Attachment 971 Details for Bug 2354 – This is a level 10 log from when it works (include = someplace/user-%U)

This is a level 10 log from when it works (include = someplace/user-%U)

log-when-works (text/plain), 999.35 KB, created by Gary Algier on 2005-02-17 10:30:57 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Gary Algier

Created: 2005-02-17 10:30:57 UTC

Size: 999.35 KB

patch

obsolete

>[2005/02/17 12:15:59, 0] lib/smbldap.c:smbldap_search_domain_info(1406)
>  Adding domain info for CARP failed with NT_STATUS_UNSUCCESSFUL
>[2005/02/17 12:16:07, 0] lib/util_sock.c:set_socket_options(202)
>  Failed to set socket option SO_KEEPALIVE (Error Invalid argument)
>[2005/02/17 12:16:07, 0] lib/util_sock.c:set_socket_options(202)
>  Failed to set socket option TCP_NODELAY (Error Invalid argument)
>[2005/02/17 12:16:07, 0] lib/util_sock.c:get_peer_addr(1150)
>  getpeername failed. Error was Transport endpoint is not connected
>[2005/02/17 12:16:07, 0] lib/util_sock.c:get_peer_addr(1150)
>  getpeername failed. Error was Transport endpoint is not connected
>[2005/02/17 12:16:07, 0] lib/util_sock.c:get_peer_addr(1150)
>  getpeername failed. Error was Transport endpoint is not connected
>[2005/02/17 12:16:07, 0] lib/util_sock.c:write_socket_data(430)
>  write_socket_data: write failure. Error = Broken pipe
>[2005/02/17 12:16:07, 0] lib/util_sock.c:write_socket(455)
>  write_socket: Error writing 4 bytes to socket 27: ERRNO = Broken pipe
>[2005/02/17 12:16:07, 0] lib/util_sock.c:send_smb(647)
>  Error writing 4 bytes to client. -1. (Broken pipe)
>[2005/02/17 12:16:07, 5] lib/debug.c:debug_dump_status(366)
>  INFO: Current debug levels:
>    all: True/10
>    tdb: False/0
>    printdrivers: False/0
>    lanman: False/0
>    smb: False/0
>    rpc_parse: False/0
>    rpc_srv: False/0
>    rpc_cli: False/0
>    passdb: False/0
>    sam: False/0
>    auth: False/0
>    winbind: False/0
>    vfs: False/0
>    idmap: False/0
>    quota: False/0
>    acls: False/0
>  doing parameter include = /etc/ulcmit/samba/carp/smb.conf.shares
>[2005/02/17 12:16:07, 3] param/params.c:pm_process(566)
>  params.c:pm_process() - Processing configuration file "/etc/ulcmit/samba/carp/smb.conf.shares"
>[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417)
>  Processing section "[homes]"
>[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310)
>  add_a_service: Creating snum = 0 for homes
>  doing parameter comment = My Corporate Directory
>  doing parameter path = /corp/%S
>  doing parameter valid users = %S
>  doing parameter browseable = no
>  doing parameter writable = yes
>  doing parameter directory mask = 0755
>  doing parameter create mask = 0755
>[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417)
>  Processing section "[users]"
>[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310)
>  add_a_service: Creating snum = 1 for users
>  doing parameter comment = Links to all the user's home directories
>  doing parameter path = /etc/ulcmit/samba/carp/users
>  doing parameter browseable = yes
>  doing parameter writable = no
>[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417)
>  Processing section "[hosts]"
>[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310)
>  add_a_service: Creating snum = 2 for hosts
>  doing parameter comment = Links to other file servers in the same NIS domain.
