 00 00 00 00 00 00 00 00   00 FF FF FF FF 00 00 00   ........ ........
>  [0070] 00                                                . 
>[2011/12/15 15:22:54.881992,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBtrans (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.882019,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.882049,  3, pid=1905] smbd/ipc.c:560(handle_trans)
>  trans <\PIPE\> data=96 params=0 setup=2
>[2011/12/15 15:22:54.882076,  5, pid=1905] smbd/ipc.c:593(handle_trans)
>  calling named_pipe
>[2011/12/15 15:22:54.882101,  3, pid=1905] smbd/ipc.c:511(named_pipe)
>  named pipe command on <> name
>[2011/12/15 15:22:54.882126,  5, pid=1905] smbd/ipc.c:434(api_fd_reply)
>  api_fd_reply
>[2011/12/15 15:22:54.882150,  3, pid=1905] smbd/ipc.c:475(api_fd_reply)
>  Got API command 0x26 on pipe "srvsvc" (pnum 17b8)
>[2011/12/15 15:22:54.882176, 10, pid=1905] smbd/ipc.c:477(api_fd_reply)
>  api_fd_reply: p:8bb4ea8 max_trans_reply: 1024
>[2011/12/15 15:22:54.882202,  6, pid=1905] rpc_server/srv_pipe_hnd.c:520(np_write_send)
>  np_write_send: len: 96
>[2011/12/15 15:22:54.882227, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 96
>[2011/12/15 15:22:54.882252, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 96
>[2011/12/15 15:22:54.882277, 10, pid=1905] rpc_server/srv_pipe_hnd.c:50(fill_rpc_header)
>  fill_rpc_header: data_to_copy = 96, len_needed_to_complete_hdr = 16, receive_len = 0
>[2011/12/15 15:22:54.882303, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 16
>[2011/12/15 15:22:54.882327, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 80
>[2011/12/15 15:22:54.882351, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 80
>[2011/12/15 15:22:54.882377, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 0
>[2011/12/15 15:22:54.882402, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 80
>[2011/12/15 15:22:54.882425, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 80, incoming data = 80
>[2011/12/15 15:22:54.882451, 10, pid=1905] rpc_server/srv_pipe.c:1877(process_complete_pdu)
>  PDU is in Little Endian format!
>[2011/12/15 15:22:54.882482,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_REQUEST (0)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0060 (96)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 0)
>          request: struct dcerpc_request
>              alloc_hint               : 0x00000048 (72)
>              context_id               : 0x0000 (0)
>              opnum                    : 0x000f (15)
>              object                   : union dcerpc_object(case 0)
>              empty: struct dcerpc_empty
>              _pad                     : DATA_BLOB length=0
>              stub_and_verifier        : DATA_BLOB length=72
>  [0000] 00 00 02 00 0D 00 00 00   00 00 00 00 0D 00 00 00   ........ ........
>  [0010] 5C 00 5C 00 31 00 30 00   2E 00 31 00 2E 00 30 00   \.\.1.0. ..1...0.
>  [0020] 2E 00 31 00 30 00 32 00   00 00 48 60 01 00 00 00   ..1.0.2. ..H`....
>  [0030] 01 00 00 00 04 00 02 00   00 00 00 00 00 00 00 00   ........ ........
>  [0040] FF FF FF FF 00 00 00 00                            ........ 
>[2011/12/15 15:22:54.882901, 10, pid=1905] rpc_server/srv_pipe.c:1890(process_complete_pdu)
>  Processing packet type 0
>[2011/12/15 15:22:54.882927, 10, pid=1905] rpc_server/srv_pipe.c:1734(dcesrv_auth_request)
>  Checking request auth.
>[2011/12/15 15:22:54.882953,  5, pid=1905] rpc_server/srv_pipe.c:1571(api_pipe_request)
>  Requested \PIPE\\srvsvc
>[2011/12/15 15:22:54.882979,  4, pid=1905] rpc_server/srv_pipe.c:1611(api_rpcTNP)
>  api_rpcTNP: \srvsvc op 0xf - api_rpcTNP: rpc command: SRVSVC_NETSHAREENUMALL
>[2011/12/15 15:22:54.883007,  6, pid=1905] rpc_server/srv_pipe.c:1645(api_rpcTNP)
>  api_rpc_cmds[15].fn == 83b0691
>[2011/12/15 15:22:54.883041,  1, pid=1905] ../librpc/ndr/ndr.c:284(ndr_print_function_debug)
>       srvsvc_NetShareEnumAll: struct srvsvc_NetShareEnumAll
>          in: struct srvsvc_NetShareEnumAll
>              server_unc               : *
>                  server_unc               : '\\10.1.0.102'
>              info_ctr                 : *
>                  info_ctr: struct srvsvc_NetShareInfoCtr
>                      level                    : 0x00000001 (1)
>                      ctr                      : union srvsvc_NetShareCtr(case 1)
>                      ctr1                     : *
>                          ctr1: struct srvsvc_NetShareCtr1
>                              count                    : 0x00000000 (0)
>                              array                    : NULL
>              max_buffer               : 0xffffffff (4294967295)
>              resume_handle            : NULL
>[2011/12/15 15:22:54.883234,  5, pid=1905] rpc_server/srvsvc/srv_srvsvc_nt.c:1381(_srvsvc_NetShareEnumAll)
>  _srvsvc_NetShareEnumAll: 1381
>[2011/12/15 15:22:54.883262,  5, pid=1905] rpc_server/srvsvc/srv_srvsvc_nt.c:567(init_srv_share_info_ctr)
>  init_srv_share_info_ctr
>[2011/12/15 15:22:54.883289,  4, pid=1905] smbd/sec_ctx.c:214(push_sec_ctx)
>  push_sec_ctx(1129, 513) : sec_ctx_stack_ndx = 1
>[2011/12/15 15:22:54.883317,  4, pid=1905] smbd/uid.c:460(push_conn_ctx)
>  push_conn_ctx(102) : conn_ctx_stack_ndx = 0
>[2011/12/15 15:22:54.883342,  4, pid=1905] smbd/sec_ctx.c:314(set_sec_ctx)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2011/12/15 15:22:54.883367,  5, pid=1905] ../libcli/security/security_token.c:53(security_token_debug)
>  Security token: (NULL)
>[2011/12/15 15:22:54.883392,  5, pid=1905] auth/token_util.c:527(debug_unix_user_token)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2011/12/15 15:22:54.883440,  8, pid=1905] smbd/service.c:248(load_registry_shares)
>  load_registry_shares()
>[2011/12/15 15:22:54.883473,  4, pid=1905] smbd/sec_ctx.c:422(pop_sec_ctx)
>  pop_sec_ctx (1129, 513) - sec_ctx_stack_ndx = 0
>[2011/12/15 15:22:54.883501, 10, pid=1905] rpc_server/srvsvc/srv_srvsvc_nt.c:585(init_srv_share_info_ctr)
>  counting service nfs
>[2011/12/15 15:22:54.883529, 10, pid=1905] rpc_server/srvsvc/srv_srvsvc_nt.c:585(init_srv_share_info_ctr)
>  counting service zfs
>[2011/12/15 15:22:54.883556, 10, pid=1905] rpc_server/srvsvc/srv_srvsvc_nt.c:585(init_srv_share_info_ctr)
>  counting service IPC$
>[2011/12/15 15:22:54.883599,  5, pid=1905] rpc_server/srvsvc/srv_srvsvc_nt.c:1395(_srvsvc_NetShareEnumAll)
>  _srvsvc_NetShareEnumAll: 1395
>[2011/12/15 15:22:54.883626,  1, pid=1905] ../librpc/ndr/ndr.c:284(ndr_print_function_debug)
>       srvsvc_NetShareEnumAll: struct srvsvc_NetShareEnumAll
>          out: struct srvsvc_NetShareEnumAll
>              info_ctr                 : *
>                  info_ctr: struct srvsvc_NetShareInfoCtr
>                      level                    : 0x00000001 (1)
>                      ctr                      : union srvsvc_NetShareCtr(case 1)
>                      ctr1                     : *
>                          ctr1: struct srvsvc_NetShareCtr1
>                              count                    : 0x00000003 (3)
>                              array                    : *
>                                  array: ARRAY(3)
>                                      array: struct srvsvc_NetShareInfo1
>                                          name                     : *
>                                              name                     : 'nfs'
>                                          type                     : STYPE_DISKTREE (0x0)
>                                          comment                  : *
>                                              comment                  : ''
>                                      array: struct srvsvc_NetShareInfo1
>                                          name                     : *
>                                              name                     : 'zfs'
>                                          type                     : STYPE_DISKTREE (0x0)
>                                          comment                  : *
>                                              comment                  : ''
>                                      array: struct srvsvc_NetShareInfo1
>                                          name                     : *
>                                              name                     : 'IPC$'
>                                          type                     : STYPE_IPC_HIDDEN (0x80000003)
>                                          comment                  : *
>                                              comment                  : 'IPC Service (SAMBA LDAP PDC)'
>              totalentries             : *
>                  totalentries             : 0x00000003 (3)
>              resume_handle            : NULL
>              result                   : WERR_OK
>[2011/12/15 15:22:54.884109,  5, pid=1905] rpc_server/srv_pipe.c:1679(api_rpcTNP)
>  api_rpcTNP: called \srvsvc successfully
>[2011/12/15 15:22:54.884142, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 80
>[2011/12/15 15:22:54.884178,  6, pid=1905] rpc_server/srv_pipe_hnd.c:284(read_from_internal_pipe)
>   name: \srvsvc len: 1024
>[2011/12/15 15:22:54.884206, 10, pid=1905] rpc_server/srv_pipe_hnd.c:346(read_from_internal_pipe)
>  read_from_pipe: \srvsvc: fault_state = 0 : data_sent_length = 0, p->out_data.rdata.length = 240.
>[2011/12/15 15:22:54.884239,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       &r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_RESPONSE (2)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0108 (264)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 2)
>          response: struct dcerpc_response
>              alloc_hint               : 0x000000f0 (240)
>              context_id               : 0x0000 (0)
>              cancel_count             : 0x00 (0)
>              _pad                     : DATA_BLOB length=0
>              stub_and_verifier        : DATA_BLOB length=240
>  [0000] 01 00 00 00 01 00 00 00   08 00 02 00 03 00 00 00   ........ ........
>  [0010] 0C 00 02 00 03 00 00 00   10 00 02 00 00 00 00 00   ........ ........
>  [0020] 14 00 02 00 18 00 02 00   00 00 00 00 1C 00 02 00   ........ ........
>  [0030] 20 00 02 00 03 00 00 80   24 00 02 00 04 00 00 00    ....... $.......
>  [0040] 00 00 00 00 04 00 00 00   6E 00 66 00 73 00 00 00   ........ n.f.s...
>  [0050] 01 00 00 00 00 00 00 00   01 00 00 00 00 00 00 00   ........ ........
>  [0060] 04 00 00 00 00 00 00 00   04 00 00 00 7A 00 66 00   ........ ....z.f.
>  [0070] 73 00 00 00 01 00 00 00   00 00 00 00 01 00 00 00   s....... ........
>  [0080] 00 00 00 00 05 00 00 00   00 00 00 00 05 00 00 00   ........ ........
>  [0090] 49 00 50 00 43 00 24 00   00 00 00 00 1D 00 00 00   I.P.C.$. ........
>  [00A0] 00 00 00 00 1D 00 00 00   49 00 50 00 43 00 20 00   ........ I.P.C. .
>  [00B0] 53 00 65 00 72 00 76 00   69 00 63 00 65 00 20 00   S.e.r.v. i.c.e. .
>  [00C0] 28 00 53 00 41 00 4D 00   42 00 41 00 20 00 4C 00   (.S.A.M. B.A. .L.
>  [00D0] 44 00 41 00 50 00 20 00   50 00 44 00 43 00 29 00   D.A.P. . P.D.C.).
>  [00E0] 00 00 00 00 03 00 00 00   00 00 00 00 00 00 00 00   ........ ........
>[2011/12/15 15:22:54.884931,  3, pid=1905] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
>  free_pipe_context: destroying talloc pool of size 130
>[2011/12/15 15:22:54.884966, 10, pid=1905] rpc_server/srv_pipe_hnd.c:788(np_read_recv)
>  Received 264 bytes. There is no more data outstanding
>[2011/12/15 15:22:54.884994,  5, pid=1905] smbd/ipc.c:62(copy_trans_params_and_data)
>  copy_trans_params_and_data: params[0..0] data[0..264] (align 0)
>[2011/12/15 15:22:54.885020,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.885035,  5, pid=1905] lib/util.c:342(show_msg)
>  size=320
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=1
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=23424
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  264 (0x108)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  264 (0x108)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=265
>[2011/12/15 15:22:54.885269, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 05 00 02 03 10 00 00   00 08 01 00 00 01 00 00   ........ ........
>  [0010] 00 F0 00 00 00 00 00 00   00 01 00 00 00 01 00 00   ........ ........
>  [0020] 00 08 00 02 00 03 00 00   00 0C 00 02 00 03 00 00   ........ ........
>  [0030] 00 10 00 02 00 00 00 00   00 14 00 02 00 18 00 02   ........ ........
>  [0040] 00 00 00 00 00 1C 00 02   00 20 00 02 00 03 00 00   ........ . ......
>  [0050] 80 24 00 02 00 04 00 00   00 00 00 00 00 04 00 00   .$...... ........
>  [0060] 00 6E 00 66 00 73 00 00   00 01 00 00 00 00 00 00   .n.f.s.. ........
>  [0070] 00 01 00 00 00 00 00 00   00 04 00 00 00 00 00 00   ........ ........
>  [0080] 00 04 00 00 00 7A 00 66   00 73 00 00 00 01 00 00   .....z.f .s......
>  [0090] 00 00 00 00 00 01 00 00   00 00 00 00 00 05 00 00   ........ ........
>  [00A0] 00 00 00 00 00 05 00 00   00 49 00 50 00 43 00 24   ........ .I.P.C.$
>  [00B0] 00 00 00 00 00 1D 00 00   00 00 00 00 00 1D 00 00   ........ ........
>  [00C0] 00 49 00 50 00 43 00 20   00 53 00 65 00 72 00 76   .I.P.C.  .S.e.r.v
>  [00D0] 00 69 00 63 00 65 00 20   00 28 00 53 00 41 00 4D   .i.c.e.  .(.S.A.M
>  [00E0] 00 42 00 41 00 20 00 4C   00 44 00 41 00 50 00 20   .B.A. .L .D.A.P. 
>  [00F0] 00 50 00 44 00 43 00 29   00 00 00 00 00 03 00 00   .P.D.C.) ........
>  [0100] 00 00 00 00 00 00 00 00   00                       ........ .
>[2011/12/15 15:22:54.885958, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 41
>[2011/12/15 15:22:54.886002,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x29
>[2011/12/15 15:22:54.886029,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 367 of length 45 (0 toread)
>[2011/12/15 15:22:54.886054,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.886068,  5, pid=1905] lib/util.c:342(show_msg)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=23488
>  smt_wct=3
>  smb_vwv[ 0]= 6072 (0x17B8)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2011/12/15 15:22:54.886232, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>[2011/12/15 15:22:54.886248,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBclose (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.886274,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.886300,  3, pid=1905] smbd/reply.c:4851(reply_close)
>  close fd=-1 fnum=6072 (numopen=1)
>[2011/12/15 15:22:54.886327,  6, pid=1905] smbd/close.c:527(set_close_write_time)
>  close_write_time: Thu Jan  1 00:59:59 1970
>[2011/12/15 15:22:54.886356, 10, pid=1905] rpc_server/rpc_handles.c:307(close_policy_by_pipe)
>  close_policy_by_pipe: deleted handle list for pipe \srvsvc
>[2011/12/15 15:22:54.886387,  5, pid=1905] smbd/files.c:464(file_free)
>  freed files structure 6072 (0 used)
>[2011/12/15 15:22:54.886416,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.886431,  5, pid=1905] lib/util.c:342(show_msg)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=23488
>  smt_wct=0
>  smb_bcc=0
>[2011/12/15 15:22:54.886564, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>[2011/12/15 15:22:54.888452, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 102
>[2011/12/15 15:22:54.888494,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x66
>[2011/12/15 15:22:54.888520,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 368 of length 106 (0 toread)
>[2011/12/15 15:22:54.888545,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.888559,  5, pid=1905] lib/util.c:342(show_msg)
>  size=102
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1776
>  smb_uid=102
>  smb_mid=23552
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 4096 (0x1000)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  768 (0x300)
>  smb_bcc=19
>[2011/12/15 15:22:54.888958, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 5C 00 73 00 70 00 6F   00 6F 00 6C 00 73 00 73   .\.s.p.o .o.l.s.s
>  [0010] 00 00 00                                          ... 
>[2011/12/15 15:22:54.889014,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBntcreateX (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.889041,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.889069, 10, pid=1905] smbd/nttrans.c:505(reply_ntcreate_and_X)
>  reply_ntcreate_and_X: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0, fname = spoolss
>[2011/12/15 15:22:54.889099,  4, pid=1905] smbd/nttrans.c:293(nt_open_pipe)
>  nt_open_pipe: Opening pipe \spoolss.
>[2011/12/15 15:22:54.889128,  5, pid=1905] smbd/files.c:126(file_new)
>  allocated file structure 1977, fnum = 6073 (1 used)
>[2011/12/15 15:22:54.889157, 10, pid=1905] smbd/files.c:618(file_name_hash)
>  file_name_hash: /tmp/spoolss hash 0x7d4e46e5
>[2011/12/15 15:22:54.889188,  4, pid=1905] rpc_server/rpc_ncacn_np.c:132(make_internal_rpc_pipe_p)
>  Create pipe requested \spoolss
>[2011/12/15 15:22:54.889219, 10, pid=1905] rpc_server/rpc_handles.c:116(init_pipe_handles)
>  init_pipe_handle_list: created handle list for pipe \spoolss
>[2011/12/15 15:22:54.889245, 10, pid=1905] rpc_server/rpc_handles.c:133(init_pipe_handles)
>  init_pipe_handle_list: pipe_handles ref count = 1 for pipe \spoolss
>[2011/12/15 15:22:54.889279,  4, pid=1905] rpc_server/rpc_ncacn_np.c:176(make_internal_rpc_pipe_p)
>  Created internal pipe \spoolss (pipes_open=0)
>[2011/12/15 15:22:54.889306,  5, pid=1905] smbd/nttrans.c:382(do_ntcreate_pipe_open)
>  do_ntcreate_pipe_open: open pipe = \spoolss
>[2011/12/15 15:22:54.889699, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 136
>[2011/12/15 15:22:54.889741,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x88
>[2011/12/15 15:22:54.889767,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 369 of length 140 (0 toread)
>[2011/12/15 15:22:54.889793,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.889807,  5, pid=1905] lib/util.c:342(show_msg)
>  size=136
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=23616
>  smt_wct=14
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 6073 (0x17B9)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=65535 (0xFFFF)
>  smb_vwv[ 6]=65535 (0xFFFF)
>  smb_vwv[ 7]=    8 (0x8)
>  smb_vwv[ 8]=   72 (0x48)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   72 (0x48)
>  smb_vwv[11]=   64 (0x40)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_bcc=73
>[2011/12/15 15:22:54.890115, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] EE 05 00 0B 03 10 00 00   00 48 00 00 00 01 00 00   ........ .H......
>  [0010] 00 B8 10 B8 10 00 00 00   00 01 00 00 00 00 00 01   ........ ........
>  [0020] 00 78 56 34 12 34 12 CD   AB EF 00 01 23 45 67 89   .xV4.4.. ....#Eg.
>  [0030] AB 01 00 00 00 04 5D 88   8A EB 1C C9 11 9F E8 08   ......]. ........
>  [0040] 00 2B 10 48 60 02 00 00   00                       .+.H`... .
>[2011/12/15 15:22:54.890239,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBwriteX (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.890266,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.890292,  6, pid=1905] smbd/pipes.c:300(reply_pipe_write_and_X)
>  reply_pipe_write_and_X: 17b9 name: spoolss len: 72
>[2011/12/15 15:22:54.890319,  6, pid=1905] rpc_server/srv_pipe_hnd.c:520(np_write_send)
>  np_write_send: len: 72
>[2011/12/15 15:22:54.890345, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 72
>[2011/12/15 15:22:54.890370, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 72
>[2011/12/15 15:22:54.890395, 10, pid=1905] rpc_server/srv_pipe_hnd.c:50(fill_rpc_header)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2011/12/15 15:22:54.890421, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 16
>[2011/12/15 15:22:54.890445, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 56
>[2011/12/15 15:22:54.890470, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 56
>[2011/12/15 15:22:54.890496, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 0
>[2011/12/15 15:22:54.890520, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 56
>[2011/12/15 15:22:54.890544, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 56, incoming data = 56
>[2011/12/15 15:22:54.890570, 10, pid=1905] rpc_server/srv_pipe.c:1877(process_complete_pdu)
>  PDU is in Little Endian format!