>  doing parameter path = /etc/ulcmit/samba/carp/hosts
>  doing parameter browseable = yes
>  doing parameter writable = no
>[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417)
>  Processing section "[public]"
>[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310)
>  add_a_service: Creating snum = 3 for public
>  doing parameter comment = Here are files for public consumption
>  doing parameter path = /etc/ulcmit/samba/carp/public
>  doing parameter browseable = yes
>  doing parameter writable = yes
>  doing parameter include = /etc/ulcmit/samba/carp/auto-config/user-%U
>[2005/02/17 12:16:07, 2] param/loadparm.c:handle_include(2804)
>  Can't find include file /etc/ulcmit/samba/carp/auto-config/user-
>  doing parameter include = /etc/ulcmit/samba/carp/smb.conf.oracleimp
>[2005/02/17 12:16:07, 3] param/params.c:pm_process(566)
>  params.c:pm_process() - Processing configuration file "/etc/ulcmit/samba/carp/smb.conf.oracleimp"
>[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417)
>  Processing section "[OracleImp]"
>[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310)
>  add_a_service: Creating snum = 4 for OracleImp
>  doing parameter comment = ES Group Oracle Implementation
>  doing parameter path = /corp/es/OracleImp
>  doing parameter writable = yes
>  doing parameter browsable = yes
>  doing parameter write list = @esora
>  doing parameter valid users = 
>  doing parameter map archive = no
>  doing parameter map hidden = no
>  doing parameter map system = no
>  doing parameter force directory mode = 02775
>  doing parameter force create mode = 0664
>  doing parameter directory mask = 02775
>  doing parameter create mask = 0664
>  doing parameter include = /etc/ulcmit/samba/carp/smb.conf.q-train
>[2005/02/17 12:16:07, 3] param/params.c:pm_process(566)
>  params.c:pm_process() - Processing configuration file "/etc/ulcmit/samba/carp/smb.conf.q-train"
>[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417)
>  Processing section "[Q-Train]"
>[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310)
>  add_a_service: Creating snum = 5 for Q-Train
>  doing parameter comment = Quality Trainer
>  doing parameter path = /corp/qlty/q-train
>  doing parameter writable = yes
>  doing parameter browsable = yes
>  doing parameter valid users = 
>  doing parameter force group = qlty
>  doing parameter force user = qlty
>  doing parameter map archive = no
>  doing parameter map hidden = no
>  doing parameter map system = no
>  doing parameter force directory mode = 0777
>  doing parameter force create mode = 0666
>  doing parameter directory mask = 0777
>  doing parameter create mask = 0666
>[2005/02/17 12:16:07, 4] param/loadparm.c:lp_load(3929)
>  pm_process() returned Yes
>[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310)
>  add_a_service: Creating snum = 6 for IPC$
>[2005/02/17 12:16:07, 3] param/loadparm.c:lp_add_ipc(2392)
>  adding IPC service
>[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310)
>  add_a_service: Creating snum = 7 for ADMIN$
>[2005/02/17 12:16:07, 3] param/loadparm.c:lp_add_ipc(2392)
>  adding IPC service
>[2005/02/17 12:16:07, 10] param/loadparm.c:set_server_role(3847)
>  set_server_role: role = ROLE_STANDALONE
>[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81)
>  Substituting charset '646' for LOCALE
>[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81)
>  Substituting charset '646' for LOCALE
>[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81)
>  Substituting charset '646' for LOCALE
>[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81)
>  Substituting charset '646' for LOCALE
>[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81)
>  Substituting charset '646' for LOCALE
>[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81)
>  Substituting charset '646' for LOCALE
>[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81)
>  Substituting charset '646' for LOCALE
>[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81)
>  Substituting charset '646' for LOCALE
>[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81)
>  Substituting charset '646' for LOCALE
>[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81)
>  Substituting charset '646' for LOCALE
>[2005/02/17 12:16:07, 7] param/loadparm.c:lp_servicenumber(4039)
>  lp_servicenumber: couldn't find printers
>[2005/02/17 12:16:07, 3] printing/pcap.c:pcap_cache_reload(114)
>  reloading printcap cache
>[2005/02/17 12:16:07, 5] printing/print_cups.c:cups_cache_reload(71)
>  reloading cups printcap cache
>[2005/02/17 12:16:07, 10] printing/print_cups.c:cups_server(51)
>  cups server left to default localhost
>[2005/02/17 12:16:07, 3] printing/pcap.c:pcap_cache_reload(213)
>  reload status: ok
>[2005/02/17 12:16:07, 7] param/loadparm.c:lp_servicenumber(4039)
>  lp_servicenumber: couldn't find printers
>[2005/02/17 12:16:07, 7] param/loadparm.c:lp_servicenumber(4039)
>  lp_servicenumber: couldn't find printers
>[2005/02/17 12:16:07, 2] lib/interface.c:add_interface(79)
>  added interface ip=172.25.0.9 bcast=172.25.255.255 nmask=255.255.0.0
>[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147)
>  socket option SO_KEEPALIVE = 8
>[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147)
>  socket option SO_REUSEADDR = 4
>[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147)
>  socket option SO_BROADCAST = 0
>[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147)
>  socket option TCP_NODELAY = 1
>[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147)
>  socket option IPTOS_LOWDELAY = 0
>[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147)
>  socket option IPTOS_THROUGHPUT = 0
>[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147)
>  socket option SO_SNDBUF = 49152
>[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147)
>  socket option SO_RCVBUF = 49640
>[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(145)
>  Could not test socket option SO_SNDLOWAT.
>[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(145)
>  Could not test socket option SO_RCVLOWAT.
>[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(145)
>  Could not test socket option SO_SNDTIMEO.
>[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(145)
>  Could not test socket option SO_RCVTIMEO.
>[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147)
>  socket option SO_KEEPALIVE = 8
>[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147)
>  socket option SO_REUSEADDR = 4
>[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147)
>  socket option SO_BROADCAST = 0
>[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147)
>  socket option TCP_NODELAY = 1
>[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147)
>  socket option IPTOS_LOWDELAY = 0
>[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147)
>  socket option IPTOS_THROUGHPUT = 0
>[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147)
>  socket option SO_SNDBUF = 49152
>[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(147)
>  socket option SO_RCVBUF = 49640
>[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(145)
>  Could not test socket option SO_SNDLOWAT.