>[2011/12/15 15:22:54.890600,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_BIND (11)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0048 (72)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 11)
>          bind: struct dcerpc_bind
>              max_xmit_frag            : 0x10b8 (4280)
>              max_recv_frag            : 0x10b8 (4280)
>              assoc_group_id           : 0x00000000 (0)
>              num_contexts             : 0x01 (1)
>              ctx_list: ARRAY(1)
>                  ctx_list: struct dcerpc_ctx_list
>                      context_id               : 0x0000 (0)
>                      num_transfer_syntaxes    : 0x01 (1)
>                      abstract_syntax: struct ndr_syntax_id
>                          uuid                     : 12345678-1234-abcd-ef00-0123456789ab
>                          if_version               : 0x00000001 (1)
>                      transfer_syntaxes: ARRAY(1)
>                          transfer_syntaxes: struct ndr_syntax_id
>                              uuid                     : 8a885d04-1ceb-11c9-9fe8-08002b104860
>                              if_version               : 0x00000002 (2)
>              auth_info                : DATA_BLOB length=0
>[2011/12/15 15:22:54.890990, 10, pid=1905] rpc_server/srv_pipe.c:1890(process_complete_pdu)
>  Processing packet type 11
>[2011/12/15 15:22:54.891016,  3, pid=1905] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
>  api_pipe_bind_req: \PIPE\spoolss -> \PIPE\spoolss
>[2011/12/15 15:22:54.891042,  5, pid=1905] rpc_server/srv_pipe.c:923(api_pipe_bind_req)
>  api_pipe_bind_req: make response. 923
>[2011/12/15 15:22:54.891067,  3, pid=1905] rpc_server/srv_pipe.c:339(check_bind_req)
>  check_bind_req for \spoolss
>[2011/12/15 15:22:54.891093,  3, pid=1905] rpc_server/srv_pipe.c:346(check_bind_req)
>  check_bind_req: \PIPE\spoolss -> \PIPE\spoolss
>[2011/12/15 15:22:54.891126,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       &r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_BIND_ACK (12)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0044 (68)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 12)
>          bind_ack: struct dcerpc_bind_ack
>              max_xmit_frag            : 0x10b8 (4280)
>              max_recv_frag            : 0x10b8 (4280)
>              assoc_group_id           : 0x000053f0 (21488)
>              secondary_address_size   : 0x000e (14)
>              secondary_address        : '\PIPE\spoolss'
>              _pad1                    : DATA_BLOB length=0
>              num_results              : 0x01 (1)
>              ctx_list: ARRAY(1)
>                  ctx_list: struct dcerpc_ack_ctx
>                      result                   : 0x0000 (0)
>                      reason                   : 0x0000 (0)
>                      syntax: struct ndr_syntax_id
>                          uuid                     : 8a885d04-1ceb-11c9-9fe8-08002b104860
>                          if_version               : 0x00000002 (2)
>              auth_info                : DATA_BLOB length=0
>[2011/12/15 15:22:54.891502, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 56
>[2011/12/15 15:22:54.891536,  3, pid=1905] smbd/pipes.c:361(pipe_write_andx_done)
>  writeX-IPC nwritten=72
>[2011/12/15 15:22:54.891847, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 59
>[2011/12/15 15:22:54.891888,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x3b
>[2011/12/15 15:22:54.891915,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 370 of length 63 (0 toread)
>[2011/12/15 15:22:54.891940,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.891954,  5, pid=1905] lib/util.c:342(show_msg)
>  size=59
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=23680
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 6073 (0x17B9)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]= 1024 (0x400)
>  smb_vwv[ 6]= 1024 (0x400)
>  smb_vwv[ 7]=65535 (0xFFFF)
>  smb_vwv[ 8]=65535 (0xFFFF)
>  smb_vwv[ 9]= 1024 (0x400)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=0
>[2011/12/15 15:22:54.892207, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>[2011/12/15 15:22:54.892223,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBreadX (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.892249,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.892277,  6, pid=1905] rpc_server/srv_pipe_hnd.c:284(read_from_internal_pipe)
>   name: \spoolss len: 1024
>[2011/12/15 15:22:54.892305, 10, pid=1905] rpc_server/srv_pipe_hnd.c:325(read_from_internal_pipe)
>  read_from_pipe: \spoolss: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2011/12/15 15:22:54.892332,  3, pid=1905] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
>  free_pipe_context: destroying talloc pool of size 22
>[2011/12/15 15:22:54.892363, 10, pid=1905] rpc_server/srv_pipe_hnd.c:788(np_read_recv)
>  Received 68 bytes. There is no more data outstanding
>[2011/12/15 15:22:54.892389,  3, pid=1905] smbd/pipes.c:485(pipe_read_andx_done)
>  readX-IPC min=1024 max=1024 nread=68
>[2011/12/15 15:22:54.892679, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 266
>[2011/12/15 15:22:54.892721,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x10a
>[2011/12/15 15:22:54.892747,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 371 of length 270 (0 toread)
>[2011/12/15 15:22:54.892772,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.892786,  5, pid=1905] lib/util.c:342(show_msg)
>  size=266
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1776
>  smb_uid=102
>  smb_mid=23744
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  182 (0xB6)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  182 (0xB6)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]= 6073 (0x17B9)
>  smb_bcc=199
>[2011/12/15 15:22:54.893078, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 5C 00 50 00 49 00 50   00 45 00 5C 00 00 00 00   .\.P.I.P .E.\....
>  [0010] 00 05 00 00 03 10 00 00   00 B6 00 00 00 01 00 00   ........ ........
>  [0020] 00 9E 00 00 00 00 00 45   00 00 00 02 00 0D 00 00   .......E ........
>  [0030] 00 00 00 00 00 0D 00 00   00 5C 00 5C 00 31 00 30   ........ .\.\.1.0
>  [0040] 00 2E 00 31 00 2E 00 30   00 2E 00 31 00 30 00 32   ...1...0 ...1.0.2
>  [0050] 00 00 00 48 60 00 00 00   00 00 00 00 00 00 00 00   ...H`... ........
>  [0060] 00 00 00 00 00 01 00 00   00 01 00 00 00 04 00 02   ........ ........
>  [0070] 00 1C 00 00 00 08 00 02   00 0C 00 02 00 28 0A 00   ........ .....(..
>  [0080] 00 03 00 00 00 00 00 00   00 00 00 00 00 0A 00 00   ........ ........
>  [0090] 00 00 00 00 00 0A 00 00   00 5C 00 5C 00 57 00 58   ........ .\.\.W.X
>  [00A0] 00 50 00 2D 00 44 00 4F   00 4D 00 00 00 07 00 00   .P.-.D.O .M......
>  [00B0] 00 00 00 00 00 07 00 00   00 61 00 64 00 74 00 65   ........ .a.d.t.e
>  [00C0] 00 73 00 74 00 00 00                              .s.t... 
>[2011/12/15 15:22:54.893365,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBtrans (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.893392,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.893421,  3, pid=1905] smbd/ipc.c:560(handle_trans)
>  trans <\PIPE\> data=182 params=0 setup=2
>[2011/12/15 15:22:54.893449,  5, pid=1905] smbd/ipc.c:593(handle_trans)
>  calling named_pipe
>[2011/12/15 15:22:54.893473,  3, pid=1905] smbd/ipc.c:511(named_pipe)
>  named pipe command on <> name
>[2011/12/15 15:22:54.893497,  5, pid=1905] smbd/ipc.c:434(api_fd_reply)
>  api_fd_reply
>[2011/12/15 15:22:54.893521,  3, pid=1905] smbd/ipc.c:475(api_fd_reply)
>  Got API command 0x26 on pipe "spoolss" (pnum 17b9)
>[2011/12/15 15:22:54.893547, 10, pid=1905] smbd/ipc.c:477(api_fd_reply)
>  api_fd_reply: p:8bb4ea8 max_trans_reply: 1024
>[2011/12/15 15:22:54.893573,  6, pid=1905] rpc_server/srv_pipe_hnd.c:520(np_write_send)
>  np_write_send: len: 182
>[2011/12/15 15:22:54.893598, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 182
>[2011/12/15 15:22:54.893623, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 182
>[2011/12/15 15:22:54.893648, 10, pid=1905] rpc_server/srv_pipe_hnd.c:50(fill_rpc_header)
>  fill_rpc_header: data_to_copy = 182, len_needed_to_complete_hdr = 16, receive_len = 0
>[2011/12/15 15:22:54.893673, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 16
>[2011/12/15 15:22:54.893698, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 166
>[2011/12/15 15:22:54.893722, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 166
>[2011/12/15 15:22:54.893763, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 0
>[2011/12/15 15:22:54.893788, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 166
>[2011/12/15 15:22:54.893813, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 166, incoming data = 166
>[2011/12/15 15:22:54.893839, 10, pid=1905] rpc_server/srv_pipe.c:1877(process_complete_pdu)
>  PDU is in Little Endian format!
>[2011/12/15 15:22:54.893868,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_REQUEST (0)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x00b6 (182)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 0)
>          request: struct dcerpc_request
>              alloc_hint               : 0x0000009e (158)
>              context_id               : 0x0000 (0)
>              opnum                    : 0x0045 (69)
>              object                   : union dcerpc_object(case 0)
>              empty: struct dcerpc_empty
>              _pad                     : DATA_BLOB length=0
>              stub_and_verifier        : DATA_BLOB length=158
>  [0000] 00 00 02 00 0D 00 00 00   00 00 00 00 0D 00 00 00   ........ ........
>  [0010] 5C 00 5C 00 31 00 30 00   2E 00 31 00 2E 00 30 00   \.\.1.0. ..1...0.
>  [0020] 2E 00 31 00 30 00 32 00   00 00 48 60 00 00 00 00   ..1.0.2. ..H`....
>  [0030] 00 00 00 00 00 00 00 00   00 00 00 00 01 00 00 00   ........ ........
>  [0040] 01 00 00 00 04 00 02 00   1C 00 00 00 08 00 02 00   ........ ........
>  [0050] 0C 00 02 00 28 0A 00 00   03 00 00 00 00 00 00 00   ....(... ........
>  [0060] 00 00 00 00 0A 00 00 00   00 00 00 00 0A 00 00 00   ........ ........
>  [0070] 5C 00 5C 00 57 00 58 00   50 00 2D 00 44 00 4F 00   \.\.W.X. P.-.D.O.
>  [0080] 4D 00 00 00 07 00 00 00   00 00 00 00 07 00 00 00   M....... ........
>  [0090] 61 00 64 00 74 00 65 00   73 00 74 00 00 00        a.d.t.e. s.t...
>[2011/12/15 15:22:54.894439, 10, pid=1905] rpc_server/srv_pipe.c:1890(process_complete_pdu)
>  Processing packet type 0
>[2011/12/15 15:22:54.894466, 10, pid=1905] rpc_server/srv_pipe.c:1734(dcesrv_auth_request)
>  Checking request auth.
>[2011/12/15 15:22:54.894491,  5, pid=1905] rpc_server/srv_pipe.c:1571(api_pipe_request)
>  Requested \PIPE\\spoolss
>[2011/12/15 15:22:54.894518,  4, pid=1905] rpc_server/srv_pipe.c:1611(api_rpcTNP)
>  api_rpcTNP: \spoolss op 0x45 - api_rpcTNP: rpc command: SPOOLSS_OPENPRINTEREX
>[2011/12/15 15:22:54.894550,  6, pid=1905] rpc_server/srv_pipe.c:1645(api_rpcTNP)
>  api_rpc_cmds[69].fn == 83dcf4f
>[2011/12/15 15:22:54.894588,  1, pid=1905] ../librpc/ndr/ndr.c:284(ndr_print_function_debug)
>       spoolss_OpenPrinterEx: struct spoolss_OpenPrinterEx
>          in: struct spoolss_OpenPrinterEx
>              printername              : *
>                  printername              : '\\10.1.0.102'
>              datatype                 : NULL
>              devmode_ctr: struct spoolss_DevmodeContainer
>                  _ndr_size                : 0x00000000 (0)
>                  devmode                  : NULL
>              access_mask              : 0x00000000 (0)
>                     0: SERVER_ACCESS_ADMINISTER 
>                     0: SERVER_ACCESS_ENUMERATE  
>                     0: PRINTER_ACCESS_ADMINISTER
>                     0: PRINTER_ACCESS_USE       
>                     0: JOB_ACCESS_ADMINISTER    
>                     0: JOB_ACCESS_READ          
>              level                    : 0x00000001 (1)
>              userlevel                : union spoolss_UserLevel(case 1)
>              level1                   : *
>                  level1: struct spoolss_UserLevel1
>                      size                     : 0x0000001c (28)
>                      client                   : *
>                          client                   : '\\WXP-DOM'
>                      user                     : *
>                          user                     : 'adtest'
>                      build                    : 0x00000a28 (2600)
>                      major                    : UNKNOWN_ENUM_VALUE (3)
>                      minor                    : SPOOLSS_MINOR_VERSION_0 (0)
>                      processor                : PROCESSOR_ARCHITECTURE_INTEL (0)
>  checking name: \\10.1.0.102
>[2011/12/15 15:22:54.894958, 10, pid=1905] rpc_server/spoolss/srv_spoolss_nt.c:751(open_printer_hnd)
>  open_printer_hnd: name [\\10.1.0.102]
>[2011/12/15 15:22:54.894989,  4, pid=1905] rpc_server/rpc_handles.c:197(create_rpc_handle_internal)
>  Opened policy hnd[1] [0000] 00 00 00 00 17 00 00 00   00 00 00 00 EA 4E BE 02   ........ .....N..
>  [0010] 71 07 00 00                                       q... 
>[2011/12/15 15:22:54.895044,  3, pid=1905] rpc_server/spoolss/srv_spoolss_nt.c:520(set_printer_hnd_printertype)
>  Setting printer type=\\10.1.0.102
>  Printer is a print server
>[2011/12/15 15:22:54.895080,  4, pid=1905] rpc_server/spoolss/srv_spoolss_nt.c:580(set_printer_hnd_name)
>  Setting printer name=\\10.1.0.102 (len=12)
>[2011/12/15 15:22:54.895107,  8, pid=1905] lib/util.c:1521(is_myname)
>  is_myname("10.1.0.102") returns 0
>[2011/12/15 15:22:54.895160,  5, pid=1905] rpc_server/spoolss/srv_spoolss_nt.c:787(open_printer_hnd)
>  1 printer handles active
>[2011/12/15 15:22:54.895188,  4, pid=1905] rpc_server/rpc_handles.c:232(find_policy_by_hnd_internal)
>  Found policy hnd[0] [0000] 00 00 00 00 17 00 00 00   00 00 00 00 EA 4E BE 02   ........ .....N..
>  [0010] 71 07 00 00                                       q... 
>[2011/12/15 15:22:54.895243,  4, pid=1905] rpc_server/spoolss/srv_spoolss_nt.c:1851(_spoolss_OpenPrinterEx)
>  Setting print server access = SERVER_ACCESS_ENUMERATE
>[2011/12/15 15:22:54.895268,  1, pid=1905] ../librpc/ndr/ndr.c:284(ndr_print_function_debug)
>       spoolss_OpenPrinterEx: struct spoolss_OpenPrinterEx
>          out: struct spoolss_OpenPrinterEx
>              handle                   : *
>                  handle: struct policy_handle
>                      handle_type              : 0x00000000 (0)
>                      uuid                     : 00000017-0000-0000-ea4e-be0271070000
>              result                   : WERR_OK
>[2011/12/15 15:22:54.895375,  5, pid=1905] rpc_server/srv_pipe.c:1679(api_rpcTNP)
>  api_rpcTNP: called \spoolss successfully
>[2011/12/15 15:22:54.895404, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 166
>[2011/12/15 15:22:54.895439,  6, pid=1905] rpc_server/srv_pipe_hnd.c:284(read_from_internal_pipe)
>   name: \spoolss len: 1024
>[2011/12/15 15:22:54.895467, 10, pid=1905] rpc_server/srv_pipe_hnd.c:346(read_from_internal_pipe)
>  read_from_pipe: \spoolss: fault_state = 0 : data_sent_length = 0, p->out_data.rdata.length = 24.
>[2011/12/15 15:22:54.895499,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       &r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_RESPONSE (2)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0030 (48)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 2)
>          response: struct dcerpc_response
>              alloc_hint               : 0x00000018 (24)
>              context_id               : 0x0000 (0)
>              cancel_count             : 0x00 (0)
>              _pad                     : DATA_BLOB length=0
>              stub_and_verifier        : DATA_BLOB length=24
>  [0000] 00 00 00 00 17 00 00 00   00 00 00 00 EA 4E BE 02   ........ .....N..
>  [0010] 71 07 00 00 00 00 00 00                            q....... 
>[2011/12/15 15:22:54.895806,  3, pid=1905] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
>  free_pipe_context: destroying talloc pool of size 22
>[2011/12/15 15:22:54.895837, 10, pid=1905] rpc_server/srv_pipe_hnd.c:788(np_read_recv)
>  Received 48 bytes. There is no more data outstanding
>[2011/12/15 15:22:54.895864,  5, pid=1905] smbd/ipc.c:62(copy_trans_params_and_data)
>  copy_trans_params_and_data: params[0..0] data[0..48] (align 0)
>[2011/12/15 15:22:54.895890,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.895904,  5, pid=1905] lib/util.c:342(show_msg)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=1
>  smb_pid=1776
>  smb_uid=102
>  smb_mid=23744
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2011/12/15 15:22:54.896139, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 05 00 02 03 10 00 00   00 30 00 00 00 01 00 00   ........ .0......
>  [0010] 00 18 00 00 00 00 00 00   00 00 00 00 00 17 00 00   ........ ........
>  [0020] 00 00 00 00 00 EA 4E BE   02 71 07 00 00 00 00 00   ......N. .q......
>  [0030] 00                                                . 
>[2011/12/15 15:22:54.896559, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 128
>[2011/12/15 15:22:54.896601,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x80
>[2011/12/15 15:22:54.896628,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 372 of length 132 (0 toread)
>[2011/12/15 15:22:54.896653,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.896667,  5, pid=1905] lib/util.c:342(show_msg)
>  size=128
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1776
>  smb_uid=102
>  smb_mid=23808
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   44 (0x2C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   44 (0x2C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]= 6073 (0x17B9)
>  smb_bcc=61
>[2011/12/15 15:22:54.896983, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 5C 00 50 00 49 00 50   00 45 00 5C 00 00 00 00   .\.P.I.P .E.\....
>  [0010] 00 05 00 00 03 10 00 00   00 2C 00 00 00 02 00 00   ........ .,......
>  [0020] 00 14 00 00 00 00 00 1D   00 00 00 00 00 17 00 00   ........ ........
>  [0030] 00 00 00 00 00 EA 4E BE   02 71 07 00 00           ......N. .q...
>[2011/12/15 15:22:54.897085,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBtrans (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.897112,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.897141,  3, pid=1905] smbd/ipc.c:560(handle_trans)
>  trans <\PIPE\> data=44 params=0 setup=2
>[2011/12/15 15:22:54.897168,  5, pid=1905] smbd/ipc.c:593(handle_trans)
>  calling named_pipe
>[2011/12/15 15:22:54.897192,  3, pid=1905] smbd/ipc.c:511(named_pipe)
>  named pipe command on <> name
>[2011/12/15 15:22:54.897217,  5, pid=1905] smbd/ipc.c:434(api_fd_reply)
>  api_fd_reply
>[2011/12/15 15:22:54.897241,  3, pid=1905] smbd/ipc.c:475(api_fd_reply)
>  Got API command 0x26 on pipe "spoolss" (pnum 17b9)
>[2011/12/15 15:22:54.897266, 10, pid=1905] smbd/ipc.c:477(api_fd_reply)
>  api_fd_reply: p:8bb4ea8 max_trans_reply: 1024
>[2011/12/15 15:22:54.897292,  6, pid=1905] rpc_server/srv_pipe_hnd.c:520(np_write_send)
>  np_write_send: len: 44
>[2011/12/15 15:22:54.897317, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 44
>[2011/12/15 15:22:54.897342, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 44
>[2011/12/15 15:22:54.897367, 10, pid=1905] rpc_server/srv_pipe_hnd.c:50(fill_rpc_header)
>  fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0
>[2011/12/15 15:22:54.897392, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 16
>[2011/12/15 15:22:54.897416, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 28
>[2011/12/15 15:22:54.897440, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 28
>[2011/12/15 15:22:54.897465, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 0
>[2011/12/15 15:22:54.897490, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 28
>[2011/12/15 15:22:54.897513, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 28, incoming data = 28
>[2011/12/15 15:22:54.897539, 10, pid=1905] rpc_server/srv_pipe.c:1877(process_complete_pdu)
>  PDU is in Little Endian format!
>[2011/12/15 15:22:54.897568,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_REQUEST (0)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x002c (44)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000002 (2)
>          u                        : union dcerpc_payload(case 0)
>          request: struct dcerpc_request
>              alloc_hint               : 0x00000014 (20)
>              context_id               : 0x0000 (0)
>              opnum                    : 0x001d (29)
>              object                   : union dcerpc_object(case 0)
>              empty: struct dcerpc_empty
>              _pad                     : DATA_BLOB length=0
>              stub_and_verifier        : DATA_BLOB length=20
>  [0000] 00 00 00 00 17 00 00 00   00 00 00 00 EA 4E BE 02   ........ .....N..
>  [0010] 71 07 00 00                                       q... 
>[2011/12/15 15:22:54.897896, 10, pid=1905] rpc_server/srv_pipe.c:1890(process_complete_pdu)
>  Processing packet type 0
>[2011/12/15 15:22:54.897921, 10, pid=1905] rpc_server/srv_pipe.c:1734(dcesrv_auth_request)
>  Checking request auth.
>[2011/12/15 15:22:54.897946,  5, pid=1905] rpc_server/srv_pipe.c:1571(api_pipe_request)
>  Requested \PIPE\\spoolss
>[2011/12/15 15:22:54.897973,  4, pid=1905] rpc_server/srv_pipe.c:1611(api_rpcTNP)
>  api_rpcTNP: \spoolss op 0x1d - api_rpcTNP: rpc command: SPOOLSS_CLOSEPRINTER
>[2011/12/15 15:22:54.898000,  6, pid=1905] rpc_server/srv_pipe.c:1645(api_rpcTNP)
>  api_rpc_cmds[29].fn == 83d5b85
>[2011/12/15 15:22:54.898032,  1, pid=1905] ../librpc/ndr/ndr.c:284(ndr_print_function_debug)
>       spoolss_ClosePrinter: struct spoolss_ClosePrinter
>          in: struct spoolss_ClosePrinter
>              handle                   : *
>                  handle: struct policy_handle
>                      handle_type              : 0x00000000 (0)
>                      uuid                     : 00000017-0000-0000-ea4e-be0271070000
>[2011/12/15 15:22:54.898127,  4, pid=1905] rpc_server/rpc_handles.c:232(find_policy_by_hnd_internal)
>  Found policy hnd[0] [0000] 00 00 00 00 17 00 00 00   00 00 00 00 EA 4E BE 02   ........ .....N..
>  [0010] 71 07 00 00                                       q... 
>[2011/12/15 15:22:54.898182,  4, pid=1905] rpc_server/rpc_handles.c:232(find_policy_by_hnd_internal)
>  Found policy hnd[0] [0000] 00 00 00 00 17 00 00 00   00 00 00 00 EA 4E BE 02   ........ .....N..
>  [0010] 71 07 00 00                                       q... 
>[2011/12/15 15:22:54.898236,  4, pid=1905] rpc_server/rpc_handles.c:232(find_policy_by_hnd_internal)
>  Found policy hnd[0] [0000] 00 00 00 00 17 00 00 00   00 00 00 00 EA 4E BE 02   ........ .....N..
>  [0010] 71 07 00 00                                       q... 
>[2011/12/15 15:22:54.898290,  3, pid=1905] rpc_server/rpc_handles.c:281(close_policy_hnd)
>  Closed policy
>[2011/12/15 15:22:54.898315,  1, pid=1905] ../librpc/ndr/ndr.c:284(ndr_print_function_debug)
>       spoolss_ClosePrinter: struct spoolss_ClosePrinter
>          out: struct spoolss_ClosePrinter
>              handle                   : *
>                  handle: struct policy_handle
>                      handle_type              : 0x00000000 (0)
>                      uuid                     : 00000000-0000-0000-0000-000000000000
>              result                   : WERR_OK
>[2011/12/15 15:22:54.898419,  5, pid=1905] rpc_server/srv_pipe.c:1679(api_rpcTNP)
>  api_rpcTNP: called \spoolss successfully
>[2011/12/15 15:22:54.898448, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 28
>[2011/12/15 15:22:54.898483,  6, pid=1905] rpc_server/srv_pipe_hnd.c:284(read_from_internal_pipe)
>   name: \spoolss len: 1024
>[2011/12/15 15:22:54.898511, 10, pid=1905] rpc_server/srv_pipe_hnd.c:346(read_from_internal_pipe)
>  read_from_pipe: \spoolss: fault_state = 0 : data_sent_length = 0, p->out_data.rdata.length = 24.
>[2011/12/15 15:22:54.898542,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       &r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_RESPONSE (2)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0030 (48)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000002 (2)
>          u                        : union dcerpc_payload(case 2)
>          response: struct dcerpc_response
>              alloc_hint               : 0x00000018 (24)
>              context_id               : 0x0000 (0)
>              cancel_count             : 0x00 (0)
>              _pad                     : DATA_BLOB length=0
>              stub_and_verifier        : DATA_BLOB length=24
>  [0000] 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00   ........ ........
>  [0010] 00 00 00 00 00 00 00 00                            ........ 
>[2011/12/15 15:22:54.898847,  3, pid=1905] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
>  free_pipe_context: destroying talloc pool of size 22
>[2011/12/15 15:22:54.898878, 10, pid=1905] rpc_server/srv_pipe_hnd.c:788(np_read_recv)
>  Received 48 bytes. There is no more data outstanding
>[2011/12/15 15:22:54.898906,  5, pid=1905] smbd/ipc.c:62(copy_trans_params_and_data)
>  copy_trans_params_and_data: params[0..0] data[0..48] (align 0)
>[2011/12/15 15:22:54.898932,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.898946,  5, pid=1905] lib/util.c:342(show_msg)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=1
>  smb_pid=1776
>  smb_uid=102
>  smb_mid=23808
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2011/12/15 15:22:54.899180, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 05 00 02 03 10 00 00   00 30 00 00 00 02 00 00   ........ .0......
>  [0010] 00 18 00 00 00 00 00 00   00 00 00 00 00 00 00 00   ........ ........
>  [0020] 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00   ........ ........
>  [0030] 00                                                . 
>[2011/12/15 15:22:54.899566, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 41
>[2011/12/15 15:22:54.899607,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x29
>[2011/12/15 15:22:54.899634,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 373 of length 45 (0 toread)
>[2011/12/15 15:22:54.899659,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.899673,  5, pid=1905] lib/util.c:342(show_msg)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=23872
>  smt_wct=3
>  smb_vwv[ 0]= 6073 (0x17B9)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2011/12/15 15:22:54.899837, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>[2011/12/15 15:22:54.899852,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBclose (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.899878,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.899904,  3, pid=1905] smbd/reply.c:4851(reply_close)
>  close fd=-1 fnum=6073 (numopen=1)
>[2011/12/15 15:22:54.899930,  6, pid=1905] smbd/close.c:527(set_close_write_time)
>  close_write_time: Thu Jan  1 00:59:59 1970
>[2011/12/15 15:22:54.899957, 10, pid=1905] rpc_server/rpc_handles.c:307(close_policy_by_pipe)
>  close_policy_by_pipe: deleted handle list for pipe \spoolss
>[2011/12/15 15:22:54.900009,  5, pid=1905] smbd/files.c:464(file_free)
>  freed files structure 6073 (0 used)
>[2011/12/15 15:22:54.900041,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.900056,  5, pid=1905] lib/util.c:342(show_msg)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=23872
>  smt_wct=0
>  smb_bcc=0
>[2011/12/15 15:22:54.900192, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>[2011/12/15 15:22:54.901286, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 100
>[2011/12/15 15:22:54.901328,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x64
>[2011/12/15 15:22:54.901354,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 374 of length 104 (0 toread)
>[2011/12/15 15:22:54.901379,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.901393,  5, pid=1905] lib/util.c:342(show_msg)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=23936
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  256 (0x100)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2011/12/15 15:22:54.901764, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 5C 00 77 00 6B 00 73   00 73 00 76 00 63 00 00   .\.w.k.s .s.v.c..
>  [0010] 00                                                . 
>[2011/12/15 15:22:54.901818,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBntcreateX (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.901844,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.901871, 10, pid=1905] smbd/nttrans.c:505(reply_ntcreate_and_X)
>  reply_ntcreate_and_X: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0, fname = wkssvc
>[2011/12/15 15:22:54.901902,  4, pid=1905] smbd/nttrans.c:293(nt_open_pipe)
>  nt_open_pipe: Opening pipe \wkssvc.
>[2011/12/15 15:22:54.901930,  5, pid=1905] smbd/files.c:126(file_new)
>  allocated file structure 1978, fnum = 6074 (1 used)
>[2011/12/15 15:22:54.901959, 10, pid=1905] smbd/files.c:618(file_name_hash)
>  file_name_hash: /tmp/wkssvc hash 0x2b4dd005
>[2011/12/15 15:22:54.901989,  4, pid=1905] rpc_server/rpc_ncacn_np.c:132(make_internal_rpc_pipe_p)
>  Create pipe requested \wkssvc
>[2011/12/15 15:22:54.902020, 10, pid=1905] rpc_server/rpc_handles.c:116(init_pipe_handles)
>  init_pipe_handle_list: created handle list for pipe \wkssvc
>[2011/12/15 15:22:54.902046, 10, pid=1905] rpc_server/rpc_handles.c:133(init_pipe_handles)
>  init_pipe_handle_list: pipe_handles ref count = 1 for pipe \wkssvc
>[2011/12/15 15:22:54.902080,  4, pid=1905] rpc_server/rpc_ncacn_np.c:176(make_internal_rpc_pipe_p)
>  Created internal pipe \wkssvc (pipes_open=0)
>[2011/12/15 15:22:54.902107,  5, pid=1905] smbd/nttrans.c:382(do_ntcreate_pipe_open)
>  do_ntcreate_pipe_open: open pipe = \wkssvc
>[2011/12/15 15:22:54.902469, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 136
>[2011/12/15 15:22:54.902511,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x88
>[2011/12/15 15:22:54.902537,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 375 of length 140 (0 toread)
>[2011/12/15 15:22:54.902562,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.902576,  5, pid=1905] lib/util.c:342(show_msg)
>  size=136
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=24000
>  smt_wct=14
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 6074 (0x17BA)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=65535 (0xFFFF)
>  smb_vwv[ 6]=65535 (0xFFFF)
>  smb_vwv[ 7]=    8 (0x8)
>  smb_vwv[ 8]=   72 (0x48)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   72 (0x48)
>  smb_vwv[11]=   64 (0x40)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_bcc=73
>[2011/12/15 15:22:54.902849, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] EE 05 00 0B 03 10 00 00   00 48 00 00 00 01 00 00   ........ .H......
>  [0010] 00 B8 10 B8 10 00 00 00   00 01 00 00 00 00 00 01   ........ ........
>  [0020] 00 98 D0 FF 6B 12 A1 10   36 98 33 46 C3 F8 7E 34   ....k... 6.3F..~4
>  [0030] 5A 01 00 00 00 04 5D 88   8A EB 1C C9 11 9F E8 08   Z.....]. ........
>  [0040] 00 2B 10 48 60 02 00 00   00                       .+.H`... .
>[2011/12/15 15:22:54.902968,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBwriteX (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.902994,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.903021,  6, pid=1905] smbd/pipes.c:300(reply_pipe_write_and_X)
>  reply_pipe_write_and_X: 17ba name: wkssvc len: 72
>[2011/12/15 15:22:54.903047,  6, pid=1905] rpc_server/srv_pipe_hnd.c:520(np_write_send)
>  np_write_send: len: 72
>[2011/12/15 15:22:54.903073, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 72
>[2011/12/15 15:22:54.903098, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 72
>[2011/12/15 15:22:54.903123, 10, pid=1905] rpc_server/srv_pipe_hnd.c:50(fill_rpc_header)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2011/12/15 15:22:54.903149, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 16
>[2011/12/15 15:22:54.903173, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 56
>[2011/12/15 15:22:54.903198, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 56
>[2011/12/15 15:22:54.903224, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 0
>[2011/12/15 15:22:54.903248, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 56
>[2011/12/15 15:22:54.903272, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 56, incoming data = 56
>[2011/12/15 15:22:54.903297, 10, pid=1905] rpc_server/srv_pipe.c:1877(process_complete_pdu)
>  PDU is in Little Endian format!
>[2011/12/15 15:22:54.903327,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_BIND (11)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0048 (72)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 11)
>          bind: struct dcerpc_bind
>              max_xmit_frag            : 0x10b8 (4280)
>              max_recv_frag            : 0x10b8 (4280)
>              assoc_group_id           : 0x00000000 (0)
>              num_contexts             : 0x01 (1)
>              ctx_list: ARRAY(1)
>                  ctx_list: struct dcerpc_ctx_list
>                      context_id               : 0x0000 (0)
>                      num_transfer_syntaxes    : 0x01 (1)
>                      abstract_syntax: struct ndr_syntax_id
>                          uuid                     : 6bffd098-a112-3610-9833-46c3f87e345a
>                          if_version               : 0x00000001 (1)
>                      transfer_syntaxes: ARRAY(1)
>                          transfer_syntaxes: struct ndr_syntax_id
>                              uuid                     : 8a885d04-1ceb-11c9-9fe8-08002b104860
>                              if_version               : 0x00000002 (2)
>              auth_info                : DATA_BLOB length=0
>[2011/12/15 15:22:54.903718, 10, pid=1905] rpc_server/srv_pipe.c:1890(process_complete_pdu)
>  Processing packet type 11
>[2011/12/15 15:22:54.903759,  3, pid=1905] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
>  api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\wkssvc
>[2011/12/15 15:22:54.903789,  5, pid=1905] rpc_server/srv_pipe.c:923(api_pipe_bind_req)
>  api_pipe_bind_req: make response. 923
>[2011/12/15 15:22:54.903814,  3, pid=1905] rpc_server/srv_pipe.c:339(check_bind_req)
>  check_bind_req for \wkssvc
>[2011/12/15 15:22:54.903841,  3, pid=1905] rpc_server/srv_pipe.c:346(check_bind_req)
>  check_bind_req: \PIPE\wkssvc -> \PIPE\wkssvc
>[2011/12/15 15:22:54.903875,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       &r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_BIND_ACK (12)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0044 (68)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 12)
>          bind_ack: struct dcerpc_bind_ack
>              max_xmit_frag            : 0x10b8 (4280)
>              max_recv_frag            : 0x10b8 (4280)
>              assoc_group_id           : 0x000053f0 (21488)
>              secondary_address_size   : 0x000d (13)
>              secondary_address        : '\PIPE\wkssvc'
>              _pad1                    : DATA_BLOB length=0
>              num_results              : 0x01 (1)
>              ctx_list: ARRAY(1)
>                  ctx_list: struct dcerpc_ack_ctx
>                      result                   : 0x0000 (0)
>                      reason                   : 0x0000 (0)
>                      syntax: struct ndr_syntax_id
>                          uuid                     : 8a885d04-1ceb-11c9-9fe8-08002b104860
>                          if_version               : 0x00000002 (2)
>              auth_info                : DATA_BLOB length=0
>[2011/12/15 15:22:54.904252, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 56
>[2011/12/15 15:22:54.904286,  3, pid=1905] smbd/pipes.c:361(pipe_write_andx_done)
>  writeX-IPC nwritten=72
>[2011/12/15 15:22:54.904635, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 59
>[2011/12/15 15:22:54.904676,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x3b
>[2011/12/15 15:22:54.904703,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 376 of length 63 (0 toread)
>[2011/12/15 15:22:54.904728,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.904742,  5, pid=1905] lib/util.c:342(show_msg)
>  size=59
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=24064
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 6074 (0x17BA)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]= 1024 (0x400)
>  smb_vwv[ 6]= 1024 (0x400)
>  smb_vwv[ 7]=65535 (0xFFFF)
>  smb_vwv[ 8]=65535 (0xFFFF)
>  smb_vwv[ 9]= 1024 (0x400)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=0
>[2011/12/15 15:22:54.904995, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>[2011/12/15 15:22:54.905011,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBreadX (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.905037,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.905065,  6, pid=1905] rpc_server/srv_pipe_hnd.c:284(read_from_internal_pipe)
>   name: \wkssvc len: 1024
>[2011/12/15 15:22:54.905092, 10, pid=1905] rpc_server/srv_pipe_hnd.c:325(read_from_internal_pipe)
>  read_from_pipe: \wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2011/12/15 15:22:54.905119,  3, pid=1905] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
>  free_pipe_context: destroying talloc pool of size 21
>[2011/12/15 15:22:54.905150, 10, pid=1905] rpc_server/srv_pipe_hnd.c:788(np_read_recv)
>  Received 68 bytes. There is no more data outstanding
>[2011/12/15 15:22:54.905177,  3, pid=1905] smbd/pipes.c:485(pipe_read_andx_done)
>  readX-IPC min=1024 max=1024 nread=68
>[2011/12/15 15:22:54.905464, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 156
>[2011/12/15 15:22:54.905506,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x9c
>[2011/12/15 15:22:54.905533,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 377 of length 160 (0 toread)
>[2011/12/15 15:22:54.905557,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.905572,  5, pid=1905] lib/util.c:342(show_msg)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=24129
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]= 6074 (0x17BA)
>  smb_bcc=89
>[2011/12/15 15:22:54.905863, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 5C 00 50 00 49 00 50   00 45 00 5C 00 00 00 00   .\.P.I.P .E.\....
>  [0010] 00 05 00 00 03 10 00 00   00 48 00 00 00 01 00 00   ........ .H......
>  [0020] 00 30 00 00 00 00 00 00   00 00 00 02 00 0D 00 00   .0...... ........
>  [0030] 00 00 00 00 00 0D 00 00   00 5C 00 5C 00 31 00 30   ........ .\.\.1.0
>  [0040] 00 2E 00 31 00 2E 00 30   00 2E 00 31 00 30 00 32   ...1...0 ...1.0.2
>  [0050] 00 00 00 48 60 64 00 00   00                       ...H`d.. .
>[2011/12/15 15:22:54.906003,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBtrans (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.906029,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.906058,  3, pid=1905] smbd/ipc.c:560(handle_trans)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2011/12/15 15:22:54.906085,  5, pid=1905] smbd/ipc.c:593(handle_trans)
>  calling named_pipe
>[2011/12/15 15:22:54.906110,  3, pid=1905] smbd/ipc.c:511(named_pipe)
>  named pipe command on <> name
>[2011/12/15 15:22:54.906134,  5, pid=1905] smbd/ipc.c:434(api_fd_reply)
>  api_fd_reply
>[2011/12/15 15:22:54.906159,  3, pid=1905] smbd/ipc.c:475(api_fd_reply)
>  Got API command 0x26 on pipe "wkssvc" (pnum 17ba)
>[2011/12/15 15:22:54.906184, 10, pid=1905] smbd/ipc.c:477(api_fd_reply)
>  api_fd_reply: p:8bb4ea8 max_trans_reply: 1024
>[2011/12/15 15:22:54.906210,  6, pid=1905] rpc_server/srv_pipe_hnd.c:520(np_write_send)
>  np_write_send: len: 72
>[2011/12/15 15:22:54.906235, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 72
>[2011/12/15 15:22:54.906260, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 72
>[2011/12/15 15:22:54.906285, 10, pid=1905] rpc_server/srv_pipe_hnd.c:50(fill_rpc_header)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2011/12/15 15:22:54.906310, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 16
>[2011/12/15 15:22:54.906342, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 56
>[2011/12/15 15:22:54.906367, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 56
>[2011/12/15 15:22:54.906393, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 0
>[2011/12/15 15:22:54.906417, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 56
>[2011/12/15 15:22:54.906441, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 56, incoming data = 56
>[2011/12/15 15:22:54.906466, 10, pid=1905] rpc_server/srv_pipe.c:1877(process_complete_pdu)
>  PDU is in Little Endian format!
>[2011/12/15 15:22:54.906495,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_REQUEST (0)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0048 (72)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 0)
>          request: struct dcerpc_request
>              alloc_hint               : 0x00000030 (48)
>              context_id               : 0x0000 (0)
>              opnum                    : 0x0000 (0)
>              object                   : union dcerpc_object(case 0)
>              empty: struct dcerpc_empty
>              _pad                     : DATA_BLOB length=0
>              stub_and_verifier        : DATA_BLOB length=48
>  [0000] 00 00 02 00 0D 00 00 00   00 00 00 00 0D 00 00 00   ........ ........
>  [0010] 5C 00 5C 00 31 00 30 00   2E 00 31 00 2E 00 30 00   \.\.1.0. ..1...0.
>  [0020] 2E 00 31 00 30 00 32 00   00 00 48 60 64 00 00 00   ..1.0.2. ..H`d...
>[2011/12/15 15:22:54.906858, 10, pid=1905] rpc_server/srv_pipe.c:1890(process_complete_pdu)
>  Processing packet type 0
>[2011/12/15 15:22:54.906883, 10, pid=1905] rpc_server/srv_pipe.c:1734(dcesrv_auth_request)
>  Checking request auth.
>[2011/12/15 15:22:54.906908,  5, pid=1905] rpc_server/srv_pipe.c:1571(api_pipe_request)
>  Requested \PIPE\\wkssvc
>[2011/12/15 15:22:54.906935,  4, pid=1905] rpc_server/srv_pipe.c:1611(api_rpcTNP)
>  api_rpcTNP: \wkssvc op 0x0 - api_rpcTNP: rpc command: WKSSVC_NETWKSTAGETINFO
>[2011/12/15 15:22:54.906962,  6, pid=1905] rpc_server/srv_pipe.c:1645(api_rpcTNP)
>  api_rpc_cmds[0].fn == 83723e4
>[2011/12/15 15:22:54.906996,  1, pid=1905] ../librpc/ndr/ndr.c:284(ndr_print_function_debug)
>       wkssvc_NetWkstaGetInfo: struct wkssvc_NetWkstaGetInfo
>          in: struct wkssvc_NetWkstaGetInfo
>              server_name              : *
>                  server_name              : '\\10.1.0.102'
>              level                    : 0x00000064 (100)
>[2011/12/15 15:22:54.907082,  1, pid=1905] ../librpc/ndr/ndr.c:284(ndr_print_function_debug)
>       wkssvc_NetWkstaGetInfo: struct wkssvc_NetWkstaGetInfo
>          out: struct wkssvc_NetWkstaGetInfo
>              info                     : *
>                  info                     : union wkssvc_NetWkstaInfo(case 100)
>                  info100                  : *
>                      info100: struct wkssvc_NetWkstaInfo100
>                          platform_id              : PLATFORM_ID_NT (500)
>                          server_name              : *
>                              server_name              : 'SUPERNOVA2'
>                          domain_name              : *
>                              domain_name              : 'CIRCULAR'
>                          version_major            : 0x00000004 (4)
>                          version_minor            : 0x00000009 (9)
>              result                   : WERR_OK
>[2011/12/15 15:22:54.907280,  5, pid=1905] rpc_server/srv_pipe.c:1679(api_rpcTNP)
>  api_rpcTNP: called \wkssvc successfully
>[2011/12/15 15:22:54.907310, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 56
>[2011/12/15 15:22:54.907344,  6, pid=1905] rpc_server/srv_pipe_hnd.c:284(read_from_internal_pipe)
>   name: \wkssvc len: 1024
>[2011/12/15 15:22:54.907372, 10, pid=1905] rpc_server/srv_pipe_hnd.c:346(read_from_internal_pipe)
>  read_from_pipe: \wkssvc: fault_state = 0 : data_sent_length = 0, p->out_data.rdata.length = 100.
>[2011/12/15 15:22:54.907404,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       &r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_RESPONSE (2)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x007c (124)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 2)
>          response: struct dcerpc_response
>              alloc_hint               : 0x00000064 (100)
>              context_id               : 0x0000 (0)
>              cancel_count             : 0x00 (0)
>              _pad                     : DATA_BLOB length=0
>              stub_and_verifier        : DATA_BLOB length=100
>  [0000] 64 00 00 00 04 00 02 00   F4 01 00 00 08 00 02 00   d....... ........
>  [0010] 0C 00 02 00 04 00 00 00   09 00 00 00 0B 00 00 00   ........ ........
>  [0020] 00 00 00 00 0B 00 00 00   53 00 55 00 50 00 45 00   ........ S.U.P.E.
>  [0030] 52 00 4E 00 4F 00 56 00   41 00 32 00 00 00 00 00   R.N.O.V. A.2.....
>  [0040] 09 00 00 00 00 00 00 00   09 00 00 00 43 00 49 00   ........ ....C.I.
>  [0050] 52 00 43 00 55 00 4C 00   41 00 52 00 00 00 00 00   R.C.U.L. A.R.....
>  [0060] 00 00 00 00                                       .... 
>[2011/12/15 15:22:54.907850,  3, pid=1905] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
>  free_pipe_context: destroying talloc pool of size 61
>[2011/12/15 15:22:54.907881, 10, pid=1905] rpc_server/srv_pipe_hnd.c:788(np_read_recv)
>  Received 124 bytes. There is no more data outstanding
>[2011/12/15 15:22:54.907908,  5, pid=1905] smbd/ipc.c:62(copy_trans_params_and_data)
>  copy_trans_params_and_data: params[0..0] data[0..124] (align 0)
>[2011/12/15 15:22:54.907934,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.907948,  5, pid=1905] lib/util.c:342(show_msg)
>  size=180
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=1
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=24129
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  124 (0x7C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  124 (0x7C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=125
>[2011/12/15 15:22:54.908181, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 05 00 02 03 10 00 00   00 7C 00 00 00 01 00 00   ........ .|......
>  [0010] 00 64 00 00 00 00 00 00   00 64 00 00 00 04 00 02   .d...... .d......
>  [0020] 00 F4 01 00 00 08 00 02   00 0C 00 02 00 04 00 00   ........ ........
>  [0030] 00 09 00 00 00 0B 00 00   00 00 00 00 00 0B 00 00   ........ ........
>  [0040] 00 53 00 55 00 50 00 45   00 52 00 4E 00 4F 00 56   .S.U.P.E .R.N.O.V
>  [0050] 00 41 00 32 00 00 00 00   00 09 00 00 00 00 00 00   .A.2.... ........
>  [0060] 00 09 00 00 00 43 00 49   00 52 00 43 00 55 00 4C   .....C.I .R.C.U.L
>  [0070] 00 41 00 52 00 00 00 00   00 00 00 00 00           .A.R.... .....
>[2011/12/15 15:22:54.908660, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 41
>[2011/12/15 15:22:54.908701,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x29
>[2011/12/15 15:22:54.908728,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 378 of length 45 (0 toread)
>[2011/12/15 15:22:54.908753,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.908767,  5, pid=1905] lib/util.c:342(show_msg)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=24193
>  smt_wct=3
>  smb_vwv[ 0]= 6074 (0x17BA)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2011/12/15 15:22:54.908930, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>[2011/12/15 15:22:54.908946,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBclose (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.908972,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.908998,  3, pid=1905] smbd/reply.c:4851(reply_close)
>  close fd=-1 fnum=6074 (numopen=1)
>[2011/12/15 15:22:54.909024,  6, pid=1905] smbd/close.c:527(set_close_write_time)
>  close_write_time: Thu Jan  1 00:59:59 1970
>[2011/12/15 15:22:54.909051, 10, pid=1905] rpc_server/rpc_handles.c:307(close_policy_by_pipe)
>  close_policy_by_pipe: deleted handle list for pipe \wkssvc
>[2011/12/15 15:22:54.909081,  5, pid=1905] smbd/files.c:464(file_free)
>  freed files structure 6074 (0 used)
>[2011/12/15 15:22:54.909109,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.909124,  5, pid=1905] lib/util.c:342(show_msg)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=24193
>  smt_wct=0
>  smb_bcc=0
>[2011/12/15 15:22:54.909258, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>[2011/12/15 15:22:54.909722, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 100
>[2011/12/15 15:22:54.909764,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x64
>[2011/12/15 15:22:54.909790,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 379 of length 104 (0 toread)
>[2011/12/15 15:22:54.909815,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.909829,  5, pid=1905] lib/util.c:342(show_msg)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=24257
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2011/12/15 15:22:54.910239, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 5C 00 73 00 72 00 76   00 73 00 76 00 63 00 00   .\.s.r.v .s.v.c..