>[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(145)
>  Could not test socket option SO_RCVLOWAT.
>[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(145)
>  Could not test socket option SO_SNDTIMEO.
>[2005/02/17 12:16:07, 5] lib/util_sock.c:print_socket_options(145)
>  Could not test socket option SO_RCVTIMEO.
>[2005/02/17 12:16:07, 3] smbd/oplock.c:init_oplocks(1345)
>  open_oplock_ipc: opening loopback UDP socket.
>[2005/02/17 12:16:07, 10] lib/util_sock.c:open_socket_in(717)
>  bind succeeded on port 0
>[2005/02/17 12:16:07, 3] smbd/oplock.c:init_oplocks(1376)
>  open_oplock ipc: pid = 13681, global_oplock_port = 33918
>[2005/02/17 12:16:07, 4] lib/time.c:get_serverzone(122)
>  Serverzone is 18000
>[2005/02/17 12:16:07, 10] lib/smbldap.c:smbldap_idle_fn(1186)
>  ldap connection not idle...
>[2005/02/17 12:16:07, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 133
>[2005/02/17 12:16:07, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x85
>[2005/02/17 12:16:07, 3] smbd/process.c:process_smb(1091)
>  Transaction 0 of length 137
>[2005/02/17 12:16:07, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:07, 5] lib/util.c:show_msg(474)
>  size=133
>  smb_com=0x72
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51283
>  smb_tid=0
>  smb_pid=65279
>  smb_uid=0
>  smb_mid=0
>  smt_wct=0
>  smb_bcc=98
>[2005/02/17 12:16:07, 10] lib/util.c:dump_data(1990)
>  [000] 02 50 43 20 4E 45 54 57  4F 52 4B 20 50 52 4F 47  .PC NETW ORK PROG
>  [010] 52 41 4D 20 31 2E 30 00  02 4C 41 4E 4D 41 4E 31  RAM 1.0. .LANMAN1
>  [020] 2E 30 00 02 57 69 6E 64  6F 77 73 20 66 6F 72 20  .0..Wind ows for 
>  [030] 57 6F 72 6B 67 72 6F 75  70 73 20 33 2E 31 61 00  Workgrou ps 3.1a.
>  [040] 02 4C 4D 31 2E 32 58 30  30 32 00 02 4C 41 4E 4D  .LM1.2X0 02..LANM
>  [050] 41 4E 32 2E 31 00 02 4E  54 20 4C 4D 20 30 2E 31  AN2.1..N T LM 0.1
>  [060] 32 00                                             2. 
>[2005/02/17 12:16:07, 3] smbd/process.c:switch_message(886)
>  switch message SMBnegprot (pid 13681) conn 0x0
>[2005/02/17 12:16:07, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2005/02/17 12:16:07, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2005/02/17 12:16:07, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2005/02/17 12:16:07, 5] smbd/uid.c:change_to_root_user(296)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2005/02/17 12:16:07, 3] smbd/negprot.c:reply_negprot(461)
>  Requested protocol [PC NETWORK PROGRAM 1.0]
>[2005/02/17 12:16:07, 3] smbd/negprot.c:reply_negprot(461)
>  Requested protocol [LANMAN1.0]
>[2005/02/17 12:16:07, 3] smbd/negprot.c:reply_negprot(461)
>  Requested protocol [Windows for Workgroups 3.1a]
>[2005/02/17 12:16:07, 3] smbd/negprot.c:reply_negprot(461)
>  Requested protocol [LM1.2X002]
>[2005/02/17 12:16:07, 3] smbd/negprot.c:reply_negprot(461)
>  Requested protocol [LANMAN2.1]
>[2005/02/17 12:16:07, 3] smbd/negprot.c:reply_negprot(461)
>  Requested protocol [NT LM 0.12]
>[2005/02/17 12:16:07, 10] lib/util.c:set_remote_arch(1965)
>  set_remote_arch: Client arch is 'Win2K'
>[2005/02/17 12:16:07, 6] param/loadparm.c:lp_file_list_changed(2698)
>  lp_file_list_changed()
>  file /etc/ulcmit/samba/carp/smb.conf.q-train -> /etc/ulcmit/samba/carp/smb.conf.q-train  last mod_time: Wed May  1 08:38:33 2002
>  
>  file /etc/ulcmit/samba/carp/smb.conf.oracleimp -> /etc/ulcmit/samba/carp/smb.conf.oracleimp  last mod_time: Thu May  2 15:57:49 2002
>  
>  file /etc/ulcmit/samba/carp/auto-config/user-%U -> /etc/ulcmit/samba/carp/auto-config/user-  last mod_time: Wed Dec 31 19:00:00 1969
>  
>  file /etc/ulcmit/samba/carp/smb.conf.shares -> /etc/ulcmit/samba/carp/smb.conf.shares  last mod_time: Thu Feb 17 10:14:42 2005
>  
>  file /etc/ulcmit/samba/carp/smb.conf.ip-%I -> /etc/ulcmit/samba/carp/smb.conf.ip-172.25.32.13  last mod_time: Thu Feb 17 12:12:56 2005
>  
>  file /etc/ulcmit/samba/carp/smb.conf -> /etc/ulcmit/samba/carp/smb.conf  last mod_time: Thu Feb 17 12:13:35 2005
>  
>[2005/02/17 12:16:07, 5] smbd/connection.c:claim_connection(170)
>  claiming  0
>[2005/02/17 12:16:07, 6] param/loadparm.c:lp_file_list_changed(2698)
>  lp_file_list_changed()
>  file /etc/ulcmit/samba/carp/smb.conf.q-train -> /etc/ulcmit/samba/carp/smb.conf.q-train  last mod_time: Wed May  1 08:38:33 2002
>  
>  file /etc/ulcmit/samba/carp/smb.conf.oracleimp -> /etc/ulcmit/samba/carp/smb.conf.oracleimp  last mod_time: Thu May  2 15:57:49 2002
>  
>  file /etc/ulcmit/samba/carp/auto-config/user-%U -> /etc/ulcmit/samba/carp/auto-config/user-  last mod_time: Wed Dec 31 19:00:00 1969
>  
>  file /etc/ulcmit/samba/carp/smb.conf.shares -> /etc/ulcmit/samba/carp/smb.conf.shares  last mod_time: Thu Feb 17 10:14:42 2005
>  
>  file /etc/ulcmit/samba/carp/smb.conf.ip-%I -> /etc/ulcmit/samba/carp/smb.conf.ip-172.25.32.13  last mod_time: Thu Feb 17 12:12:56 2005
>  
>  file /etc/ulcmit/samba/carp/smb.conf -> /etc/ulcmit/samba/carp/smb.conf  last mod_time: Thu Feb 17 12:13:35 2005
>  
>[2005/02/17 12:16:07, 3] smbd/negprot.c:reply_nt1(333)
>  using SPNEGO
>[2005/02/17 12:16:07, 3] smbd/negprot.c:reply_negprot(555)
>  Selected protocol NT LM 0.12
>[2005/02/17 12:16:07, 5] smbd/negprot.c:reply_negprot(561)
>  negprot index=5
>[2005/02/17 12:16:07, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:07, 5] lib/util.c:show_msg(474)
>  size=127
>  smb_com=0x72
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=0
>  smb_pid=65279
>  smb_uid=0
>  smb_mid=0
>  smt_wct=17
>  smb_vwv[ 0]=    5 (0x5)
>  smb_vwv[ 1]=12803 (0x3203)
>  smb_vwv[ 2]=  256 (0x100)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=   65 (0x41)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  256 (0x100)
>  smb_vwv[ 7]=28928 (0x7100)
>  smb_vwv[ 8]=   53 (0x35)
>  smb_vwv[ 9]=64768 (0xFD00)
>  smb_vwv[10]=32995 (0x80E3)
>  smb_vwv[11]=32896 (0x8080)
>  smb_vwv[12]=63525 (0xF825)
>  smb_vwv[13]= 5213 (0x145D)
>  smb_vwv[14]=50453 (0xC515)
>  smb_vwv[15]=11265 (0x2C01)
>  smb_vwv[16]=14849 (0x3A01)
>  smb_bcc=58
>[2005/02/17 12:16:07, 10] lib/util.c:dump_data(1990)
>  [000] 63 61 72 70 00 00 00 00  00 00 00 00 00 00 00 00  carp.... ........
>  [010] 60 28 06 06 2B 06 01 05  05 02 A0 1E 30 1C A0 0E  `(..+... ....0...
>  [020] 30 0C 06 0A 2B 06 01 04  01 82 37 02 02 0A A3 0A  0...+... ..7.....
>  [030] 30 08 A0 06 1B 04 4E 4F  4E 45                    0.....NO NE
>[2005/02/17 12:16:07, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,131)
>[2005/02/17 12:16:07, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,131) wrote 131
>[2005/02/17 12:16:07, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 206
>[2005/02/17 12:16:07, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0xce
>[2005/02/17 12:16:07, 3] smbd/process.c:process_smb(1091)
>  Transaction 1 of length 210
>[2005/02/17 12:16:07, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:07, 5] lib/util.c:show_msg(474)
>  size=206
>  smb_com=0x73
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=0
>  smb_pid=65279
>  smb_uid=0
>  smb_mid=50688
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=  206 (0xCE)
>  smb_vwv[ 2]=16644 (0x4104)
>  smb_vwv[ 3]=   50 (0x32)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=   74 (0x4A)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=  212 (0xD4)
>  smb_vwv[11]=32768 (0x8000)
>  smb_bcc=147
>[2005/02/17 12:16:07, 10] lib/util.c:dump_data(1990)
>  [000] 60 48 06 06 2B 06 01 05  05 02 A0 3E 30 3C A0 0E  `H..+... ...>0<..