>  [0010] 00                                                . 
>[2011/12/15 15:22:54.910296,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBntcreateX (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.910323,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.910350, 10, pid=1905] smbd/nttrans.c:505(reply_ntcreate_and_X)
>  reply_ntcreate_and_X: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0, fname = srvsvc
>[2011/12/15 15:22:54.910380,  4, pid=1905] smbd/nttrans.c:293(nt_open_pipe)
>  nt_open_pipe: Opening pipe \srvsvc.
>[2011/12/15 15:22:54.910409,  5, pid=1905] smbd/files.c:126(file_new)
>  allocated file structure 1979, fnum = 6075 (1 used)
>[2011/12/15 15:22:54.910437, 10, pid=1905] smbd/files.c:618(file_name_hash)
>  file_name_hash: /tmp/srvsvc hash 0x8e98a76a
>[2011/12/15 15:22:54.910467,  4, pid=1905] rpc_server/rpc_ncacn_np.c:132(make_internal_rpc_pipe_p)
>  Create pipe requested \srvsvc
>[2011/12/15 15:22:54.910497, 10, pid=1905] rpc_server/rpc_handles.c:116(init_pipe_handles)
>  init_pipe_handle_list: created handle list for pipe \srvsvc
>[2011/12/15 15:22:54.910523, 10, pid=1905] rpc_server/rpc_handles.c:133(init_pipe_handles)
>  init_pipe_handle_list: pipe_handles ref count = 1 for pipe \srvsvc
>[2011/12/15 15:22:54.910556,  4, pid=1905] rpc_server/rpc_ncacn_np.c:176(make_internal_rpc_pipe_p)
>  Created internal pipe \srvsvc (pipes_open=0)
>[2011/12/15 15:22:54.910584,  5, pid=1905] smbd/nttrans.c:382(do_ntcreate_pipe_open)
>  do_ntcreate_pipe_open: open pipe = \srvsvc
>[2011/12/15 15:22:54.910938, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 136
>[2011/12/15 15:22:54.910980,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x88
>[2011/12/15 15:22:54.911007,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 380 of length 140 (0 toread)
>[2011/12/15 15:22:54.911032,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.911046,  5, pid=1905] lib/util.c:342(show_msg)
>  size=136
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=24321
>  smt_wct=14
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 6075 (0x17BB)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=65535 (0xFFFF)
>  smb_vwv[ 6]=65535 (0xFFFF)
>  smb_vwv[ 7]=    8 (0x8)
>  smb_vwv[ 8]=   72 (0x48)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   72 (0x48)
>  smb_vwv[11]=   64 (0x40)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_bcc=73
>[2011/12/15 15:22:54.911317, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] EE 05 00 0B 03 10 00 00   00 48 00 00 00 01 00 00   ........ .H......
>  [0010] 00 B8 10 B8 10 00 00 00   00 01 00 00 00 00 00 01   ........ ........
>  [0020] 00 C8 4F 32 4B 70 16 D3   01 12 78 5A 47 BF 6E E1   ..O2Kp.. ..xZG.n.
>  [0030] 88 03 00 00 00 04 5D 88   8A EB 1C C9 11 9F E8 08   ......]. ........
>  [0040] 00 2B 10 48 60 02 00 00   00                       .+.H`... .
>[2011/12/15 15:22:54.911438,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBwriteX (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.911464,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.911490,  6, pid=1905] smbd/pipes.c:300(reply_pipe_write_and_X)
>  reply_pipe_write_and_X: 17bb name: srvsvc len: 72
>[2011/12/15 15:22:54.911517,  6, pid=1905] rpc_server/srv_pipe_hnd.c:520(np_write_send)
>  np_write_send: len: 72
>[2011/12/15 15:22:54.911542, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 72
>[2011/12/15 15:22:54.911567, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 72
>[2011/12/15 15:22:54.911592, 10, pid=1905] rpc_server/srv_pipe_hnd.c:50(fill_rpc_header)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2011/12/15 15:22:54.911618, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 16
>[2011/12/15 15:22:54.911642, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 56
>[2011/12/15 15:22:54.911667, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 56
>[2011/12/15 15:22:54.911693, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 0
>[2011/12/15 15:22:54.911717, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 56
>[2011/12/15 15:22:54.911741, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 56, incoming data = 56
>[2011/12/15 15:22:54.911766, 10, pid=1905] rpc_server/srv_pipe.c:1877(process_complete_pdu)
>  PDU is in Little Endian format!
>[2011/12/15 15:22:54.911796,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_BIND (11)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0048 (72)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 11)
>          bind: struct dcerpc_bind
>              max_xmit_frag            : 0x10b8 (4280)
>              max_recv_frag            : 0x10b8 (4280)
>              assoc_group_id           : 0x00000000 (0)
>              num_contexts             : 0x01 (1)
>              ctx_list: ARRAY(1)
>                  ctx_list: struct dcerpc_ctx_list
>                      context_id               : 0x0000 (0)
>                      num_transfer_syntaxes    : 0x01 (1)
>                      abstract_syntax: struct ndr_syntax_id
>                          uuid                     : 4b324fc8-1670-01d3-1278-5a47bf6ee188
>                          if_version               : 0x00000003 (3)
>                      transfer_syntaxes: ARRAY(1)
>                          transfer_syntaxes: struct ndr_syntax_id
>                              uuid                     : 8a885d04-1ceb-11c9-9fe8-08002b104860
>                              if_version               : 0x00000002 (2)
>              auth_info                : DATA_BLOB length=0
>[2011/12/15 15:22:54.912186, 10, pid=1905] rpc_server/srv_pipe.c:1890(process_complete_pdu)
>  Processing packet type 11
>[2011/12/15 15:22:54.912212,  3, pid=1905] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
>  api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\srvsvc
>[2011/12/15 15:22:54.912237,  5, pid=1905] rpc_server/srv_pipe.c:923(api_pipe_bind_req)
>  api_pipe_bind_req: make response. 923
>[2011/12/15 15:22:54.912261,  3, pid=1905] rpc_server/srv_pipe.c:339(check_bind_req)
>  check_bind_req for \srvsvc
>[2011/12/15 15:22:54.912288,  3, pid=1905] rpc_server/srv_pipe.c:346(check_bind_req)
>  check_bind_req: \PIPE\srvsvc -> \PIPE\srvsvc
>[2011/12/15 15:22:54.912320,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       &r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_BIND_ACK (12)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0044 (68)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 12)
>          bind_ack: struct dcerpc_bind_ack
>              max_xmit_frag            : 0x10b8 (4280)
>              max_recv_frag            : 0x10b8 (4280)
>              assoc_group_id           : 0x000053f0 (21488)
>              secondary_address_size   : 0x000d (13)
>              secondary_address        : '\PIPE\srvsvc'
>              _pad1                    : DATA_BLOB length=0
>              num_results              : 0x01 (1)
>              ctx_list: ARRAY(1)
>                  ctx_list: struct dcerpc_ack_ctx
>                      result                   : 0x0000 (0)
>                      reason                   : 0x0000 (0)
>                      syntax: struct ndr_syntax_id
>                          uuid                     : 8a885d04-1ceb-11c9-9fe8-08002b104860
>                          if_version               : 0x00000002 (2)
>              auth_info                : DATA_BLOB length=0
>[2011/12/15 15:22:54.912695, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 56
>[2011/12/15 15:22:54.912728,  3, pid=1905] smbd/pipes.c:361(pipe_write_andx_done)
>  writeX-IPC nwritten=72
>[2011/12/15 15:22:54.913046, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 59
>[2011/12/15 15:22:54.913087,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x3b
>[2011/12/15 15:22:54.913114,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 381 of length 63 (0 toread)
>[2011/12/15 15:22:54.913139,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.913153,  5, pid=1905] lib/util.c:342(show_msg)
>  size=59
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=24385
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 6075 (0x17BB)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]= 1024 (0x400)
>  smb_vwv[ 6]= 1024 (0x400)
>  smb_vwv[ 7]=65535 (0xFFFF)
>  smb_vwv[ 8]=65535 (0xFFFF)
>  smb_vwv[ 9]= 1024 (0x400)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=0
>[2011/12/15 15:22:54.913405, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>[2011/12/15 15:22:54.913421,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBreadX (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.913447,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.913475,  6, pid=1905] rpc_server/srv_pipe_hnd.c:284(read_from_internal_pipe)
>   name: \srvsvc len: 1024
>[2011/12/15 15:22:54.913502, 10, pid=1905] rpc_server/srv_pipe_hnd.c:325(read_from_internal_pipe)
>  read_from_pipe: \srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2011/12/15 15:22:54.913529,  3, pid=1905] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
>  free_pipe_context: destroying talloc pool of size 21
>[2011/12/15 15:22:54.913560, 10, pid=1905] rpc_server/srv_pipe_hnd.c:788(np_read_recv)
>  Received 68 bytes. There is no more data outstanding
>[2011/12/15 15:22:54.913587,  3, pid=1905] smbd/pipes.c:485(pipe_read_andx_done)
>  readX-IPC min=1024 max=1024 nread=68
>[2011/12/15 15:22:54.913886, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 156
>[2011/12/15 15:22:54.913928,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x9c
>[2011/12/15 15:22:54.913955,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 382 of length 160 (0 toread)
>[2011/12/15 15:22:54.913980,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.913994,  5, pid=1905] lib/util.c:342(show_msg)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=24449
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]= 6075 (0x17BB)
>  smb_bcc=89
>[2011/12/15 15:22:54.914284, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 5C 00 50 00 49 00 50   00 45 00 5C 00 00 00 00   .\.P.I.P .E.\....
>  [0010] 00 05 00 00 03 10 00 00   00 48 00 00 00 01 00 00   ........ .H......
>  [0020] 00 30 00 00 00 00 00 15   00 00 00 02 00 0D 00 00   .0...... ........
>  [0030] 00 00 00 00 00 0D 00 00   00 5C 00 5C 00 31 00 30   ........ .\.\.1.0
>  [0040] 00 2E 00 31 00 2E 00 30   00 2E 00 31 00 30 00 32   ...1...0 ...1.0.2
>  [0050] 00 00 00 48 60 65 00 00   00                       ...H`e.. .
>[2011/12/15 15:22:54.914425,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBtrans (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.914452,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.914481,  3, pid=1905] smbd/ipc.c:560(handle_trans)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2011/12/15 15:22:54.914508,  5, pid=1905] smbd/ipc.c:593(handle_trans)
>  calling named_pipe
>[2011/12/15 15:22:54.914532,  3, pid=1905] smbd/ipc.c:511(named_pipe)
>  named pipe command on <> name
>[2011/12/15 15:22:54.914557,  5, pid=1905] smbd/ipc.c:434(api_fd_reply)
>  api_fd_reply
>[2011/12/15 15:22:54.914581,  3, pid=1905] smbd/ipc.c:475(api_fd_reply)
>  Got API command 0x26 on pipe "srvsvc" (pnum 17bb)
>[2011/12/15 15:22:54.914606, 10, pid=1905] smbd/ipc.c:477(api_fd_reply)
>  api_fd_reply: p:8bb4ea8 max_trans_reply: 1024
>[2011/12/15 15:22:54.914631,  6, pid=1905] rpc_server/srv_pipe_hnd.c:520(np_write_send)
>  np_write_send: len: 72
>[2011/12/15 15:22:54.914657, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 72
>[2011/12/15 15:22:54.914681, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 72
>[2011/12/15 15:22:54.914706, 10, pid=1905] rpc_server/srv_pipe_hnd.c:50(fill_rpc_header)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2011/12/15 15:22:54.914732, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 16
>[2011/12/15 15:22:54.914756, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 56
>[2011/12/15 15:22:54.914780, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 56
>[2011/12/15 15:22:54.914806, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 0
>[2011/12/15 15:22:54.914830, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 56
>[2011/12/15 15:22:54.914854, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 56, incoming data = 56
>[2011/12/15 15:22:54.914879, 10, pid=1905] rpc_server/srv_pipe.c:1877(process_complete_pdu)
>  PDU is in Little Endian format!
>[2011/12/15 15:22:54.914908,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_REQUEST (0)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0048 (72)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 0)
>          request: struct dcerpc_request
>              alloc_hint               : 0x00000030 (48)
>              context_id               : 0x0000 (0)
>              opnum                    : 0x0015 (21)
>              object                   : union dcerpc_object(case 0)
>              empty: struct dcerpc_empty
>              _pad                     : DATA_BLOB length=0
>              stub_and_verifier        : DATA_BLOB length=48
>  [0000] 00 00 02 00 0D 00 00 00   00 00 00 00 0D 00 00 00   ........ ........
>  [0010] 5C 00 5C 00 31 00 30 00   2E 00 31 00 2E 00 30 00   \.\.1.0. ..1...0.
>  [0020] 2E 00 31 00 30 00 32 00   00 00 48 60 65 00 00 00   ..1.0.2. ..H`e...
>[2011/12/15 15:22:54.915270, 10, pid=1905] rpc_server/srv_pipe.c:1890(process_complete_pdu)
>  Processing packet type 0
>[2011/12/15 15:22:54.915296, 10, pid=1905] rpc_server/srv_pipe.c:1734(dcesrv_auth_request)
>  Checking request auth.
>[2011/12/15 15:22:54.915321,  5, pid=1905] rpc_server/srv_pipe.c:1571(api_pipe_request)
>  Requested \PIPE\\srvsvc
>[2011/12/15 15:22:54.915347,  4, pid=1905] rpc_server/srv_pipe.c:1611(api_rpcTNP)
>  api_rpcTNP: \srvsvc op 0x15 - api_rpcTNP: rpc command: SRVSVC_NETSRVGETINFO
>[2011/12/15 15:22:54.915375,  6, pid=1905] rpc_server/srv_pipe.c:1645(api_rpcTNP)
>  api_rpc_cmds[21].fn == 83b1837
>[2011/12/15 15:22:54.915404,  1, pid=1905] ../librpc/ndr/ndr.c:284(ndr_print_function_debug)
>       srvsvc_NetSrvGetInfo: struct srvsvc_NetSrvGetInfo
>          in: struct srvsvc_NetSrvGetInfo
>              server_unc               : *
>                  server_unc               : '\\10.1.0.102'
>              level                    : 0x00000065 (101)
>[2011/12/15 15:22:54.915480,  5, pid=1905] rpc_server/srvsvc/srv_srvsvc_nt.c:1125(_srvsvc_NetSrvGetInfo)
>  _srvsvc_NetSrvGetInfo: 1125
>[2011/12/15 15:22:54.915508,  5, pid=1905] rpc_server/srvsvc/srv_srvsvc_nt.c:1203(_srvsvc_NetSrvGetInfo)
>  _srvsvc_NetSrvGetInfo: 1203
>[2011/12/15 15:22:54.915533,  1, pid=1905] ../librpc/ndr/ndr.c:284(ndr_print_function_debug)
>       srvsvc_NetSrvGetInfo: struct srvsvc_NetSrvGetInfo
>          out: struct srvsvc_NetSrvGetInfo
>              info                     : *
>                  info                     : union srvsvc_NetSrvInfo(case 101)
>                  info101                  : *
>                      info101: struct srvsvc_NetSrvInfo101
>                          platform_id              : PLATFORM_ID_NT (500)
>                          server_name              : *
>                              server_name              : 'SUPERNOVA2'
>                          version_major            : 0x00000004 (4)
>                          version_minor            : 0x00000009 (9)
>                          server_type              : 0x00809a33 (8428083)
>                                 1: SV_TYPE_WORKSTATION      
>                                 1: SV_TYPE_SERVER           
>                                 0: SV_TYPE_SQLSERVER        
>                                 0: SV_TYPE_DOMAIN_CTRL      
>                                 1: SV_TYPE_DOMAIN_BAKCTRL   
>                                 1: SV_TYPE_TIME_SOURCE      
>                                 0: SV_TYPE_AFP              
>                                 0: SV_TYPE_NOVELL           
>                                 0: SV_TYPE_DOMAIN_MEMBER    
>                                 1: SV_TYPE_PRINTQ_SERVER    
>                                 0: SV_TYPE_DIALIN_SERVER    
>                                 1: SV_TYPE_SERVER_UNIX      
>                                 1: SV_TYPE_NT               
>                                 0: SV_TYPE_WFW              
>                                 0: SV_TYPE_SERVER_MFPN      
>                                 1: SV_TYPE_SERVER_NT        
>                                 0: SV_TYPE_POTENTIAL_BROWSER
>                                 0: SV_TYPE_BACKUP_BROWSER   
>                                 0: SV_TYPE_MASTER_BROWSER   
>                                 0: SV_TYPE_DOMAIN_MASTER    
>                                 0: SV_TYPE_SERVER_OSF       
>                                 0: SV_TYPE_SERVER_VMS       
>                                 0: SV_TYPE_WIN95_PLUS       
>                                 1: SV_TYPE_DFS_SERVER       
>                                 0: SV_TYPE_ALTERNATE_XPORT  
>                                 0: SV_TYPE_LOCAL_LIST_ONLY  
>                                 0: SV_TYPE_DOMAIN_ENUM      
>                          comment                  : *
>                              comment                  : 'SAMBA LDAP PDC'
>              result                   : WERR_OK
>[2011/12/15 15:22:54.916083,  5, pid=1905] rpc_server/srv_pipe.c:1679(api_rpcTNP)
>  api_rpcTNP: called \srvsvc successfully
>[2011/12/15 15:22:54.916114, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 56
>[2011/12/15 15:22:54.916148,  6, pid=1905] rpc_server/srv_pipe_hnd.c:284(read_from_internal_pipe)
>   name: \srvsvc len: 1024
>[2011/12/15 15:22:54.916176, 10, pid=1905] rpc_server/srv_pipe_hnd.c:346(read_from_internal_pipe)
>  read_from_pipe: \srvsvc: fault_state = 0 : data_sent_length = 0, p->out_data.rdata.length = 116.
>[2011/12/15 15:22:54.916207,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       &r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_RESPONSE (2)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x008c (140)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 2)
>          response: struct dcerpc_response
>              alloc_hint               : 0x00000074 (116)
>              context_id               : 0x0000 (0)
>              cancel_count             : 0x00 (0)
>              _pad                     : DATA_BLOB length=0
>              stub_and_verifier        : DATA_BLOB length=116
>  [0000] 65 00 00 00 04 00 02 00   F4 01 00 00 08 00 02 00   e....... ........
>  [0010] 04 00 00 00 09 00 00 00   33 9A 80 00 0C 00 02 00   ........ 3.......
>  [0020] 0B 00 00 00 00 00 00 00   0B 00 00 00 53 00 55 00   ........ ....S.U.
>  [0030] 50 00 45 00 52 00 4E 00   4F 00 56 00 41 00 32 00   P.E.R.N. O.V.A.2.
>  [0040] 00 00 00 00 0F 00 00 00   00 00 00 00 0F 00 00 00   ........ ........
>  [0050] 53 00 41 00 4D 00 42 00   41 00 20 00 4C 00 44 00   S.A.M.B. A. .L.D.
>  [0060] 41 00 50 00 20 00 50 00   44 00 43 00 00 00 00 00   A.P. .P. D.C.....
>  [0070] 00 00 00 00                                       .... 
>[2011/12/15 15:22:54.916681,  3, pid=1905] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
>  free_pipe_context: destroying talloc pool of size 45
>[2011/12/15 15:22:54.916712, 10, pid=1905] rpc_server/srv_pipe_hnd.c:788(np_read_recv)
>  Received 140 bytes. There is no more data outstanding
>[2011/12/15 15:22:54.916739,  5, pid=1905] smbd/ipc.c:62(copy_trans_params_and_data)
>  copy_trans_params_and_data: params[0..0] data[0..140] (align 0)
>[2011/12/15 15:22:54.916765,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.916779,  5, pid=1905] lib/util.c:342(show_msg)
>  size=196
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=1
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=24449
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  140 (0x8C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  140 (0x8C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=141
>[2011/12/15 15:22:54.917011, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 05 00 02 03 10 00 00   00 8C 00 00 00 01 00 00   ........ ........
>  [0010] 00 74 00 00 00 00 00 00   00 65 00 00 00 04 00 02   .t...... .e......
>  [0020] 00 F4 01 00 00 08 00 02   00 04 00 00 00 09 00 00   ........ ........
>  [0030] 00 33 9A 80 00 0C 00 02   00 0B 00 00 00 00 00 00   .3...... ........
>  [0040] 00 0B 00 00 00 53 00 55   00 50 00 45 00 52 00 4E   .....S.U .P.E.R.N
>  [0050] 00 4F 00 56 00 41 00 32   00 00 00 00 00 0F 00 00   .O.V.A.2 ........
>  [0060] 00 00 00 00 00 0F 00 00   00 53 00 41 00 4D 00 42   ........ .S.A.M.B
>  [0070] 00 41 00 20 00 4C 00 44   00 41 00 50 00 20 00 50   .A. .L.D .A.P. .P
>  [0080] 00 44 00 43 00 00 00 00   00 00 00 00 00           .D.C.... .....
>[2011/12/15 15:22:54.917496, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 41
>[2011/12/15 15:22:54.917537,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x29
>[2011/12/15 15:22:54.917564,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 383 of length 45 (0 toread)
>[2011/12/15 15:22:54.917589,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.917603,  5, pid=1905] lib/util.c:342(show_msg)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=24513
>  smt_wct=3
>  smb_vwv[ 0]= 6075 (0x17BB)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2011/12/15 15:22:54.917768, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>[2011/12/15 15:22:54.917783,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBclose (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.917809,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.917835,  3, pid=1905] smbd/reply.c:4851(reply_close)
>  close fd=-1 fnum=6075 (numopen=1)
>[2011/12/15 15:22:54.917861,  6, pid=1905] smbd/close.c:527(set_close_write_time)
>  close_write_time: Thu Jan  1 00:59:59 1970
>[2011/12/15 15:22:54.917888, 10, pid=1905] rpc_server/rpc_handles.c:307(close_policy_by_pipe)
>  close_policy_by_pipe: deleted handle list for pipe \srvsvc
>[2011/12/15 15:22:54.917918,  5, pid=1905] smbd/files.c:464(file_free)
>  freed files structure 6075 (0 used)
>[2011/12/15 15:22:54.917947,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.917962,  5, pid=1905] lib/util.c:342(show_msg)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=24513
>  smt_wct=0
>  smb_bcc=0
>[2011/12/15 15:22:54.918096, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>[2011/12/15 15:22:54.918597, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 100
>[2011/12/15 15:22:54.918639,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x64
>[2011/12/15 15:22:54.918665,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 384 of length 104 (0 toread)
>[2011/12/15 15:22:54.918690,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.918704,  5, pid=1905] lib/util.c:342(show_msg)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=24577
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  256 (0x100)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2011/12/15 15:22:54.919076, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 5C 00 77 00 6B 00 73   00 73 00 76 00 63 00 00   .\.w.k.s .s.v.c..