>  [010] 30 0C 06 0A 2B 06 01 04  01 82 37 02 02 0A A2 2A  0...+... ..7....*
>  [020] 04 28 4E 54 4C 4D 53 53  50 00 01 00 00 00 97 82  .(NTLMSS P.......
>  [030] 08 E2 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........
>  [040] 00 00 05 00 93 08 00 00  00 0F 00 57 00 69 00 6E  ........ ...W.i.n
>  [050] 00 64 00 6F 00 77 00 73  00 20 00 32 00 30 00 30  .d.o.w.s . .2.0.0
>  [060] 00 30 00 20 00 32 00 31  00 39 00 35 00 00 00 57  .0. .2.1 .9.5...W
>  [070] 00 69 00 6E 00 64 00 6F  00 77 00 73 00 20 00 32  .i.n.d.o .w.s. .2
>  [080] 00 30 00 30 00 30 00 20  00 35 00 2E 00 30 00 00  .0.0.0.  .5...0..
>  [090] 00 00 00                                          ... 
>[2005/02/17 12:16:07, 3] smbd/process.c:switch_message(886)
>  switch message SMBsesssetupX (pid 13681) conn 0x0
>[2005/02/17 12:16:07, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2005/02/17 12:16:07, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2005/02/17 12:16:07, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2005/02/17 12:16:07, 5] smbd/uid.c:change_to_root_user(296)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2005/02/17 12:16:07, 3] smbd/sesssetup.c:reply_sesssetup_and_X(655)
>  wct=12 flg2=0xc807
>[2005/02/17 12:16:07, 2] smbd/sesssetup.c:setup_new_vc_session(608)
>  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
>[2005/02/17 12:16:07, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(535)
>  Doing spnego session setup
>[2005/02/17 12:16:07, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(566)
>  NativeOS=[Windows 2000 2195] NativeLanMan=[Windows 2000 5.0] PrimaryDomain=[]
>[2005/02/17 12:16:07, 3] smbd/sesssetup.c:reply_spnego_negotiate(444)
>  Got OID 1 3 6 1 4 1 311 2 2 10
>[2005/02/17 12:16:07, 3] smbd/sesssetup.c:reply_spnego_negotiate(447)
>  Got secblob of size 40
>[2005/02/17 12:16:07, 5] auth/auth.c:make_auth_context_subsystem(480)
>  Making default auth method list for standalone security=user, encrypt passwords = yes
>[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(45)
>  Attempting to register auth backend rhosts
>[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(57)
>  Successfully added auth method 'rhosts'
>[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(45)
>  Attempting to register auth backend hostsequiv
>[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(57)
>  Successfully added auth method 'hostsequiv'
>[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(45)
>  Attempting to register auth backend sam
>[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(57)
>  Successfully added auth method 'sam'
>[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(45)
>  Attempting to register auth backend sam_ignoredomain
>[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(57)
>  Successfully added auth method 'sam_ignoredomain'
>[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(45)
>  Attempting to register auth backend unix
>[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(57)
>  Successfully added auth method 'unix'
>[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(45)
>  Attempting to register auth backend winbind
>[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(57)
>  Successfully added auth method 'winbind'
>[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(45)
>  Attempting to register auth backend smbserver
>[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(57)
>  Successfully added auth method 'smbserver'
>[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(45)
>  Attempting to register auth backend trustdomain
>[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(57)
>  Successfully added auth method 'trustdomain'
>[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(45)
>  Attempting to register auth backend ntdomain
>[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(57)
>  Successfully added auth method 'ntdomain'
>[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(45)
>  Attempting to register auth backend guest
>[2005/02/17 12:16:07, 5] auth/auth.c:smb_register_auth(57)
>  Successfully added auth method 'guest'
>[2005/02/17 12:16:07, 5] auth/auth.c:load_auth_module(384)
>  load_auth_module: Attempting to find an auth method to match guest
>[2005/02/17 12:16:07, 5] auth/auth.c:load_auth_module(409)
>  load_auth_module: auth method guest has a valid init
>[2005/02/17 12:16:07, 5] auth/auth.c:load_auth_module(384)
>  load_auth_module: Attempting to find an auth method to match sam
>[2005/02/17 12:16:07, 5] auth/auth.c:load_auth_module(409)
>  load_auth_module: auth method sam has a valid init
>[2005/02/17 12:16:07, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(62)
>  Got NTLMSSP neg_flags=0xe2088297
>    NTLMSSP_NEGOTIATE_UNICODE
>    NTLMSSP_NEGOTIATE_OEM
>    NTLMSSP_REQUEST_TARGET
>    NTLMSSP_NEGOTIATE_SIGN
>    NTLMSSP_NEGOTIATE_LM_KEY
>    NTLMSSP_NEGOTIATE_NTLM
>    NTLMSSP_NEGOTIATE_ALWAYS_SIGN
>    NTLMSSP_NEGOTIATE_NTLM2
>    NTLMSSP_NEGOTIATE_128
>    NTLMSSP_NEGOTIATE_KEY_EXCH
>[2005/02/17 12:16:07, 5] auth/auth.c:get_ntlm_challenge(95)
>  auth_get_challenge: module guest did not want to specify a challenge
>[2005/02/17 12:16:07, 5] auth/auth.c:get_ntlm_challenge(95)
>  auth_get_challenge: module sam did not want to specify a challenge
>[2005/02/17 12:16:07, 5] auth/auth.c:get_ntlm_challenge(135)
>  auth_context challenge created by random
>[2005/02/17 12:16:07, 5] auth/auth.c:get_ntlm_challenge(136)
>  challenge is: 
>[2005/02/17 12:16:07, 5] lib/util.c:dump_data(1990)
>  [000] 34 46 61 70 FB 20 A3 F0                           4Fap. .. 
>[2005/02/17 12:16:07, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,276)
>[2005/02/17 12:16:07, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,276) wrote 276
>[2005/02/17 12:16:07, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 314
>[2005/02/17 12:16:07, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x13a
>[2005/02/17 12:16:07, 3] smbd/process.c:process_smb(1091)
>  Transaction 2 of length 318
>[2005/02/17 12:16:07, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:07, 5] lib/util.c:show_msg(474)
>  size=314
>  smb_com=0x73
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=0
>  smb_pid=65279
>  smb_uid=0
>  smb_mid=50752
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=  314 (0x13A)
>  smb_vwv[ 2]=16644 (0x4104)
>  smb_vwv[ 3]=   50 (0x32)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=  182 (0xB6)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=  212 (0xD4)
>  smb_vwv[11]=32768 (0x8000)
>  smb_bcc=255
>[2005/02/17 12:16:07, 10] lib/util.c:dump_data(1990)
>  [000] A1 81 B3 30 81 B0 A2 81  AD 04 81 AA 4E 54 4C 4D  ...0.... ....NTLM
>  [010] 53 53 50 00 03 00 00 00  18 00 18 00 6A 00 00 00  SSP..... ....j...
>  [020] 18 00 18 00 82 00 00 00  0E 00 0E 00 48 00 00 00  ........ ....H...
>  [030] 06 00 06 00 56 00 00 00  0E 00 0E 00 5C 00 00 00  ....V... ....\...
>  [040] 10 00 10 00 9A 00 00 00  15 82 88 62 05 00 93 08  ........ ...b....
>  [050] 00 00 00 0F 41 00 5A 00  55 00 52 00 49 00 54 00  ....A.Z. U.R.I.T.
>  [060] 45 00 67 00 61 00 61 00  41 00 5A 00 55 00 52 00  E.g.a.a. A.Z.U.R.
>  [070] 49 00 54 00 45 00 3B A8  02 5B 19 E2 43 28 00 00  I.T.E.;. .[..C(..
>  [080] 00 00 00 00 00 00 00 00  00 00 00 00 00 00 02 6F  ........ .......o
>  [090] 24 06 11 C5 07 89 EA C7  9F 99 A3 B2 FC 02 2F F0  $....... ....../.
>  [0A0] 3A 1B 8B B5 8E 41 B9 54  64 D8 6C 55 81 56 9B 95  :....A.T d.lU.V..
>  [0B0] C8 52 99 26 C0 50 00 57  00 69 00 6E 00 64 00 6F  .R.&.P.W .i.n.d.o
>  [0C0] 00 77 00 73 00 20 00 32  00 30 00 30 00 30 00 20  .w.s. .2 .0.0.0. 
>  [0D0] 00 32 00 31 00 39 00 35  00 00 00 57 00 69 00 6E  .2.1.9.5 ...W.i.n
>  [0E0] 00 64 00 6F 00 77 00 73  00 20 00 32 00 30 00 30  .d.o.w.s . .2.0.0
>  [0F0] 00 30 00 20 00 35 00 2E  00 30 00 00 00 00 00     .0. .5.. .0.....
>[2005/02/17 12:16:07, 3] smbd/process.c:switch_message(886)
>  switch message SMBsesssetupX (pid 13681) conn 0x0
>[2005/02/17 12:16:07, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2005/02/17 12:16:07, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2005/02/17 12:16:07, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2005/02/17 12:16:07, 5] smbd/uid.c:change_to_root_user(296)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2005/02/17 12:16:07, 3] smbd/sesssetup.c:reply_sesssetup_and_X(655)
>  wct=12 flg2=0xc807
>[2005/02/17 12:16:07, 2] smbd/sesssetup.c:setup_new_vc_session(608)
>  setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
>[2005/02/17 12:16:07, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(535)
>  Doing spnego session setup
>[2005/02/17 12:16:07, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(566)
>  NativeOS=[Windows 2000 2195] NativeLanMan=[Windows 2000 5.0] PrimaryDomain=[]
>[2005/02/17 12:16:07, 3] libsmb/ntlmssp.c:ntlmssp_server_auth(615)
>  Got user=[gaa] domain=[AZURITE] workstation=[AZURITE] len1=24 len2=24
>[2005/02/17 12:16:07, 5] auth/auth_ntlmssp.c:auth_ntlmssp_set_challenge(66)
>  auth_context challenge set by NTLMSSP callback (NTLM2)
>[2005/02/17 12:16:07, 5] auth/auth_ntlmssp.c:auth_ntlmssp_set_challenge(67)
>  challenge is: 
>[2005/02/17 12:16:07, 5] lib/util.c:dump_data(1990)
>  [000] BC EA B7 0E B4 58 F8 01                           .....X.. 