>  [0010] 00                                                . 
>[2011/12/15 15:22:54.919130,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBntcreateX (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.919157,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.919185, 10, pid=1905] smbd/nttrans.c:505(reply_ntcreate_and_X)
>  reply_ntcreate_and_X: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0, fname = wkssvc
>[2011/12/15 15:22:54.919215,  4, pid=1905] smbd/nttrans.c:293(nt_open_pipe)
>  nt_open_pipe: Opening pipe \wkssvc.
>[2011/12/15 15:22:54.919243,  5, pid=1905] smbd/files.c:126(file_new)
>  allocated file structure 1980, fnum = 6076 (1 used)
>[2011/12/15 15:22:54.919272, 10, pid=1905] smbd/files.c:618(file_name_hash)
>  file_name_hash: /tmp/wkssvc hash 0x2b4dd005
>[2011/12/15 15:22:54.919302,  4, pid=1905] rpc_server/rpc_ncacn_np.c:132(make_internal_rpc_pipe_p)
>  Create pipe requested \wkssvc
>[2011/12/15 15:22:54.919332, 10, pid=1905] rpc_server/rpc_handles.c:116(init_pipe_handles)
>  init_pipe_handle_list: created handle list for pipe \wkssvc
>[2011/12/15 15:22:54.919358, 10, pid=1905] rpc_server/rpc_handles.c:133(init_pipe_handles)
>  init_pipe_handle_list: pipe_handles ref count = 1 for pipe \wkssvc
>[2011/12/15 15:22:54.919392,  4, pid=1905] rpc_server/rpc_ncacn_np.c:176(make_internal_rpc_pipe_p)
>  Created internal pipe \wkssvc (pipes_open=0)
>[2011/12/15 15:22:54.919419,  5, pid=1905] smbd/nttrans.c:382(do_ntcreate_pipe_open)
>  do_ntcreate_pipe_open: open pipe = \wkssvc
>[2011/12/15 15:22:54.919776, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 136
>[2011/12/15 15:22:54.919818,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x88
>[2011/12/15 15:22:54.919845,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 385 of length 140 (0 toread)
>[2011/12/15 15:22:54.919870,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.919884,  5, pid=1905] lib/util.c:342(show_msg)
>  size=136
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=24641
>  smt_wct=14
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 6076 (0x17BC)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=65535 (0xFFFF)
>  smb_vwv[ 6]=65535 (0xFFFF)
>  smb_vwv[ 7]=    8 (0x8)
>  smb_vwv[ 8]=   72 (0x48)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   72 (0x48)
>  smb_vwv[11]=   64 (0x40)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_bcc=73
>[2011/12/15 15:22:54.920184, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] EE 05 00 0B 03 10 00 00   00 48 00 00 00 01 00 00   ........ .H......
>  [0010] 00 B8 10 B8 10 00 00 00   00 01 00 00 00 00 00 01   ........ ........
>  [0020] 00 98 D0 FF 6B 12 A1 10   36 98 33 46 C3 F8 7E 34   ....k... 6.3F..~4
>  [0030] 5A 01 00 00 00 04 5D 88   8A EB 1C C9 11 9F E8 08   Z.....]. ........
>  [0040] 00 2B 10 48 60 02 00 00   00                       .+.H`... .
>[2011/12/15 15:22:54.920306,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBwriteX (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.920333,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.920360,  6, pid=1905] smbd/pipes.c:300(reply_pipe_write_and_X)
>  reply_pipe_write_and_X: 17bc name: wkssvc len: 72
>[2011/12/15 15:22:54.920386,  6, pid=1905] rpc_server/srv_pipe_hnd.c:520(np_write_send)
>  np_write_send: len: 72
>[2011/12/15 15:22:54.920412, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 72
>[2011/12/15 15:22:54.920437, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 72
>[2011/12/15 15:22:54.920494, 10, pid=1905] rpc_server/srv_pipe_hnd.c:50(fill_rpc_header)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2011/12/15 15:22:54.920520, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 16
>[2011/12/15 15:22:54.920545, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 56
>[2011/12/15 15:22:54.920569, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 56
>[2011/12/15 15:22:54.920595, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 0
>[2011/12/15 15:22:54.920619, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 56
>[2011/12/15 15:22:54.920643, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 56, incoming data = 56
>[2011/12/15 15:22:54.920668, 10, pid=1905] rpc_server/srv_pipe.c:1877(process_complete_pdu)
>  PDU is in Little Endian format!
>[2011/12/15 15:22:54.920698,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_BIND (11)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0048 (72)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 11)
>          bind: struct dcerpc_bind
>              max_xmit_frag            : 0x10b8 (4280)
>              max_recv_frag            : 0x10b8 (4280)
>              assoc_group_id           : 0x00000000 (0)
>              num_contexts             : 0x01 (1)
>              ctx_list: ARRAY(1)
>                  ctx_list: struct dcerpc_ctx_list
>                      context_id               : 0x0000 (0)
>                      num_transfer_syntaxes    : 0x01 (1)
>                      abstract_syntax: struct ndr_syntax_id
>                          uuid                     : 6bffd098-a112-3610-9833-46c3f87e345a
>                          if_version               : 0x00000001 (1)
>                      transfer_syntaxes: ARRAY(1)
>                          transfer_syntaxes: struct ndr_syntax_id
>                              uuid                     : 8a885d04-1ceb-11c9-9fe8-08002b104860
>                              if_version               : 0x00000002 (2)
>              auth_info                : DATA_BLOB length=0
>[2011/12/15 15:22:54.921090, 10, pid=1905] rpc_server/srv_pipe.c:1890(process_complete_pdu)
>  Processing packet type 11
>[2011/12/15 15:22:54.921117,  3, pid=1905] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
>  api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\wkssvc
>[2011/12/15 15:22:54.921143,  5, pid=1905] rpc_server/srv_pipe.c:923(api_pipe_bind_req)
>  api_pipe_bind_req: make response. 923
>[2011/12/15 15:22:54.921168,  3, pid=1905] rpc_server/srv_pipe.c:339(check_bind_req)
>  check_bind_req for \wkssvc
>[2011/12/15 15:22:54.921195,  3, pid=1905] rpc_server/srv_pipe.c:346(check_bind_req)
>  check_bind_req: \PIPE\wkssvc -> \PIPE\wkssvc
>[2011/12/15 15:22:54.921228,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       &r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_BIND_ACK (12)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0044 (68)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 12)
>          bind_ack: struct dcerpc_bind_ack
>              max_xmit_frag            : 0x10b8 (4280)
>              max_recv_frag            : 0x10b8 (4280)
>              assoc_group_id           : 0x000053f0 (21488)
>              secondary_address_size   : 0x000d (13)
>              secondary_address        : '\PIPE\wkssvc'
>              _pad1                    : DATA_BLOB length=0
>              num_results              : 0x01 (1)
>              ctx_list: ARRAY(1)
>                  ctx_list: struct dcerpc_ack_ctx
>                      result                   : 0x0000 (0)
>                      reason                   : 0x0000 (0)
>                      syntax: struct ndr_syntax_id
>                          uuid                     : 8a885d04-1ceb-11c9-9fe8-08002b104860
>                          if_version               : 0x00000002 (2)
>              auth_info                : DATA_BLOB length=0
>[2011/12/15 15:22:54.921604, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 56
>[2011/12/15 15:22:54.921637,  3, pid=1905] smbd/pipes.c:361(pipe_write_andx_done)
>  writeX-IPC nwritten=72
>[2011/12/15 15:22:54.921964, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 59
>[2011/12/15 15:22:54.922005,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x3b
>[2011/12/15 15:22:54.922032,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 386 of length 63 (0 toread)
>[2011/12/15 15:22:54.922057,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.922071,  5, pid=1905] lib/util.c:342(show_msg)
>  size=59
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=24705
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 6076 (0x17BC)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]= 1024 (0x400)
>  smb_vwv[ 6]= 1024 (0x400)
>  smb_vwv[ 7]=65535 (0xFFFF)
>  smb_vwv[ 8]=65535 (0xFFFF)
>  smb_vwv[ 9]= 1024 (0x400)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=0
>[2011/12/15 15:22:54.922325, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>[2011/12/15 15:22:54.922341,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBreadX (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.922367,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.922396,  6, pid=1905] rpc_server/srv_pipe_hnd.c:284(read_from_internal_pipe)
>   name: \wkssvc len: 1024
>[2011/12/15 15:22:54.922423, 10, pid=1905] rpc_server/srv_pipe_hnd.c:325(read_from_internal_pipe)
>  read_from_pipe: \wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2011/12/15 15:22:54.922450,  3, pid=1905] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
>  free_pipe_context: destroying talloc pool of size 21
>[2011/12/15 15:22:54.922482, 10, pid=1905] rpc_server/srv_pipe_hnd.c:788(np_read_recv)
>  Received 68 bytes. There is no more data outstanding
>[2011/12/15 15:22:54.922509,  3, pid=1905] smbd/pipes.c:485(pipe_read_andx_done)
>  readX-IPC min=1024 max=1024 nread=68
>[2011/12/15 15:22:54.922792, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 156
>[2011/12/15 15:22:54.922834,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x9c
>[2011/12/15 15:22:54.922861,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 387 of length 160 (0 toread)
>[2011/12/15 15:22:54.922886,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.922901,  5, pid=1905] lib/util.c:342(show_msg)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=24769
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]= 6076 (0x17BC)
>  smb_bcc=89
>[2011/12/15 15:22:54.923195, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 5C 00 50 00 49 00 50   00 45 00 5C 00 00 00 00   .\.P.I.P .E.\....
>  [0010] 00 05 00 00 03 10 00 00   00 48 00 00 00 01 00 00   ........ .H......
>  [0020] 00 30 00 00 00 00 00 00   00 00 00 02 00 0D 00 00   .0...... ........
>  [0030] 00 00 00 00 00 0D 00 00   00 5C 00 5C 00 31 00 30   ........ .\.\.1.0
>  [0040] 00 2E 00 31 00 2E 00 30   00 2E 00 31 00 30 00 32   ...1...0 ...1.0.2
>  [0050] 00 00 00 48 60 64 00 00   00                       ...H`d.. .
>[2011/12/15 15:22:54.923336,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBtrans (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.923363,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.923392,  3, pid=1905] smbd/ipc.c:560(handle_trans)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2011/12/15 15:22:54.923419,  5, pid=1905] smbd/ipc.c:593(handle_trans)
>  calling named_pipe
>[2011/12/15 15:22:54.923444,  3, pid=1905] smbd/ipc.c:511(named_pipe)
>  named pipe command on <> name
>[2011/12/15 15:22:54.923469,  5, pid=1905] smbd/ipc.c:434(api_fd_reply)
>  api_fd_reply
>[2011/12/15 15:22:54.923493,  3, pid=1905] smbd/ipc.c:475(api_fd_reply)
>  Got API command 0x26 on pipe "wkssvc" (pnum 17bc)
>[2011/12/15 15:22:54.923518, 10, pid=1905] smbd/ipc.c:477(api_fd_reply)
>  api_fd_reply: p:8bb4ea8 max_trans_reply: 1024
>[2011/12/15 15:22:54.923544,  6, pid=1905] rpc_server/srv_pipe_hnd.c:520(np_write_send)
>  np_write_send: len: 72
>[2011/12/15 15:22:54.923570, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 72
>[2011/12/15 15:22:54.923595, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 72
>[2011/12/15 15:22:54.923620, 10, pid=1905] rpc_server/srv_pipe_hnd.c:50(fill_rpc_header)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2011/12/15 15:22:54.923645, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 16
>[2011/12/15 15:22:54.923670, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 56
>[2011/12/15 15:22:54.923694, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 56
>[2011/12/15 15:22:54.923721, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 0
>[2011/12/15 15:22:54.923760, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 56
>[2011/12/15 15:22:54.923788, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 56, incoming data = 56
>[2011/12/15 15:22:54.923814, 10, pid=1905] rpc_server/srv_pipe.c:1877(process_complete_pdu)
>  PDU is in Little Endian format!
>[2011/12/15 15:22:54.923844,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_REQUEST (0)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0048 (72)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 0)
>          request: struct dcerpc_request
>              alloc_hint               : 0x00000030 (48)
>              context_id               : 0x0000 (0)
>              opnum                    : 0x0000 (0)
>              object                   : union dcerpc_object(case 0)
>              empty: struct dcerpc_empty
>              _pad                     : DATA_BLOB length=0
>              stub_and_verifier        : DATA_BLOB length=48
>  [0000] 00 00 02 00 0D 00 00 00   00 00 00 00 0D 00 00 00   ........ ........
>  [0010] 5C 00 5C 00 31 00 30 00   2E 00 31 00 2E 00 30 00   \.\.1.0. ..1...0.
>  [0020] 2E 00 31 00 30 00 32 00   00 00 48 60 64 00 00 00   ..1.0.2. ..H`d...
>[2011/12/15 15:22:54.924209, 10, pid=1905] rpc_server/srv_pipe.c:1890(process_complete_pdu)
>  Processing packet type 0
>[2011/12/15 15:22:54.924234, 10, pid=1905] rpc_server/srv_pipe.c:1734(dcesrv_auth_request)
>  Checking request auth.
>[2011/12/15 15:22:54.924259,  5, pid=1905] rpc_server/srv_pipe.c:1571(api_pipe_request)
>  Requested \PIPE\\wkssvc
>[2011/12/15 15:22:54.924286,  4, pid=1905] rpc_server/srv_pipe.c:1611(api_rpcTNP)
>  api_rpcTNP: \wkssvc op 0x0 - api_rpcTNP: rpc command: WKSSVC_NETWKSTAGETINFO
>[2011/12/15 15:22:54.924314,  6, pid=1905] rpc_server/srv_pipe.c:1645(api_rpcTNP)
>  api_rpc_cmds[0].fn == 83723e4
>[2011/12/15 15:22:54.924342,  1, pid=1905] ../librpc/ndr/ndr.c:284(ndr_print_function_debug)
>       wkssvc_NetWkstaGetInfo: struct wkssvc_NetWkstaGetInfo
>          in: struct wkssvc_NetWkstaGetInfo
>              server_name              : *
>                  server_name              : '\\10.1.0.102'
>              level                    : 0x00000064 (100)
>[2011/12/15 15:22:54.924420,  1, pid=1905] ../librpc/ndr/ndr.c:284(ndr_print_function_debug)
>       wkssvc_NetWkstaGetInfo: struct wkssvc_NetWkstaGetInfo
>          out: struct wkssvc_NetWkstaGetInfo
>              info                     : *
>                  info                     : union wkssvc_NetWkstaInfo(case 100)
>                  info100                  : *
>                      info100: struct wkssvc_NetWkstaInfo100
>                          platform_id              : PLATFORM_ID_NT (500)
>                          server_name              : *
>                              server_name              : 'SUPERNOVA2'
>                          domain_name              : *
>                              domain_name              : 'CIRCULAR'
>                          version_major            : 0x00000004 (4)
>                          version_minor            : 0x00000009 (9)
>              result                   : WERR_OK
>[2011/12/15 15:22:54.924613,  5, pid=1905] rpc_server/srv_pipe.c:1679(api_rpcTNP)
>  api_rpcTNP: called \wkssvc successfully
>[2011/12/15 15:22:54.924642, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 56
>[2011/12/15 15:22:54.924677,  6, pid=1905] rpc_server/srv_pipe_hnd.c:284(read_from_internal_pipe)
>   name: \wkssvc len: 1024
>[2011/12/15 15:22:54.924705, 10, pid=1905] rpc_server/srv_pipe_hnd.c:346(read_from_internal_pipe)
>  read_from_pipe: \wkssvc: fault_state = 0 : data_sent_length = 0, p->out_data.rdata.length = 100.
>[2011/12/15 15:22:54.924737,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       &r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_RESPONSE (2)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x007c (124)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 2)
>          response: struct dcerpc_response
>              alloc_hint               : 0x00000064 (100)
>              context_id               : 0x0000 (0)
>              cancel_count             : 0x00 (0)
>              _pad                     : DATA_BLOB length=0
>              stub_and_verifier        : DATA_BLOB length=100
>  [0000] 64 00 00 00 04 00 02 00   F4 01 00 00 08 00 02 00   d....... ........
>  [0010] 0C 00 02 00 04 00 00 00   09 00 00 00 0B 00 00 00   ........ ........
>  [0020] 00 00 00 00 0B 00 00 00   53 00 55 00 50 00 45 00   ........ S.U.P.E.
>  [0030] 52 00 4E 00 4F 00 56 00   41 00 32 00 00 00 00 00   R.N.O.V. A.2.....
>  [0040] 09 00 00 00 00 00 00 00   09 00 00 00 43 00 49 00   ........ ....C.I.
>  [0050] 52 00 43 00 55 00 4C 00   41 00 52 00 00 00 00 00   R.C.U.L. A.R.....
>  [0060] 00 00 00 00                                       .... 
>[2011/12/15 15:22:54.925186,  3, pid=1905] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
>  free_pipe_context: destroying talloc pool of size 61
>[2011/12/15 15:22:54.925217, 10, pid=1905] rpc_server/srv_pipe_hnd.c:788(np_read_recv)
>  Received 124 bytes. There is no more data outstanding
>[2011/12/15 15:22:54.925244,  5, pid=1905] smbd/ipc.c:62(copy_trans_params_and_data)
>  copy_trans_params_and_data: params[0..0] data[0..124] (align 0)
>[2011/12/15 15:22:54.925270,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.925285,  5, pid=1905] lib/util.c:342(show_msg)
>  size=180
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=1
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=24769
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  124 (0x7C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  124 (0x7C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=125
>[2011/12/15 15:22:54.925522, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 05 00 02 03 10 00 00   00 7C 00 00 00 01 00 00   ........ .|......
>  [0010] 00 64 00 00 00 00 00 00   00 64 00 00 00 04 00 02   .d...... .d......
>  [0020] 00 F4 01 00 00 08 00 02   00 0C 00 02 00 04 00 00   ........ ........
>  [0030] 00 09 00 00 00 0B 00 00   00 00 00 00 00 0B 00 00   ........ ........
>  [0040] 00 53 00 55 00 50 00 45   00 52 00 4E 00 4F 00 56   .S.U.P.E .R.N.O.V
>  [0050] 00 41 00 32 00 00 00 00   00 09 00 00 00 00 00 00   .A.2.... ........
>  [0060] 00 09 00 00 00 43 00 49   00 52 00 43 00 55 00 4C   .....C.I .R.C.U.L
>  [0070] 00 41 00 52 00 00 00 00   00 00 00 00 00           .A.R.... .....
>[2011/12/15 15:22:54.925993, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 41
>[2011/12/15 15:22:54.926035,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x29
>[2011/12/15 15:22:54.926061,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 388 of length 45 (0 toread)
>[2011/12/15 15:22:54.926087,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.926101,  5, pid=1905] lib/util.c:342(show_msg)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=24833
>  smt_wct=3
>  smb_vwv[ 0]= 6076 (0x17BC)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2011/12/15 15:22:54.926266, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>[2011/12/15 15:22:54.926282,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBclose (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.926308,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.926334,  3, pid=1905] smbd/reply.c:4851(reply_close)
>  close fd=-1 fnum=6076 (numopen=1)
>[2011/12/15 15:22:54.926359,  6, pid=1905] smbd/close.c:527(set_close_write_time)
>  close_write_time: Thu Jan  1 00:59:59 1970
>[2011/12/15 15:22:54.926387, 10, pid=1905] rpc_server/rpc_handles.c:307(close_policy_by_pipe)
>  close_policy_by_pipe: deleted handle list for pipe \wkssvc
>[2011/12/15 15:22:54.926417,  5, pid=1905] smbd/files.c:464(file_free)
>  freed files structure 6076 (0 used)
>[2011/12/15 15:22:54.926446,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.926461,  5, pid=1905] lib/util.c:342(show_msg)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=24833
>  smt_wct=0
>  smb_bcc=0
>[2011/12/15 15:22:54.926596, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>[2011/12/15 15:22:54.927053, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 100
>[2011/12/15 15:22:54.927094,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x64
>[2011/12/15 15:22:54.927121,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 389 of length 104 (0 toread)
>[2011/12/15 15:22:54.927146,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.927160,  5, pid=1905] lib/util.c:342(show_msg)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=24897
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2011/12/15 15:22:54.927536, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 5C 00 73 00 72 00 76   00 73 00 76 00 63 00 00   .\.s.r.v .s.v.c..
>  [0010] 00                                                . 
>[2011/12/15 15:22:54.927590,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBntcreateX (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.927617,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.927644, 10, pid=1905] smbd/nttrans.c:505(reply_ntcreate_and_X)
>  reply_ntcreate_and_X: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0, fname = srvsvc
>[2011/12/15 15:22:54.927674,  4, pid=1905] smbd/nttrans.c:293(nt_open_pipe)
>  nt_open_pipe: Opening pipe \srvsvc.
>[2011/12/15 15:22:54.927703,  5, pid=1905] smbd/files.c:126(file_new)
>  allocated file structure 1981, fnum = 6077 (1 used)
>[2011/12/15 15:22:54.927732, 10, pid=1905] smbd/files.c:618(file_name_hash)
>  file_name_hash: /tmp/srvsvc hash 0x8e98a76a
>[2011/12/15 15:22:54.927762,  4, pid=1905] rpc_server/rpc_ncacn_np.c:132(make_internal_rpc_pipe_p)
>  Create pipe requested \srvsvc
>[2011/12/15 15:22:54.927792, 10, pid=1905] rpc_server/rpc_handles.c:116(init_pipe_handles)
>  init_pipe_handle_list: created handle list for pipe \srvsvc
>[2011/12/15 15:22:54.927818, 10, pid=1905] rpc_server/rpc_handles.c:133(init_pipe_handles)
>  init_pipe_handle_list: pipe_handles ref count = 1 for pipe \srvsvc
>[2011/12/15 15:22:54.927852,  4, pid=1905] rpc_server/rpc_ncacn_np.c:176(make_internal_rpc_pipe_p)
>  Created internal pipe \srvsvc (pipes_open=0)
>[2011/12/15 15:22:54.927880,  5, pid=1905] smbd/nttrans.c:382(do_ntcreate_pipe_open)
>  do_ntcreate_pipe_open: open pipe = \srvsvc
>[2011/12/15 15:22:54.928252, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 136
>[2011/12/15 15:22:54.928294,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x88
>[2011/12/15 15:22:54.928321,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 390 of length 140 (0 toread)
>[2011/12/15 15:22:54.928346,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.928360,  5, pid=1905] lib/util.c:342(show_msg)
>  size=136
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=24961
>  smt_wct=14
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 6077 (0x17BD)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=65535 (0xFFFF)
>  smb_vwv[ 6]=65535 (0xFFFF)
>  smb_vwv[ 7]=    8 (0x8)
>  smb_vwv[ 8]=   72 (0x48)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   72 (0x48)
>  smb_vwv[11]=   64 (0x40)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_bcc=73
>[2011/12/15 15:22:54.928635, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] EE 05 00 0B 03 10 00 00   00 48 00 00 00 01 00 00   ........ .H......
>  [0010] 00 B8 10 B8 10 00 00 00   00 01 00 00 00 00 00 01   ........ ........