>[2005/02/17 12:16:07, 6] param/loadparm.c:lp_file_list_changed(2698)
>  lp_file_list_changed()
>  file /etc/ulcmit/samba/carp/smb.conf.q-train -> /etc/ulcmit/samba/carp/smb.conf.q-train  last mod_time: Wed May  1 08:38:33 2002
>  
>  file /etc/ulcmit/samba/carp/smb.conf.oracleimp -> /etc/ulcmit/samba/carp/smb.conf.oracleimp  last mod_time: Thu May  2 15:57:49 2002
>  
>  file /etc/ulcmit/samba/carp/auto-config/user-%U -> /etc/ulcmit/samba/carp/auto-config/user-gaa  last mod_time: Wed Dec 31 19:00:00 1969
>  
>  file /etc/ulcmit/samba/carp/auto-config/user-gaa modified: Thu Feb 17 10:22:09 2005
>  
>[2005/02/17 12:16:07, 5] param/loadparm.c:free_service(2205)
>  free_service: Freeing service homes
>[2005/02/17 12:16:07, 5] param/loadparm.c:free_service(2205)
>  free_service: Freeing service users
>[2005/02/17 12:16:07, 5] param/loadparm.c:free_service(2205)
>  free_service: Freeing service hosts
>[2005/02/17 12:16:07, 5] param/loadparm.c:free_service(2205)
>  free_service: Freeing service public
>[2005/02/17 12:16:07, 5] param/loadparm.c:free_service(2205)
>  free_service: Freeing service OracleImp
>[2005/02/17 12:16:07, 5] param/loadparm.c:free_service(2205)
>  free_service: Freeing service Q-Train
>[2005/02/17 12:16:07, 5] param/loadparm.c:free_service(2205)
>  free_service: Freeing service IPC$
>[2005/02/17 12:16:07, 5] param/loadparm.c:free_service(2205)
>  free_service: Freeing service ADMIN$
>[2005/02/17 12:16:07, 3] param/loadparm.c:lp_load(3898)
>  lp_load: refreshing parameters
>[2005/02/17 12:16:07, 3] param/loadparm.c:init_globals(1314)
>  Initialising global parameters
>[2005/02/17 12:16:07, 3] param/params.c:pm_process(566)
>  params.c:pm_process() - Processing configuration file "/etc/ulcmit/samba/carp/smb.conf"
>[2005/02/17 12:16:07, 3] param/loadparm.c:do_section(3400)
>  Processing section "[global]"
>  doing parameter netbios name = carp
>[2005/02/17 12:16:07, 4] param/loadparm.c:handle_netbios_name(2745)
>  handle_netbios_name: set global_myname to: CARP
>  doing parameter server string = Carp -- a test instance of Corp
>  doing parameter interfaces = 172.25.0.9
>  doing parameter private dir = /var/ulcmit/samba/carp/private
>  doing parameter smb passwd file = /var/ulcmit/samba/carp/private/smbpasswd
>  doing parameter lock directory = /var/ulcmit/samba/carp/locks
>  doing parameter pid directory = /var/ulcmit/samba/carp/locks
>  doing parameter log level = 0
>[2005/02/17 12:16:07, 5] lib/debug.c:debug_dump_status(366)
>  INFO: Current debug levels:
>    all: True/10
>    tdb: False/0
>    printdrivers: False/0
>    lanman: False/0
>    smb: False/0
>    rpc_parse: False/0
>    rpc_srv: False/0
>    rpc_cli: False/0
>    passdb: False/0
>    sam: False/0
>    auth: False/0
>    winbind: False/0
>    vfs: False/0
>    idmap: False/0
>    quota: False/0
>    acls: False/0
>  doing parameter include = /etc/ulcmit/samba/carp/smb.conf.shares
>[2005/02/17 12:16:07, 3] param/params.c:pm_process(566)
>  params.c:pm_process() - Processing configuration file "/etc/ulcmit/samba/carp/smb.conf.shares"
>[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417)
>  Processing section "[homes]"
>[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310)
>  add_a_service: Creating snum = 0 for homes
>  doing parameter comment = My Corporate Directory
>  doing parameter path = /corp/%S
>  doing parameter valid users = %S
>  doing parameter browseable = no
>  doing parameter writable = yes
>  doing parameter directory mask = 0755
>  doing parameter create mask = 0755
>[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417)
>  Processing section "[users]"
>[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310)
>  add_a_service: Creating snum = 1 for users
>  doing parameter comment = Links to all the user's home directories
>  doing parameter path = /etc/ulcmit/samba/carp/users
>  doing parameter browseable = yes
>  doing parameter writable = no
>[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417)
>  Processing section "[hosts]"
>[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310)
>  add_a_service: Creating snum = 2 for hosts
>  doing parameter comment = Links to other file servers in the same NIS domain.