>  [0020] 00 C8 4F 32 4B 70 16 D3   01 12 78 5A 47 BF 6E E1   ..O2Kp.. ..xZG.n.
>  [0030] 88 03 00 00 00 04 5D 88   8A EB 1C C9 11 9F E8 08   ......]. ........
>  [0040] 00 2B 10 48 60 02 00 00   00                       .+.H`... .
>[2011/12/15 15:22:54.928756,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBwriteX (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.928782,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.928809,  6, pid=1905] smbd/pipes.c:300(reply_pipe_write_and_X)
>  reply_pipe_write_and_X: 17bd name: srvsvc len: 72
>[2011/12/15 15:22:54.928835,  6, pid=1905] rpc_server/srv_pipe_hnd.c:520(np_write_send)
>  np_write_send: len: 72
>[2011/12/15 15:22:54.928861, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 72
>[2011/12/15 15:22:54.928886, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 72
>[2011/12/15 15:22:54.928911, 10, pid=1905] rpc_server/srv_pipe_hnd.c:50(fill_rpc_header)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2011/12/15 15:22:54.928937, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 16
>[2011/12/15 15:22:54.928961, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 56
>[2011/12/15 15:22:54.928986, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 56
>[2011/12/15 15:22:54.929012, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 0
>[2011/12/15 15:22:54.929036, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 56
>[2011/12/15 15:22:54.929061, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 56, incoming data = 56
>[2011/12/15 15:22:54.929086, 10, pid=1905] rpc_server/srv_pipe.c:1877(process_complete_pdu)
>  PDU is in Little Endian format!
>[2011/12/15 15:22:54.929116,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_BIND (11)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0048 (72)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 11)
>          bind: struct dcerpc_bind
>              max_xmit_frag            : 0x10b8 (4280)
>              max_recv_frag            : 0x10b8 (4280)
>              assoc_group_id           : 0x00000000 (0)
>              num_contexts             : 0x01 (1)
>              ctx_list: ARRAY(1)
>                  ctx_list: struct dcerpc_ctx_list
>                      context_id               : 0x0000 (0)
>                      num_transfer_syntaxes    : 0x01 (1)
>                      abstract_syntax: struct ndr_syntax_id
>                          uuid                     : 4b324fc8-1670-01d3-1278-5a47bf6ee188
>                          if_version               : 0x00000003 (3)
>                      transfer_syntaxes: ARRAY(1)
>                          transfer_syntaxes: struct ndr_syntax_id
>                              uuid                     : 8a885d04-1ceb-11c9-9fe8-08002b104860
>                              if_version               : 0x00000002 (2)
>              auth_info                : DATA_BLOB length=0
>[2011/12/15 15:22:54.929510, 10, pid=1905] rpc_server/srv_pipe.c:1890(process_complete_pdu)
>  Processing packet type 11
>[2011/12/15 15:22:54.929536,  3, pid=1905] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
>  api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\srvsvc
>[2011/12/15 15:22:54.929562,  5, pid=1905] rpc_server/srv_pipe.c:923(api_pipe_bind_req)
>  api_pipe_bind_req: make response. 923
>[2011/12/15 15:22:54.929586,  3, pid=1905] rpc_server/srv_pipe.c:339(check_bind_req)
>  check_bind_req for \srvsvc
>[2011/12/15 15:22:54.929612,  3, pid=1905] rpc_server/srv_pipe.c:346(check_bind_req)
>  check_bind_req: \PIPE\srvsvc -> \PIPE\srvsvc
>[2011/12/15 15:22:54.929644,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       &r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_BIND_ACK (12)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0044 (68)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 12)
>          bind_ack: struct dcerpc_bind_ack
>              max_xmit_frag            : 0x10b8 (4280)
>              max_recv_frag            : 0x10b8 (4280)
>              assoc_group_id           : 0x000053f0 (21488)
>              secondary_address_size   : 0x000d (13)
>              secondary_address        : '\PIPE\srvsvc'
>              _pad1                    : DATA_BLOB length=0
>              num_results              : 0x01 (1)
>              ctx_list: ARRAY(1)
>                  ctx_list: struct dcerpc_ack_ctx
>                      result                   : 0x0000 (0)
>                      reason                   : 0x0000 (0)
>                      syntax: struct ndr_syntax_id
>                          uuid                     : 8a885d04-1ceb-11c9-9fe8-08002b104860
>                          if_version               : 0x00000002 (2)
>              auth_info                : DATA_BLOB length=0
>[2011/12/15 15:22:54.930067, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 56
>[2011/12/15 15:22:54.930103,  3, pid=1905] smbd/pipes.c:361(pipe_write_andx_done)
>  writeX-IPC nwritten=72
>[2011/12/15 15:22:54.930467, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 59
>[2011/12/15 15:22:54.930508,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x3b
>[2011/12/15 15:22:54.930535,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 391 of length 63 (0 toread)
>[2011/12/15 15:22:54.930560,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.930574,  5, pid=1905] lib/util.c:342(show_msg)
>  size=59
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=25025
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 6077 (0x17BD)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]= 1024 (0x400)
>  smb_vwv[ 6]= 1024 (0x400)
>  smb_vwv[ 7]=65535 (0xFFFF)
>  smb_vwv[ 8]=65535 (0xFFFF)
>  smb_vwv[ 9]= 1024 (0x400)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=0
>[2011/12/15 15:22:54.930829, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>[2011/12/15 15:22:54.930848,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBreadX (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.930875,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.930904,  6, pid=1905] rpc_server/srv_pipe_hnd.c:284(read_from_internal_pipe)
>   name: \srvsvc len: 1024
>[2011/12/15 15:22:54.930931, 10, pid=1905] rpc_server/srv_pipe_hnd.c:325(read_from_internal_pipe)
>  read_from_pipe: \srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2011/12/15 15:22:54.930958,  3, pid=1905] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
>  free_pipe_context: destroying talloc pool of size 21
>[2011/12/15 15:22:54.930990, 10, pid=1905] rpc_server/srv_pipe_hnd.c:788(np_read_recv)
>  Received 68 bytes. There is no more data outstanding
>[2011/12/15 15:22:54.931016,  3, pid=1905] smbd/pipes.c:485(pipe_read_andx_done)
>  readX-IPC min=1024 max=1024 nread=68
>[2011/12/15 15:22:54.931299, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 156
>[2011/12/15 15:22:54.931345,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x9c
>[2011/12/15 15:22:54.931372,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 392 of length 160 (0 toread)
>[2011/12/15 15:22:54.931397,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.931411,  5, pid=1905] lib/util.c:342(show_msg)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=25089
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]= 6077 (0x17BD)
>  smb_bcc=89
>[2011/12/15 15:22:54.931703, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 5C 00 50 00 49 00 50   00 45 00 5C 00 00 00 00   .\.P.I.P .E.\....
>  [0010] 00 05 00 00 03 10 00 00   00 48 00 00 00 01 00 00   ........ .H......
>  [0020] 00 30 00 00 00 00 00 15   00 00 00 02 00 0D 00 00   .0...... ........
>  [0030] 00 00 00 00 00 0D 00 00   00 5C 00 5C 00 31 00 30   ........ .\.\.1.0
>  [0040] 00 2E 00 31 00 2E 00 30   00 2E 00 31 00 30 00 32   ...1...0 ...1.0.2
>  [0050] 00 00 00 48 60 65 00 00   00                       ...H`e.. .
>[2011/12/15 15:22:54.931845,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBtrans (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.931871,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.931900,  3, pid=1905] smbd/ipc.c:560(handle_trans)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2011/12/15 15:22:54.931928,  5, pid=1905] smbd/ipc.c:593(handle_trans)
>  calling named_pipe
>[2011/12/15 15:22:54.931952,  3, pid=1905] smbd/ipc.c:511(named_pipe)
>  named pipe command on <> name
>[2011/12/15 15:22:54.931977,  5, pid=1905] smbd/ipc.c:434(api_fd_reply)
>  api_fd_reply
>[2011/12/15 15:22:54.932001,  3, pid=1905] smbd/ipc.c:475(api_fd_reply)
>  Got API command 0x26 on pipe "srvsvc" (pnum 17bd)
>[2011/12/15 15:22:54.932027, 10, pid=1905] smbd/ipc.c:477(api_fd_reply)
>  api_fd_reply: p:8bb4ea8 max_trans_reply: 1024
>[2011/12/15 15:22:54.932052,  6, pid=1905] rpc_server/srv_pipe_hnd.c:520(np_write_send)
>  np_write_send: len: 72
>[2011/12/15 15:22:54.932077, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 72
>[2011/12/15 15:22:54.932102, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 72
>[2011/12/15 15:22:54.932128, 10, pid=1905] rpc_server/srv_pipe_hnd.c:50(fill_rpc_header)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2011/12/15 15:22:54.932153, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 16
>[2011/12/15 15:22:54.932177, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 56
>[2011/12/15 15:22:54.932202, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 56
>[2011/12/15 15:22:54.932228, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 0
>[2011/12/15 15:22:54.932252, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 56
>[2011/12/15 15:22:54.932276, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 56, incoming data = 56
>[2011/12/15 15:22:54.932302, 10, pid=1905] rpc_server/srv_pipe.c:1877(process_complete_pdu)
>  PDU is in Little Endian format!
>[2011/12/15 15:22:54.932331,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_REQUEST (0)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0048 (72)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 0)
>          request: struct dcerpc_request
>              alloc_hint               : 0x00000030 (48)
>              context_id               : 0x0000 (0)
>              opnum                    : 0x0015 (21)
>              object                   : union dcerpc_object(case 0)
>              empty: struct dcerpc_empty
>              _pad                     : DATA_BLOB length=0
>              stub_and_verifier        : DATA_BLOB length=48
>  [0000] 00 00 02 00 0D 00 00 00   00 00 00 00 0D 00 00 00   ........ ........
>  [0010] 5C 00 5C 00 31 00 30 00   2E 00 31 00 2E 00 30 00   \.\.1.0. ..1...0.
>  [0020] 2E 00 31 00 30 00 32 00   00 00 48 60 65 00 00 00   ..1.0.2. ..H`e...
>[2011/12/15 15:22:54.932694, 10, pid=1905] rpc_server/srv_pipe.c:1890(process_complete_pdu)
>  Processing packet type 0
>[2011/12/15 15:22:54.932720, 10, pid=1905] rpc_server/srv_pipe.c:1734(dcesrv_auth_request)
>  Checking request auth.
>[2011/12/15 15:22:54.932745,  5, pid=1905] rpc_server/srv_pipe.c:1571(api_pipe_request)
>  Requested \PIPE\\srvsvc
>[2011/12/15 15:22:54.932771,  4, pid=1905] rpc_server/srv_pipe.c:1611(api_rpcTNP)
>  api_rpcTNP: \srvsvc op 0x15 - api_rpcTNP: rpc command: SRVSVC_NETSRVGETINFO
>[2011/12/15 15:22:54.932799,  6, pid=1905] rpc_server/srv_pipe.c:1645(api_rpcTNP)
>  api_rpc_cmds[21].fn == 83b1837
>[2011/12/15 15:22:54.932827,  1, pid=1905] ../librpc/ndr/ndr.c:284(ndr_print_function_debug)
>       srvsvc_NetSrvGetInfo: struct srvsvc_NetSrvGetInfo
>          in: struct srvsvc_NetSrvGetInfo
>              server_unc               : *
>                  server_unc               : '\\10.1.0.102'
>              level                    : 0x00000065 (101)
>[2011/12/15 15:22:54.932903,  5, pid=1905] rpc_server/srvsvc/srv_srvsvc_nt.c:1125(_srvsvc_NetSrvGetInfo)
>  _srvsvc_NetSrvGetInfo: 1125
>[2011/12/15 15:22:54.932931,  5, pid=1905] rpc_server/srvsvc/srv_srvsvc_nt.c:1203(_srvsvc_NetSrvGetInfo)
>  _srvsvc_NetSrvGetInfo: 1203
>[2011/12/15 15:22:54.932956,  1, pid=1905] ../librpc/ndr/ndr.c:284(ndr_print_function_debug)
>       srvsvc_NetSrvGetInfo: struct srvsvc_NetSrvGetInfo
>          out: struct srvsvc_NetSrvGetInfo
>              info                     : *
>                  info                     : union srvsvc_NetSrvInfo(case 101)
>                  info101                  : *
>                      info101: struct srvsvc_NetSrvInfo101
>                          platform_id              : PLATFORM_ID_NT (500)
>                          server_name              : *
>                              server_name              : 'SUPERNOVA2'
>                          version_major            : 0x00000004 (4)
>                          version_minor            : 0x00000009 (9)
>                          server_type              : 0x00809a33 (8428083)
>                                 1: SV_TYPE_WORKSTATION      
>                                 1: SV_TYPE_SERVER           
>                                 0: SV_TYPE_SQLSERVER        
>                                 0: SV_TYPE_DOMAIN_CTRL      
>                                 1: SV_TYPE_DOMAIN_BAKCTRL   
>                                 1: SV_TYPE_TIME_SOURCE      
>                                 0: SV_TYPE_AFP              
>                                 0: SV_TYPE_NOVELL           
>                                 0: SV_TYPE_DOMAIN_MEMBER    
>                                 1: SV_TYPE_PRINTQ_SERVER    
>                                 0: SV_TYPE_DIALIN_SERVER    
>                                 1: SV_TYPE_SERVER_UNIX      
>                                 1: SV_TYPE_NT               
>                                 0: SV_TYPE_WFW              
>                                 0: SV_TYPE_SERVER_MFPN      
>                                 1: SV_TYPE_SERVER_NT        
>                                 0: SV_TYPE_POTENTIAL_BROWSER
>                                 0: SV_TYPE_BACKUP_BROWSER   
>                                 0: SV_TYPE_MASTER_BROWSER   
>                                 0: SV_TYPE_DOMAIN_MASTER    
>                                 0: SV_TYPE_SERVER_OSF       
>                                 0: SV_TYPE_SERVER_VMS       
>                                 0: SV_TYPE_WIN95_PLUS       
>                                 1: SV_TYPE_DFS_SERVER       
>                                 0: SV_TYPE_ALTERNATE_XPORT  
>                                 0: SV_TYPE_LOCAL_LIST_ONLY  
>                                 0: SV_TYPE_DOMAIN_ENUM      
>                          comment                  : *
>                              comment                  : 'SAMBA LDAP PDC'
>              result                   : WERR_OK
>[2011/12/15 15:22:54.933493,  5, pid=1905] rpc_server/srv_pipe.c:1679(api_rpcTNP)
>  api_rpcTNP: called \srvsvc successfully
>[2011/12/15 15:22:54.933522, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 56
>[2011/12/15 15:22:54.933556,  6, pid=1905] rpc_server/srv_pipe_hnd.c:284(read_from_internal_pipe)
>   name: \srvsvc len: 1024
>[2011/12/15 15:22:54.933584, 10, pid=1905] rpc_server/srv_pipe_hnd.c:346(read_from_internal_pipe)
>  read_from_pipe: \srvsvc: fault_state = 0 : data_sent_length = 0, p->out_data.rdata.length = 116.
>[2011/12/15 15:22:54.933616,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       &r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_RESPONSE (2)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x008c (140)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 2)
>          response: struct dcerpc_response
>              alloc_hint               : 0x00000074 (116)
>              context_id               : 0x0000 (0)
>              cancel_count             : 0x00 (0)
>              _pad                     : DATA_BLOB length=0
>              stub_and_verifier        : DATA_BLOB length=116
>  [0000] 65 00 00 00 04 00 02 00   F4 01 00 00 08 00 02 00   e....... ........
>  [0010] 04 00 00 00 09 00 00 00   33 9A 80 00 0C 00 02 00   ........ 3.......
>  [0020] 0B 00 00 00 00 00 00 00   0B 00 00 00 53 00 55 00   ........ ....S.U.
>  [0030] 50 00 45 00 52 00 4E 00   4F 00 56 00 41 00 32 00   P.E.R.N. O.V.A.2.
>  [0040] 00 00 00 00 0F 00 00 00   00 00 00 00 0F 00 00 00   ........ ........
>  [0050] 53 00 41 00 4D 00 42 00   41 00 20 00 4C 00 44 00   S.A.M.B. A. .L.D.
>  [0060] 41 00 50 00 20 00 50 00   44 00 43 00 00 00 00 00   A.P. .P. D.C.....
>  [0070] 00 00 00 00                                       .... 
>[2011/12/15 15:22:54.934115,  3, pid=1905] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
>  free_pipe_context: destroying talloc pool of size 45
>[2011/12/15 15:22:54.934149, 10, pid=1905] rpc_server/srv_pipe_hnd.c:788(np_read_recv)
>  Received 140 bytes. There is no more data outstanding
>[2011/12/15 15:22:54.934176,  5, pid=1905] smbd/ipc.c:62(copy_trans_params_and_data)
>  copy_trans_params_and_data: params[0..0] data[0..140] (align 0)
>[2011/12/15 15:22:54.934202,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.934216,  5, pid=1905] lib/util.c:342(show_msg)
>  size=196
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=1
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=25089
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  140 (0x8C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  140 (0x8C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=141
>[2011/12/15 15:22:54.934455, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 05 00 02 03 10 00 00   00 8C 00 00 00 01 00 00   ........ ........
>  [0010] 00 74 00 00 00 00 00 00   00 65 00 00 00 04 00 02   .t...... .e......
>  [0020] 00 F4 01 00 00 08 00 02   00 04 00 00 00 09 00 00   ........ ........
>  [0030] 00 33 9A 80 00 0C 00 02   00 0B 00 00 00 00 00 00   .3...... ........
>  [0040] 00 0B 00 00 00 53 00 55   00 50 00 45 00 52 00 4E   .....S.U .P.E.R.N
>  [0050] 00 4F 00 56 00 41 00 32   00 00 00 00 00 0F 00 00   .O.V.A.2 ........
>  [0060] 00 00 00 00 00 0F 00 00   00 53 00 41 00 4D 00 42   ........ .S.A.M.B
>  [0070] 00 41 00 20 00 4C 00 44   00 41 00 50 00 20 00 50   .A. .L.D .A.P. .P
>  [0080] 00 44 00 43 00 00 00 00   00 00 00 00 00           .D.C.... .....
>[2011/12/15 15:22:54.934957, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 41
>[2011/12/15 15:22:54.934999,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x29
>[2011/12/15 15:22:54.935025,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 393 of length 45 (0 toread)
>[2011/12/15 15:22:54.935051,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.935065,  5, pid=1905] lib/util.c:342(show_msg)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=25153
>  smt_wct=3
>  smb_vwv[ 0]= 6077 (0x17BD)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2011/12/15 15:22:54.935229, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>[2011/12/15 15:22:54.935245,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBclose (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.935271,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.935297,  3, pid=1905] smbd/reply.c:4851(reply_close)
>  close fd=-1 fnum=6077 (numopen=1)
>[2011/12/15 15:22:54.935322,  6, pid=1905] smbd/close.c:527(set_close_write_time)
>  close_write_time: Thu Jan  1 00:59:59 1970
>[2011/12/15 15:22:54.935349, 10, pid=1905] rpc_server/rpc_handles.c:307(close_policy_by_pipe)
>  close_policy_by_pipe: deleted handle list for pipe \srvsvc
>[2011/12/15 15:22:54.935380,  5, pid=1905] smbd/files.c:464(file_free)
>  freed files structure 6077 (0 used)
>[2011/12/15 15:22:54.935409,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.935424,  5, pid=1905] lib/util.c:342(show_msg)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=25153
>  smt_wct=0
>  smb_bcc=0
>[2011/12/15 15:22:54.935559, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>[2011/12/15 15:22:54.936270, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 100
>[2011/12/15 15:22:54.936339,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x64
>[2011/12/15 15:22:54.936367,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 394 of length 104 (0 toread)
>[2011/12/15 15:22:54.936392,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.936409,  5, pid=1905] lib/util.c:342(show_msg)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=25217
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  768 (0x300)
>  smb_bcc=17
>[2011/12/15 15:22:54.936796, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 5C 00 77 00 69 00 6E   00 72 00 65 00 67 00 00   .\.w.i.n .r.e.g..
>  [0010] 00                                                . 
>[2011/12/15 15:22:54.936851,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBntcreateX (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.936877,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.936905, 10, pid=1905] smbd/nttrans.c:505(reply_ntcreate_and_X)
>  reply_ntcreate_and_X: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x40 root_dir_fid = 0x0, fname = winreg
>[2011/12/15 15:22:54.936935,  4, pid=1905] smbd/nttrans.c:293(nt_open_pipe)
>  nt_open_pipe: Opening pipe \winreg.
>[2011/12/15 15:22:54.936964,  5, pid=1905] smbd/files.c:126(file_new)
>  allocated file structure 1982, fnum = 6078 (1 used)
>[2011/12/15 15:22:54.936993, 10, pid=1905] smbd/files.c:618(file_name_hash)
>  file_name_hash: /tmp/winreg hash 0x718d6f2
>[2011/12/15 15:22:54.937023,  4, pid=1905] rpc_server/rpc_ncacn_np.c:132(make_internal_rpc_pipe_p)
>  Create pipe requested \winreg
>[2011/12/15 15:22:54.937053, 10, pid=1905] rpc_server/rpc_handles.c:116(init_pipe_handles)
>  init_pipe_handle_list: created handle list for pipe \winreg
>[2011/12/15 15:22:54.937079, 10, pid=1905] rpc_server/rpc_handles.c:133(init_pipe_handles)
>  init_pipe_handle_list: pipe_handles ref count = 1 for pipe \winreg
>[2011/12/15 15:22:54.937112,  4, pid=1905] rpc_server/rpc_ncacn_np.c:176(make_internal_rpc_pipe_p)
>  Created internal pipe \winreg (pipes_open=0)
>[2011/12/15 15:22:54.937140,  5, pid=1905] smbd/nttrans.c:382(do_ntcreate_pipe_open)
>  do_ntcreate_pipe_open: open pipe = \winreg
>[2011/12/15 15:22:54.937502, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 136
>[2011/12/15 15:22:54.937543,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x88
>[2011/12/15 15:22:54.937570,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 395 of length 140 (0 toread)
>[2011/12/15 15:22:54.937594,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.937608,  5, pid=1905] lib/util.c:342(show_msg)
>  size=136
>  smb_com=0x2f
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=25281
>  smt_wct=14
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 6078 (0x17BE)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=65535 (0xFFFF)
>  smb_vwv[ 6]=65535 (0xFFFF)
>  smb_vwv[ 7]=    8 (0x8)
>  smb_vwv[ 8]=   72 (0x48)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   72 (0x48)
>  smb_vwv[11]=   64 (0x40)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_bcc=73
>[2011/12/15 15:22:54.937889, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] EE 05 00 0B 03 10 00 00   00 48 00 00 00 01 00 00   ........ .H......
>  [0010] 00 B8 10 B8 10 00 00 00   00 01 00 00 00 00 00 01   ........ ........
>  [0020] 00 01 D0 8C 33 44 22 F1   31 AA AA 90 00 38 00 10   ....3D". 1....8..
>  [0030] 03 01 00 00 00 04 5D 88   8A EB 1C C9 11 9F E8 08   ......]. ........
>  [0040] 00 2B 10 48 60 02 00 00   00                       .+.H`... .
>[2011/12/15 15:22:54.938009,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBwriteX (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.938036,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.938062,  6, pid=1905] smbd/pipes.c:300(reply_pipe_write_and_X)
>  reply_pipe_write_and_X: 17be name: winreg len: 72
>[2011/12/15 15:22:54.938089,  6, pid=1905] rpc_server/srv_pipe_hnd.c:520(np_write_send)
>  np_write_send: len: 72
>[2011/12/15 15:22:54.938115, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 72
>[2011/12/15 15:22:54.938140, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 72
>[2011/12/15 15:22:54.938165, 10, pid=1905] rpc_server/srv_pipe_hnd.c:50(fill_rpc_header)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2011/12/15 15:22:54.938191, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 16
>[2011/12/15 15:22:54.938215, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 56
>[2011/12/15 15:22:54.938240, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 56
>[2011/12/15 15:22:54.938268, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 0
>[2011/12/15 15:22:54.938292, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 56
>[2011/12/15 15:22:54.938317, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 56, incoming data = 56
>[2011/12/15 15:22:54.938344, 10, pid=1905] rpc_server/srv_pipe.c:1877(process_complete_pdu)
>  PDU is in Little Endian format!
>[2011/12/15 15:22:54.938374,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_BIND (11)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0048 (72)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 11)
>          bind: struct dcerpc_bind
>              max_xmit_frag            : 0x10b8 (4280)
>              max_recv_frag            : 0x10b8 (4280)
>              assoc_group_id           : 0x00000000 (0)
>              num_contexts             : 0x01 (1)
>              ctx_list: ARRAY(1)
>                  ctx_list: struct dcerpc_ctx_list
>                      context_id               : 0x0000 (0)
>                      num_transfer_syntaxes    : 0x01 (1)
>                      abstract_syntax: struct ndr_syntax_id
>                          uuid                     : 338cd001-2244-31f1-aaaa-900038001003
>                          if_version               : 0x00000001 (1)
>                      transfer_syntaxes: ARRAY(1)
>                          transfer_syntaxes: struct ndr_syntax_id
>                              uuid                     : 8a885d04-1ceb-11c9-9fe8-08002b104860
>                              if_version               : 0x00000002 (2)
>              auth_info                : DATA_BLOB length=0
>[2011/12/15 15:22:54.938771, 10, pid=1905] rpc_server/srv_pipe.c:1890(process_complete_pdu)
>  Processing packet type 11
>[2011/12/15 15:22:54.938797,  3, pid=1905] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
>  api_pipe_bind_req: \PIPE\winreg -> \PIPE\winreg
>[2011/12/15 15:22:54.938822,  5, pid=1905] rpc_server/srv_pipe.c:923(api_pipe_bind_req)
>  api_pipe_bind_req: make response. 923
>[2011/12/15 15:22:54.938847,  3, pid=1905] rpc_server/srv_pipe.c:339(check_bind_req)
>  check_bind_req for \winreg
>[2011/12/15 15:22:54.938873,  3, pid=1905] rpc_server/srv_pipe.c:346(check_bind_req)
>  check_bind_req: \PIPE\winreg -> \PIPE\winreg
>[2011/12/15 15:22:54.938905,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       &r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_BIND_ACK (12)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0044 (68)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 12)
>          bind_ack: struct dcerpc_bind_ack
>              max_xmit_frag            : 0x10b8 (4280)
>              max_recv_frag            : 0x10b8 (4280)
>              assoc_group_id           : 0x000053f0 (21488)
>              secondary_address_size   : 0x000d (13)
>              secondary_address        : '\PIPE\winreg'
>              _pad1                    : DATA_BLOB length=0
>              num_results              : 0x01 (1)
>              ctx_list: ARRAY(1)
>                  ctx_list: struct dcerpc_ack_ctx
>                      result                   : 0x0000 (0)
>                      reason                   : 0x0000 (0)
>                      syntax: struct ndr_syntax_id
>                          uuid                     : 8a885d04-1ceb-11c9-9fe8-08002b104860
>                          if_version               : 0x00000002 (2)
>              auth_info                : DATA_BLOB length=0
>[2011/12/15 15:22:54.939281, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 56
>[2011/12/15 15:22:54.939314,  3, pid=1905] smbd/pipes.c:361(pipe_write_andx_done)
>  writeX-IPC nwritten=72
>[2011/12/15 15:22:54.939623, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 59
>[2011/12/15 15:22:54.939664,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x3b
>[2011/12/15 15:22:54.939691,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 396 of length 63 (0 toread)
>[2011/12/15 15:22:54.939716,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.939730,  5, pid=1905] lib/util.c:342(show_msg)
>  size=59
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=25345
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 6078 (0x17BE)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]= 1024 (0x400)
>  smb_vwv[ 6]= 1024 (0x400)
>  smb_vwv[ 7]=65535 (0xFFFF)
>  smb_vwv[ 8]=65535 (0xFFFF)
>  smb_vwv[ 9]= 1024 (0x400)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=0
>[2011/12/15 15:22:54.940008, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>[2011/12/15 15:22:54.940027,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBreadX (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.940054,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.940082,  6, pid=1905] rpc_server/srv_pipe_hnd.c:284(read_from_internal_pipe)
>   name: \winreg len: 1024
>[2011/12/15 15:22:54.940110, 10, pid=1905] rpc_server/srv_pipe_hnd.c:325(read_from_internal_pipe)
>  read_from_pipe: \winreg: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2011/12/15 15:22:54.940137,  3, pid=1905] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
>  free_pipe_context: destroying talloc pool of size 21
>[2011/12/15 15:22:54.940168, 10, pid=1905] rpc_server/srv_pipe_hnd.c:788(np_read_recv)
>  Received 68 bytes. There is no more data outstanding
>[2011/12/15 15:22:54.940195,  3, pid=1905] smbd/pipes.c:485(pipe_read_andx_done)
>  readX-IPC min=1024 max=1024 nread=68
>[2011/12/15 15:22:54.940480, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 120
>[2011/12/15 15:22:54.940521,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x78
>[2011/12/15 15:22:54.940548,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 397 of length 124 (0 toread)
>[2011/12/15 15:22:54.940573,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.940587,  5, pid=1905] lib/util.c:342(show_msg)
>  size=120
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=25409
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   36 (0x24)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   36 (0x24)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]= 6078 (0x17BE)
>  smb_bcc=53
>[2011/12/15 15:22:54.940879, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 5C 00 50 00 49 00 50   00 45 00 5C 00 00 00 00   .\.P.I.P .E.\....
>  [0010] 00 05 00 00 03 10 00 00   00 24 00 00 00 01 00 00   ........ .$......
>  [0020] 00 0C 00 00 00 00 00 02   00 00 00 02 00 B0 87 01   ........ ........
>  [0030] 00 00 00 00 02                                    ..... 
>[2011/12/15 15:22:54.940976,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBtrans (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.941002,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.941031,  3, pid=1905] smbd/ipc.c:560(handle_trans)
>  trans <\PIPE\> data=36 params=0 setup=2
>[2011/12/15 15:22:54.941059,  5, pid=1905] smbd/ipc.c:593(handle_trans)
>  calling named_pipe
>[2011/12/15 15:22:54.941083,  3, pid=1905] smbd/ipc.c:511(named_pipe)
>  named pipe command on <> name
>[2011/12/15 15:22:54.941108,  5, pid=1905] smbd/ipc.c:434(api_fd_reply)
>  api_fd_reply
>[2011/12/15 15:22:54.941133,  3, pid=1905] smbd/ipc.c:475(api_fd_reply)
>  Got API command 0x26 on pipe "winreg" (pnum 17be)
>[2011/12/15 15:22:54.941158, 10, pid=1905] smbd/ipc.c:477(api_fd_reply)
>  api_fd_reply: p:8bb4ea8 max_trans_reply: 1024
>[2011/12/15 15:22:54.941183,  6, pid=1905] rpc_server/srv_pipe_hnd.c:520(np_write_send)
>  np_write_send: len: 36
>[2011/12/15 15:22:54.941209, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 36
>[2011/12/15 15:22:54.941233, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 36
>[2011/12/15 15:22:54.941259, 10, pid=1905] rpc_server/srv_pipe_hnd.c:50(fill_rpc_header)
>  fill_rpc_header: data_to_copy = 36, len_needed_to_complete_hdr = 16, receive_len = 0
>[2011/12/15 15:22:54.941284, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 16
>[2011/12/15 15:22:54.941308, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 20
>[2011/12/15 15:22:54.941332, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 20
>[2011/12/15 15:22:54.941362, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 0
>[2011/12/15 15:22:54.941390, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 20
>[2011/12/15 15:22:54.941414, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 20, incoming data = 20
>[2011/12/15 15:22:54.941440, 10, pid=1905] rpc_server/srv_pipe.c:1877(process_complete_pdu)
>  PDU is in Little Endian format!
>[2011/12/15 15:22:54.941469,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_REQUEST (0)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0024 (36)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 0)
>          request: struct dcerpc_request
>              alloc_hint               : 0x0000000c (12)
>              context_id               : 0x0000 (0)
>              opnum                    : 0x0002 (2)
>              object                   : union dcerpc_object(case 0)
>              empty: struct dcerpc_empty
>              _pad                     : DATA_BLOB length=0
>              stub_and_verifier        : DATA_BLOB length=12
>  [0000] 00 00 02 00 B0 87 01 00   00 00 00 02              ........ ....
>[2011/12/15 15:22:54.941777, 10, pid=1905] rpc_server/srv_pipe.c:1890(process_complete_pdu)
>  Processing packet type 0
>[2011/12/15 15:22:54.941805, 10, pid=1905] rpc_server/srv_pipe.c:1734(dcesrv_auth_request)
>  Checking request auth.
>[2011/12/15 15:22:54.941831,  5, pid=1905] rpc_server/srv_pipe.c:1571(api_pipe_request)
>  Requested \PIPE\\winreg
>[2011/12/15 15:22:54.941858,  4, pid=1905] rpc_server/srv_pipe.c:1611(api_rpcTNP)
>  api_rpcTNP: \winreg op 0x2 - api_rpcTNP: rpc command: WINREG_OPENHKLM
>[2011/12/15 15:22:54.941885,  6, pid=1905] rpc_server/srv_pipe.c:1645(api_rpcTNP)
>  api_rpc_cmds[2].fn == 8369159
>[2011/12/15 15:22:54.941913,  1, pid=1905] ../librpc/ndr/ndr.c:284(ndr_print_function_debug)
>       winreg_OpenHKLM: struct winreg_OpenHKLM
>          in: struct winreg_OpenHKLM
>              system_name              : *
>                  system_name              : 0x87b0 (34736)
>              access_mask              : 0x02000000 (33554432)
>                     0: KEY_QUERY_VALUE          
>                     0: KEY_SET_VALUE            
>                     0: KEY_CREATE_SUB_KEY       
>                     0: KEY_ENUMERATE_SUB_KEYS   
>                     0: KEY_NOTIFY               
>                     0: KEY_CREATE_LINK          
>                     0: KEY_WOW64_64KEY          
>                     0: KEY_WOW64_32KEY          
>[2011/12/15 15:22:54.942085,  7, pid=1905] registry/reg_api.c:141(regkey_open_onelevel)
>  regkey_open_onelevel: name = [HKLM]
>[2011/12/15 15:22:54.942114, 10, pid=1905] registry/reg_backend_db.c:583(regdb_open)
>  regdb_open: incrementing refcount (2->3)
>[2011/12/15 15:22:54.942144, 10, pid=1905] registry/reg_cachehook.c:122(reghook_cache_find)
>  reghook_cache_find: Searching for keyname [\HKLM]
>[2011/12/15 15:22:54.942171, 10, pid=1905] lib/adt_tree.c:367(pathtree_find)
>  pathtree_find: Enter [\HKLM]
>[2011/12/15 15:22:54.942198, 10, pid=1905] lib/adt_tree.c:440(pathtree_find)
>  pathtree_find: Exit
>[2011/12/15 15:22:54.942224, 10, pid=1905] registry/reg_cachehook.c:127(reghook_cache_find)
>  reghook_cache_find: found ops 8ba27c0 for key [\HKLM]
>[2011/12/15 15:22:54.942292, 10, pid=1905] registry/reg_backend_db.c:1871(regdb_get_secdesc)
>  regdb_get_secdesc: Getting secdesc of key [HKLM]
>[2011/12/15 15:22:54.942338, 10, pid=1905] ../libcli/security/access_check.c:177(se_access_check)
>  se_access_check: MAX desired = 0x2000000, granted = 0x20019, remaining = 0x20019
>[2011/12/15 15:22:54.942370,  4, pid=1905] rpc_server/rpc_handles.c:197(create_rpc_handle_internal)
>  Opened policy hnd[1] [0000] 00 00 00 00 18 00 00 00   00 00 00 00 EA 4E BE 02   ........ .....N..
>  [0010] 71 07 00 00                                       q... 
>[2011/12/15 15:22:54.942426,  1, pid=1905] ../librpc/ndr/ndr.c:284(ndr_print_function_debug)
>       winreg_OpenHKLM: struct winreg_OpenHKLM
>          out: struct winreg_OpenHKLM
>              handle                   : *
>                  handle: struct policy_handle
>                      handle_type              : 0x00000000 (0)
>                      uuid                     : 00000018-0000-0000-ea4e-be0271070000
>              result                   : WERR_OK
>[2011/12/15 15:22:54.942532,  5, pid=1905] rpc_server/srv_pipe.c:1679(api_rpcTNP)
>  api_rpcTNP: called \winreg successfully
>[2011/12/15 15:22:54.942561, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 20
>[2011/12/15 15:22:54.942596,  6, pid=1905] rpc_server/srv_pipe_hnd.c:284(read_from_internal_pipe)
>   name: \winreg len: 1024
>[2011/12/15 15:22:54.942624, 10, pid=1905] rpc_server/srv_pipe_hnd.c:346(read_from_internal_pipe)
>  read_from_pipe: \winreg: fault_state = 0 : data_sent_length = 0, p->out_data.rdata.length = 24.
>[2011/12/15 15:22:54.942656,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       &r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_RESPONSE (2)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0030 (48)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000001 (1)
>          u                        : union dcerpc_payload(case 2)
>          response: struct dcerpc_response
>              alloc_hint               : 0x00000018 (24)
>              context_id               : 0x0000 (0)
>              cancel_count             : 0x00 (0)
>              _pad                     : DATA_BLOB length=0
>              stub_and_verifier        : DATA_BLOB length=24
>  [0000] 00 00 00 00 18 00 00 00   00 00 00 00 EA 4E BE 02   ........ .....N..
>  [0010] 71 07 00 00 00 00 00 00                            q....... 
>[2011/12/15 15:22:54.942991,  3, pid=1905] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
>  free_pipe_context: destroying talloc pool of size 21
>[2011/12/15 15:22:54.943027, 10, pid=1905] rpc_server/srv_pipe_hnd.c:788(np_read_recv)
>  Received 48 bytes. There is no more data outstanding
>[2011/12/15 15:22:54.943055,  5, pid=1905] smbd/ipc.c:62(copy_trans_params_and_data)
>  copy_trans_params_and_data: params[0..0] data[0..48] (align 0)
>[2011/12/15 15:22:54.943081,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.943096,  5, pid=1905] lib/util.c:342(show_msg)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=1
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=25409
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2011/12/15 15:22:54.943336, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 05 00 02 03 10 00 00   00 30 00 00 00 01 00 00   ........ .0......
>  [0010] 00 18 00 00 00 00 00 00   00 00 00 00 00 18 00 00   ........ ........
>  [0020] 00 00 00 00 00 EA 4E BE   02 71 07 00 00 00 00 00   ......N. .q......
>  [0030] 00                                                . 
>[2011/12/15 15:22:54.943703, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 228
>[2011/12/15 15:22:54.943756,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0xe4
>[2011/12/15 15:22:54.943788,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 398 of length 232 (0 toread)
>[2011/12/15 15:22:54.943813,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.943827,  5, pid=1905] lib/util.c:342(show_msg)
>  size=228
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=25473
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  144 (0x90)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  144 (0x90)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]= 6078 (0x17BE)
>  smb_bcc=161
>[2011/12/15 15:22:54.944126, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 5C 00 50 00 49 00 50   00 45 00 5C 00 00 00 00   .\.P.I.P .E.\....
>  [0010] 00 05 00 00 03 10 00 00   00 90 00 00 00 02 00 00   ........ ........
>  [0020] 00 78 00 00 00 00 00 0F   00 00 00 00 00 18 00 00   .x...... ........
>  [0030] 00 00 00 00 00 EA 4E BE   02 71 07 00 00 46 00 46   ......N. .q...F.F
>  [0040] 00 00 00 02 00 23 00 00   00 00 00 00 00 23 00 00   .....#.. .....#..
>  [0050] 00 53 00 4F 00 46 00 54   00 57 00 41 00 52 00 45   .S.O.F.T .W.A.R.E
>  [0060] 00 5C 00 4D 00 69 00 63   00 72 00 6F 00 73 00 6F   .\.M.i.c .r.o.s.o
>  [0070] 00 66 00 74 00 5C 00 53   00 63 00 68 00 65 00 64   .f.t.\.S .c.h.e.d
>  [0080] 00 75 00 6C 00 69 00 6E   00 67 00 41 00 67 00 65   .u.l.i.n .g.A.g.e
>  [0090] 00 6E 00 74 00 00 00 38   CC 00 00 00 00 19 00 02   .n.t...8 ........
>  [00A0] 00                                                . 
>[2011/12/15 15:22:54.944370,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBtrans (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.944397,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.944427,  3, pid=1905] smbd/ipc.c:560(handle_trans)
>  trans <\PIPE\> data=144 params=0 setup=2
>[2011/12/15 15:22:54.944453,  5, pid=1905] smbd/ipc.c:593(handle_trans)
>  calling named_pipe
>[2011/12/15 15:22:54.944478,  3, pid=1905] smbd/ipc.c:511(named_pipe)
>  named pipe command on <> name
>[2011/12/15 15:22:54.944502,  5, pid=1905] smbd/ipc.c:434(api_fd_reply)
>  api_fd_reply
>[2011/12/15 15:22:54.944527,  3, pid=1905] smbd/ipc.c:475(api_fd_reply)
>  Got API command 0x26 on pipe "winreg" (pnum 17be)
>[2011/12/15 15:22:54.944553, 10, pid=1905] smbd/ipc.c:477(api_fd_reply)
>  api_fd_reply: p:8bb4ea8 max_trans_reply: 1024
>[2011/12/15 15:22:54.944578,  6, pid=1905] rpc_server/srv_pipe_hnd.c:520(np_write_send)
>  np_write_send: len: 144
>[2011/12/15 15:22:54.944604, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 144
>[2011/12/15 15:22:54.944629, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 144
>[2011/12/15 15:22:54.944654, 10, pid=1905] rpc_server/srv_pipe_hnd.c:50(fill_rpc_header)
>  fill_rpc_header: data_to_copy = 144, len_needed_to_complete_hdr = 16, receive_len = 0
>[2011/12/15 15:22:54.944679, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 16
>[2011/12/15 15:22:54.944703, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 128
>[2011/12/15 15:22:54.944730, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 128
>[2011/12/15 15:22:54.944757, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 0
>[2011/12/15 15:22:54.944781, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 128
>[2011/12/15 15:22:54.944805, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 128, incoming data = 128
>[2011/12/15 15:22:54.944831, 10, pid=1905] rpc_server/srv_pipe.c:1877(process_complete_pdu)
>  PDU is in Little Endian format!
>[2011/12/15 15:22:54.944860,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_REQUEST (0)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0090 (144)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000002 (2)
>          u                        : union dcerpc_payload(case 0)
>          request: struct dcerpc_request
>              alloc_hint               : 0x00000078 (120)
>              context_id               : 0x0000 (0)
>              opnum                    : 0x000f (15)
>              object                   : union dcerpc_object(case 0)
>              empty: struct dcerpc_empty
>              _pad                     : DATA_BLOB length=0
>              stub_and_verifier        : DATA_BLOB length=120
>  [0000] 00 00 00 00 18 00 00 00   00 00 00 00 EA 4E BE 02   ........ .....N..
>  [0010] 71 07 00 00 46 00 46 00   00 00 02 00 23 00 00 00   q...F.F. ....#...
>  [0020] 00 00 00 00 23 00 00 00   53 00 4F 00 46 00 54 00   ....#... S.O.F.T.
>  [0030] 57 00 41 00 52 00 45 00   5C 00 4D 00 69 00 63 00   W.A.R.E. \.M.i.c.
>  [0040] 72 00 6F 00 73 00 6F 00   66 00 74 00 5C 00 53 00   r.o.s.o. f.t.\.S.
>  [0050] 63 00 68 00 65 00 64 00   75 00 6C 00 69 00 6E 00   c.h.e.d. u.l.i.n.
>  [0060] 67 00 41 00 67 00 65 00   6E 00 74 00 00 00 38 CC   g.A.g.e. n.t...8.
>  [0070] 00 00 00 00 19 00 02 00                            ........ 
>[2011/12/15 15:22:54.945364, 10, pid=1905] rpc_server/srv_pipe.c:1890(process_complete_pdu)
>  Processing packet type 0
>[2011/12/15 15:22:54.945389, 10, pid=1905] rpc_server/srv_pipe.c:1734(dcesrv_auth_request)
>  Checking request auth.
>[2011/12/15 15:22:54.945415,  5, pid=1905] rpc_server/srv_pipe.c:1571(api_pipe_request)
>  Requested \PIPE\\winreg
>[2011/12/15 15:22:54.945441,  4, pid=1905] rpc_server/srv_pipe.c:1611(api_rpcTNP)
>  api_rpcTNP: \winreg op 0xf - api_rpcTNP: rpc command: WINREG_OPENKEY
>[2011/12/15 15:22:54.945469,  6, pid=1905] rpc_server/srv_pipe.c:1645(api_rpcTNP)
>  api_rpc_cmds[15].fn == 836b6f0
>[2011/12/15 15:22:54.945500,  1, pid=1905] ../librpc/ndr/ndr.c:284(ndr_print_function_debug)
>       winreg_OpenKey: struct winreg_OpenKey
>          in: struct winreg_OpenKey
>              parent_handle            : *
>                  parent_handle: struct policy_handle
>                      handle_type              : 0x00000000 (0)
>                      uuid                     : 00000018-0000-0000-ea4e-be0271070000
>              keyname: struct winreg_String
>                  name_len                 : 0x0046 (70)
>                  name_size                : 0x0046 (70)
>                  name                     : *
>                      name                     : 'SOFTWARE\Microsoft\SchedulingAgent'
>              options                  : 0x00000000 (0)
>                     0: REG_OPTION_VOLATILE      
>                     0: REG_OPTION_CREATE_LINK   
>                     0: REG_OPTION_BACKUP_RESTORE
>                     0: REG_OPTION_OPEN_LINK     
>              access_mask              : 0x00020019 (131097)
>                     1: KEY_QUERY_VALUE          
>                     0: KEY_SET_VALUE            
>                     0: KEY_CREATE_SUB_KEY       
>                     1: KEY_ENUMERATE_SUB_KEYS   
>                     1: KEY_NOTIFY               
>                     0: KEY_CREATE_LINK          
>                     0: KEY_WOW64_64KEY          
>                     0: KEY_WOW64_32KEY          
>[2011/12/15 15:22:54.945825,  4, pid=1905] rpc_server/rpc_handles.c:232(find_policy_by_hnd_internal)
>  Found policy hnd[0] [0000] 00 00 00 00 18 00 00 00   00 00 00 00 EA 4E BE 02   ........ .....N..
>  [0010] 71 07 00 00                                       q... 
>[2011/12/15 15:22:54.945881,  7, pid=1905] registry/reg_api.c:141(regkey_open_onelevel)
>  regkey_open_onelevel: name = [SOFTWARE]
>[2011/12/15 15:22:54.945909, 10, pid=1905] registry/reg_backend_db.c:583(regdb_open)
>  regdb_open: incrementing refcount (3->4)
>[2011/12/15 15:22:54.945936, 10, pid=1905] registry/reg_cachehook.c:122(reghook_cache_find)
>  reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE]
>[2011/12/15 15:22:54.945960, 10, pid=1905] lib/adt_tree.c:367(pathtree_find)
>  pathtree_find: Enter [\HKLM\SOFTWARE]
>[2011/12/15 15:22:54.945986, 10, pid=1905] lib/adt_tree.c:440(pathtree_find)
>  pathtree_find: Exit
>[2011/12/15 15:22:54.946010, 10, pid=1905] registry/reg_cachehook.c:127(reghook_cache_find)
>  reghook_cache_find: found ops 8ba27c0 for key [\HKLM\SOFTWARE]
>[2011/12/15 15:22:54.946064, 10, pid=1905] registry/reg_backend_db.c:1871(regdb_get_secdesc)
>  regdb_get_secdesc: Getting secdesc of key [HKLM\SOFTWARE]
>[2011/12/15 15:22:54.946108,  7, pid=1905] registry/reg_api.c:141(regkey_open_onelevel)
>  regkey_open_onelevel: name = [Microsoft]
>[2011/12/15 15:22:54.946137, 10, pid=1905] registry/reg_backend_db.c:583(regdb_open)
>  regdb_open: incrementing refcount (4->5)
>[2011/12/15 15:22:54.946165, 10, pid=1905] registry/reg_cachehook.c:122(reghook_cache_find)
>  reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft]
>[2011/12/15 15:22:54.946189, 10, pid=1905] lib/adt_tree.c:367(pathtree_find)
>  pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft]
>[2011/12/15 15:22:54.946215, 10, pid=1905] lib/adt_tree.c:440(pathtree_find)
>  pathtree_find: Exit
>[2011/12/15 15:22:54.946239, 10, pid=1905] registry/reg_cachehook.c:127(reghook_cache_find)
>  reghook_cache_find: found ops 8ba27c0 for key [\HKLM\SOFTWARE\Microsoft]
>[2011/12/15 15:22:54.946284, 10, pid=1905] registry/reg_backend_db.c:1871(regdb_get_secdesc)
>  regdb_get_secdesc: Getting secdesc of key [HKLM\SOFTWARE\Microsoft]
>[2011/12/15 15:22:54.946326, 10, pid=1905] registry/reg_backend_db.c:619(regdb_close)
>  regdb_close: decrementing refcount (5->4)
>[2011/12/15 15:22:54.946353,  7, pid=1905] registry/reg_api.c:141(regkey_open_onelevel)
>  regkey_open_onelevel: name = [SchedulingAgent]
>[2011/12/15 15:22:54.946381, 10, pid=1905] registry/reg_backend_db.c:583(regdb_open)
>  regdb_open: incrementing refcount (4->5)
>[2011/12/15 15:22:54.946408, 10, pid=1905] registry/reg_cachehook.c:122(reghook_cache_find)
>  reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\SchedulingAgent]
>[2011/12/15 15:22:54.946433, 10, pid=1905] lib/adt_tree.c:367(pathtree_find)
>  pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\SchedulingAgent]
>[2011/12/15 15:22:54.946459, 10, pid=1905] lib/adt_tree.c:440(pathtree_find)
>  pathtree_find: Exit
>[2011/12/15 15:22:54.946483, 10, pid=1905] registry/reg_cachehook.c:127(reghook_cache_find)
>  reghook_cache_find: found ops 8ba27c0 for key [\HKLM\SOFTWARE\Microsoft\SchedulingAgent]
>[2011/12/15 15:22:54.946518, 10, pid=1905] registry/reg_backend_db.c:1618(regdb_fetch_keys_internal)
>  key [HKLM\SOFTWARE\Microsoft\SchedulingAgent] not found
>[2011/12/15 15:22:54.946545, 10, pid=1905] registry/reg_backend_db.c:619(regdb_close)
>  regdb_close: decrementing refcount (5->4)
>[2011/12/15 15:22:54.946571, 10, pid=1905] registry/reg_backend_db.c:619(regdb_close)
>  regdb_close: decrementing refcount (4->3)
>[2011/12/15 15:22:54.946597,  1, pid=1905] ../librpc/ndr/ndr.c:284(ndr_print_function_debug)
>       winreg_OpenKey: struct winreg_OpenKey
>          out: struct winreg_OpenKey
>              handle                   : *
>                  handle: struct policy_handle
>                      handle_type              : 0x00000000 (0)
>                      uuid                     : 00000000-0000-0000-0000-000000000000
>              result                   : WERR_BADFILE
>[2011/12/15 15:22:54.946704,  5, pid=1905] rpc_server/srv_pipe.c:1679(api_rpcTNP)
>  api_rpcTNP: called \winreg successfully
>[2011/12/15 15:22:54.946733, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 128
>[2011/12/15 15:22:54.946769,  6, pid=1905] rpc_server/srv_pipe_hnd.c:284(read_from_internal_pipe)
>   name: \winreg len: 1024
>[2011/12/15 15:22:54.946796, 10, pid=1905] rpc_server/srv_pipe_hnd.c:346(read_from_internal_pipe)
>  read_from_pipe: \winreg: fault_state = 0 : data_sent_length = 0, p->out_data.rdata.length = 24.
>[2011/12/15 15:22:54.946828,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       &r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_RESPONSE (2)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0030 (48)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000002 (2)
>          u                        : union dcerpc_payload(case 2)
>          response: struct dcerpc_response
>              alloc_hint               : 0x00000018 (24)
>              context_id               : 0x0000 (0)
>              cancel_count             : 0x00 (0)
>              _pad                     : DATA_BLOB length=0
>              stub_and_verifier        : DATA_BLOB length=24
>  [0000] 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00   ........ ........
>  [0010] 00 00 00 00 02 00 00 00                            ........ 
>[2011/12/15 15:22:54.947135,  3, pid=1905] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
>  free_pipe_context: destroying talloc pool of size 21
>[2011/12/15 15:22:54.947166, 10, pid=1905] rpc_server/srv_pipe_hnd.c:788(np_read_recv)
>  Received 48 bytes. There is no more data outstanding
>[2011/12/15 15:22:54.947193,  5, pid=1905] smbd/ipc.c:62(copy_trans_params_and_data)
>  copy_trans_params_and_data: params[0..0] data[0..48] (align 0)
>[2011/12/15 15:22:54.947219,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.947233,  5, pid=1905] lib/util.c:342(show_msg)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=1
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=25473
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2011/12/15 15:22:54.947471, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 05 00 02 03 10 00 00   00 30 00 00 00 02 00 00   ........ .0......
>  [0010] 00 18 00 00 00 00 00 00   00 00 00 00 00 00 00 00   ........ ........
>  [0020] 00 00 00 00 00 00 00 00   00 00 00 00 00 02 00 00   ........ ........
>  [0030] 00                                                . 
>[2011/12/15 15:22:54.947835, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 128
>[2011/12/15 15:22:54.947876,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x80
>[2011/12/15 15:22:54.947903,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 399 of length 132 (0 toread)
>[2011/12/15 15:22:54.947928,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.947942,  5, pid=1905] lib/util.c:342(show_msg)
>  size=128
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=25537
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   44 (0x2C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   44 (0x2C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]= 6078 (0x17BE)
>  smb_bcc=61
>[2011/12/15 15:22:54.948236, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 5C 00 50 00 49 00 50   00 45 00 5C 00 00 00 00   .\.P.I.P .E.\....
>  [0010] 00 05 00 00 03 10 00 00   00 2C 00 00 00 03 00 00   ........ .,......
>  [0020] 00 14 00 00 00 00 00 05   00 00 00 00 00 18 00 00   ........ ........
>  [0030] 00 00 00 00 00 EA 4E BE   02 71 07 00 00           ......N. .q...
>[2011/12/15 15:22:54.948337,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBtrans (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.948363,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.948392,  3, pid=1905] smbd/ipc.c:560(handle_trans)
>  trans <\PIPE\> data=44 params=0 setup=2
>[2011/12/15 15:22:54.948418,  5, pid=1905] smbd/ipc.c:593(handle_trans)
>  calling named_pipe
>[2011/12/15 15:22:54.948443,  3, pid=1905] smbd/ipc.c:511(named_pipe)
>  named pipe command on <> name
>[2011/12/15 15:22:54.948467,  5, pid=1905] smbd/ipc.c:434(api_fd_reply)
>  api_fd_reply
>[2011/12/15 15:22:54.948491,  3, pid=1905] smbd/ipc.c:475(api_fd_reply)
>  Got API command 0x26 on pipe "winreg" (pnum 17be)
>[2011/12/15 15:22:54.948517, 10, pid=1905] smbd/ipc.c:477(api_fd_reply)
>  api_fd_reply: p:8bb4ea8 max_trans_reply: 1024
>[2011/12/15 15:22:54.948542,  6, pid=1905] rpc_server/srv_pipe_hnd.c:520(np_write_send)
>  np_write_send: len: 44
>[2011/12/15 15:22:54.948568, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 44
>[2011/12/15 15:22:54.948593, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 44
>[2011/12/15 15:22:54.948618, 10, pid=1905] rpc_server/srv_pipe_hnd.c:50(fill_rpc_header)
>  fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0
>[2011/12/15 15:22:54.948647, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 16
>[2011/12/15 15:22:54.948672, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 28
>[2011/12/15 15:22:54.948697, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 28
>[2011/12/15 15:22:54.948723, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 0
>[2011/12/15 15:22:54.948746, 10, pid=1905] rpc_server/srv_pipe_hnd.c:242(write_to_internal_pipe)
>  write_to_pipe: data_left = 28
>[2011/12/15 15:22:54.948771, 10, pid=1905] rpc_server/srv_pipe_hnd.c:138(process_incoming_data)
>  process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 28, incoming data = 28
>[2011/12/15 15:22:54.948796, 10, pid=1905] rpc_server/srv_pipe.c:1877(process_complete_pdu)
>  PDU is in Little Endian format!
>[2011/12/15 15:22:54.948825,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_REQUEST (0)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x002c (44)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000003 (3)
>          u                        : union dcerpc_payload(case 0)
>          request: struct dcerpc_request
>              alloc_hint               : 0x00000014 (20)
>              context_id               : 0x0000 (0)
>              opnum                    : 0x0005 (5)
>              object                   : union dcerpc_object(case 0)
>              empty: struct dcerpc_empty
>              _pad                     : DATA_BLOB length=0
>              stub_and_verifier        : DATA_BLOB length=20
>  [0000] 00 00 00 00 18 00 00 00   00 00 00 00 EA 4E BE 02   ........ .....N..
>  [0010] 71 07 00 00                                       q... 
>[2011/12/15 15:22:54.949154, 10, pid=1905] rpc_server/srv_pipe.c:1890(process_complete_pdu)
>  Processing packet type 0
>[2011/12/15 15:22:54.949180, 10, pid=1905] rpc_server/srv_pipe.c:1734(dcesrv_auth_request)
>  Checking request auth.
>[2011/12/15 15:22:54.949207,  5, pid=1905] rpc_server/srv_pipe.c:1571(api_pipe_request)
>  Requested \PIPE\\winreg
>[2011/12/15 15:22:54.949235,  4, pid=1905] rpc_server/srv_pipe.c:1611(api_rpcTNP)
>  api_rpcTNP: \winreg op 0x5 - api_rpcTNP: rpc command: WINREG_CLOSEKEY
>[2011/12/15 15:22:54.949262,  6, pid=1905] rpc_server/srv_pipe.c:1645(api_rpcTNP)
>  api_rpc_cmds[5].fn == 8369aa9
>[2011/12/15 15:22:54.949289,  1, pid=1905] ../librpc/ndr/ndr.c:284(ndr_print_function_debug)
>       winreg_CloseKey: struct winreg_CloseKey
>          in: struct winreg_CloseKey
>              handle                   : *
>                  handle: struct policy_handle
>                      handle_type              : 0x00000000 (0)
>                      uuid                     : 00000018-0000-0000-ea4e-be0271070000
>[2011/12/15 15:22:54.949382,  4, pid=1905] rpc_server/rpc_handles.c:232(find_policy_by_hnd_internal)
>  Found policy hnd[0] [0000] 00 00 00 00 18 00 00 00   00 00 00 00 EA 4E BE 02   ........ .....N..
>  [0010] 71 07 00 00                                       q... 
>[2011/12/15 15:22:54.949439,  4, pid=1905] rpc_server/rpc_handles.c:232(find_policy_by_hnd_internal)
>  Found policy hnd[0] [0000] 00 00 00 00 18 00 00 00   00 00 00 00 EA 4E BE 02   ........ .....N..
>  [0010] 71 07 00 00                                       q... 
>[2011/12/15 15:22:54.949492,  3, pid=1905] rpc_server/rpc_handles.c:281(close_policy_hnd)
>  Closed policy
>[2011/12/15 15:22:54.949517, 10, pid=1905] registry/reg_backend_db.c:619(regdb_close)
>  regdb_close: decrementing refcount (3->2)
>[2011/12/15 15:22:54.949543,  1, pid=1905] ../librpc/ndr/ndr.c:284(ndr_print_function_debug)
>       winreg_CloseKey: struct winreg_CloseKey
>          out: struct winreg_CloseKey
>              handle                   : *
>                  handle: struct policy_handle
>                      handle_type              : 0x00000000 (0)
>                      uuid                     : 00000000-0000-0000-0000-000000000000
>              result                   : WERR_OK
>[2011/12/15 15:22:54.949647,  5, pid=1905] rpc_server/srv_pipe.c:1679(api_rpcTNP)
>  api_rpcTNP: called \winreg successfully
>[2011/12/15 15:22:54.949675, 10, pid=1905] rpc_server/srv_pipe_hnd.c:247(write_to_internal_pipe)
>  write_to_pipe: data_used = 28
>[2011/12/15 15:22:54.949710,  6, pid=1905] rpc_server/srv_pipe_hnd.c:284(read_from_internal_pipe)
>   name: \winreg len: 1024
>[2011/12/15 15:22:54.949738, 10, pid=1905] rpc_server/srv_pipe_hnd.c:346(read_from_internal_pipe)
>  read_from_pipe: \winreg: fault_state = 0 : data_sent_length = 0, p->out_data.rdata.length = 24.
>[2011/12/15 15:22:54.949769,  1, pid=1905] ../librpc/ndr/ndr.c:247(ndr_print_debug)
>       &r: struct ncacn_packet
>          rpc_vers                 : 0x05 (5)
>          rpc_vers_minor           : 0x00 (0)
>          ptype                    : DCERPC_PKT_RESPONSE (2)
>          pfc_flags                : 0x03 (3)
>          drep: ARRAY(4)
>              [0]                      : 0x10 (16)
>              [1]                      : 0x00 (0)
>              [2]                      : 0x00 (0)
>              [3]                      : 0x00 (0)
>          frag_length              : 0x0030 (48)
>          auth_length              : 0x0000 (0)
>          call_id                  : 0x00000003 (3)
>          u                        : union dcerpc_payload(case 2)
>          response: struct dcerpc_response
>              alloc_hint               : 0x00000018 (24)
>              context_id               : 0x0000 (0)
>              cancel_count             : 0x00 (0)
>              _pad                     : DATA_BLOB length=0
>              stub_and_verifier        : DATA_BLOB length=24
>  [0000] 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00   ........ ........
>  [0010] 00 00 00 00 00 00 00 00                            ........ 
>[2011/12/15 15:22:54.950117,  3, pid=1905] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
>  free_pipe_context: destroying talloc pool of size 21
>[2011/12/15 15:22:54.950151, 10, pid=1905] rpc_server/srv_pipe_hnd.c:788(np_read_recv)
>  Received 48 bytes. There is no more data outstanding
>[2011/12/15 15:22:54.950178,  5, pid=1905] smbd/ipc.c:62(copy_trans_params_and_data)
>  copy_trans_params_and_data: params[0..0] data[0..48] (align 0)
>[2011/12/15 15:22:54.950205,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.950219,  5, pid=1905] lib/util.c:342(show_msg)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=1
>  smb_pid=3676
>  smb_uid=102
>  smb_mid=25537
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2011/12/15 15:22:54.950455, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>  [0000] 00 05 00 02 03 10 00 00   00 30 00 00 00 03 00 00   ........ .0......
>  [0010] 00 18 00 00 00 00 00 00   00 00 00 00 00 00 00 00   ........ ........
>  [0020] 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00   ........ ........
>  [0030] 00                                                . 
>[2011/12/15 15:22:54.950832, 10, pid=1905] lib/util_sock.c:516(read_smb_length_return_keepalive)
>  got smb length of 41
>[2011/12/15 15:22:54.950873,  6, pid=1905] smbd/process.c:1659(process_smb)
>  got message type 0x0 of len 0x29
>[2011/12/15 15:22:54.950900,  3, pid=1905] smbd/process.c:1661(process_smb)
>  Transaction 400 of length 45 (0 toread)
>[2011/12/15 15:22:54.950925,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.950939,  5, pid=1905] lib/util.c:342(show_msg)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=25601
>  smt_wct=3
>  smb_vwv[ 0]= 6078 (0x17BE)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2011/12/15 15:22:54.951104, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>[2011/12/15 15:22:54.951119,  3, pid=1905] smbd/process.c:1466(switch_message)
>  switch message SMBclose (pid 1905) conn 0x8bcac28
>[2011/12/15 15:22:54.951145,  4, pid=1905] smbd/uid.c:351(change_to_user)
>  Skipping user change - already user
>[2011/12/15 15:22:54.951171,  3, pid=1905] smbd/reply.c:4851(reply_close)
>  close fd=-1 fnum=6078 (numopen=1)
>[2011/12/15 15:22:54.951201,  6, pid=1905] smbd/close.c:527(set_close_write_time)
>  close_write_time: Thu Jan  1 00:59:59 1970
>[2011/12/15 15:22:54.951228, 10, pid=1905] rpc_server/rpc_handles.c:307(close_policy_by_pipe)
>  close_policy_by_pipe: deleted handle list for pipe \winreg
>[2011/12/15 15:22:54.951259,  5, pid=1905] smbd/files.c:464(file_free)
>  freed files structure 6078 (0 used)
>[2011/12/15 15:22:54.951288,  5, pid=1905] lib/util.c:332(show_msg)
>[2011/12/15 15:22:54.951303,  5, pid=1905] lib/util.c:342(show_msg)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51203
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=102
>  smb_mid=25601
>  smt_wct=0
>  smb_bcc=0
>[2011/12/15 15:22:54.951438, 10, pid=1905] ../lib/util/util.c:415(dump_data)
>[2011/12/15 15:23:11.628766, 10, pid=1905] lib/events.c:221(run_events_poll)
>  Running timed event "smbd_idle_event_handler" 8bc2e90
>[2011/12/15 15:23:11.628869, 10, pid=1905] smbd/process.c:862(smbd_idle_event_handler)
>  smbd_idle_event_handler: idle_evt(deadtime) 0 called
>[2011/12/15 15:23:11.628905, 10, pid=1905] smbd/process.c:873(smbd_idle_event_handler)
>  smbd_idle_event_handler: idle_evt(deadtime) 0 rescheduled
>[2011/12/15 15:23:11.628940, 10, pid=1905] lib/events.c:221(run_events_poll)
>  Running timed event "smbd_idle_event_handler" 8bc5728
>[2011/12/15 15:23:11.628967, 10, pid=1905] smbd/process.c:862(smbd_idle_event_handler)
>  smbd_idle_event_handler: idle_evt(housekeeping) 0 called
>[2011/12/15 15:23:11.628993,  5, pid=1905] smbd/process.c:2473(housekeeping_fn)
>  housekeeping
>[2011/12/15 15:23:11.629021,  4, pid=1905] smbd/sec_ctx.c:314(set_sec_ctx)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2011/12/15 15:23:11.629048,  5, pid=1905] ../libcli/security/security_token.c:53(security_token_debug)
>  Security token: (NULL)
>[2011/12/15 15:23:11.629076,  5, pid=1905] auth/token_util.c:527(debug_unix_user_token)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2011/12/15 15:23:11.629130,  5, pid=1905] smbd/uid.c:400(change_to_root_user)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2011/12/15 15:23:11.629162, 10, pid=1905] smbd/process.c:873(smbd_idle_event_handler)
>  smbd_idle_event_handler: idle_evt(housekeeping) 0 rescheduled
>[2011/12/15 15:24:11.629265, 10, pid=1905] lib/events.c:221(run_events_poll)
>  Running timed event "smbd_idle_event_handler" 8bc2e90
>[2011/12/15 15:24:11.629386, 10, pid=1905] smbd/process.c:862(smbd_idle_event_handler)
>  smbd_idle_event_handler: idle_evt(deadtime) 0 called
>[2011/12/15 15:24:11.629417, 10, pid=1905] smbd/process.c:873(smbd_idle_event_handler)
>  smbd_idle_event_handler: idle_evt(deadtime) 0 rescheduled
>[2011/12/15 15:24:11.629450, 10, pid=1905] lib/events.c:221(run_events_poll)
>  Running timed event "smbd_idle_event_handler" 8bcdac0
>[2011/12/15 15:24:11.629477, 10, pid=1905] smbd/process.c:862(smbd_idle_event_handler)
>  smbd_idle_event_handler: idle_evt(housekeeping) 0 called
>[2011/12/15 15:24:11.629503,  5, pid=1905] smbd/process.c:2473(housekeeping_fn)
>  housekeeping
>[2011/12/15 15:24:11.629534,  4, pid=1905] smbd/sec_ctx.c:314(set_sec_ctx)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2011/12/15 15:24:11.629560,  5, pid=1905] ../libcli/security/security_token.c:53(security_token_debug)
>  Security token: (NULL)
>[2011/12/15 15:24:11.629589,  5, pid=1905] auth/token_util.c:527(debug_unix_user_token)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2011/12/15 15:24:11.629638,  5, pid=1905] smbd/uid.c:400(change_to_root_user)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2011/12/15 15:24:11.629670, 10, pid=1905] smbd/process.c:873(smbd_idle_event_handler)
>  smbd_idle_event_handler: idle_evt(housekeeping) 0 rescheduled

Actions: View

Attachments on bug 8660: 7179 | 7180 | 7181 | 7182 | 7190 | 7191 | 7192 | 7210 | 7235