>  doing parameter path = /etc/ulcmit/samba/carp/hosts
>  doing parameter browseable = yes
>  doing parameter writable = no
>[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417)
>  Processing section "[public]"
>[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310)
>  add_a_service: Creating snum = 3 for public
>  doing parameter comment = Here are files for public consumption
>  doing parameter path = /etc/ulcmit/samba/carp/public
>  doing parameter browseable = yes
>  doing parameter writable = yes
>  doing parameter include = /etc/ulcmit/samba/carp/auto-config/user-%U
>[2005/02/17 12:16:07, 3] param/params.c:pm_process(566)
>  params.c:pm_process() - Processing configuration file "/etc/ulcmit/samba/carp/auto-config/user-gaa"
>[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417)
>  Processing section "[doc-grp]"
>[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310)
>  add_a_service: Creating snum = 4 for doc-grp
>  doing parameter comment = /corp/doc/group -- Group Only Share
>  doing parameter path = /corp/doc/group
>  doing parameter writable = yes
>  doing parameter browsable = yes
>  doing parameter write list = @doc
>  doing parameter valid users = +doc
>  doing parameter force group = doc
>  doing parameter force user = doc
>  doing parameter map archive = no
>  doing parameter map hidden = no
>  doing parameter map system = no
>  doing parameter force directory mode = 02750
>  doing parameter force create mode = 0660
>  doing parameter directory mask = 02750
>  doing parameter create mask = 0660
>[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417)
>  Processing section "[doc-pub]"
>[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310)
>  add_a_service: Creating snum = 5 for doc-pub
>  doing parameter comment = /corp/doc/public -- Publicly Readable Share
>  doing parameter path = /corp/doc/public
>  doing parameter writable = yes
>  doing parameter browsable = yes
>  doing parameter write list = @doc
>  doing parameter valid users = +doc
>  doing parameter force group = doc
>  doing parameter force user = doc
>  doing parameter map archive = no
>  doing parameter map hidden = no
>  doing parameter map system = no
>  doing parameter force directory mode = 02755
>  doing parameter force create mode = 0664
>  doing parameter directory mask = 02755
>  doing parameter create mask = 0664
>[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417)
>  Processing section "[doc-web]"
>[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310)
>  add_a_service: Creating snum = 6 for doc-web
>  doing parameter comment = /corp/doc/public_html -- Group's webspace
>  doing parameter path = /corp/doc/public_html
>  doing parameter writable = yes
>  doing parameter browsable = yes
>  doing parameter write list = @doc
>  doing parameter valid users = +doc
>  doing parameter force group = doc
>  doing parameter force user = doc
>  doing parameter map archive = no
>  doing parameter map hidden = no
>  doing parameter map system = no
>  doing parameter force directory mode = 02755
>  doing parameter force create mode = 0664
>  doing parameter directory mask = 02755
>  doing parameter create mask = 0664
>[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417)
>  Processing section "[hradm-grp]"
>[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310)
>  add_a_service: Creating snum = 7 for hradm-grp
>  doing parameter comment = /u/hradm/group -- Group Only Share
>  doing parameter path = /u/hradm/group
>  doing parameter writable = yes
>  doing parameter browsable = yes
>  doing parameter write list = @hradm
>  doing parameter valid users = +hradm
>  doing parameter force group = hradm
>  doing parameter force user = hradm
>  doing parameter map archive = no
>  doing parameter map hidden = no
>  doing parameter map system = no
>  doing parameter force directory mode = 02750
>  doing parameter force create mode = 0660
>  doing parameter directory mask = 02750
>  doing parameter create mask = 0660
>[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417)
>  Processing section "[hradm-pub]"
>[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310)
>  add_a_service: Creating snum = 8 for hradm-pub
>  doing parameter comment = /u/hradm/public -- Publicly Readable Share
>  doing parameter path = /u/hradm/public
>  doing parameter writable = yes
>  doing parameter browsable = yes
>  doing parameter write list = @hradm
>  doing parameter valid users = +hradm
>  doing parameter force group = hradm
>  doing parameter force user = hradm
>  doing parameter map archive = no
>  doing parameter map hidden = no
>  doing parameter map system = no
>  doing parameter force directory mode = 02755
>  doing parameter force create mode = 0664
>  doing parameter directory mask = 02755
>  doing parameter create mask = 0664
>[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417)
>  Processing section "[hradm-web]"
>[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310)
>  add_a_service: Creating snum = 9 for hradm-web
>  doing parameter comment = /u/hradm/public_html -- Group's webspace
>  doing parameter path = /u/hradm/public_html
>  doing parameter writable = yes
>  doing parameter browsable = yes
>  doing parameter write list = @hradm
>  doing parameter valid users = +hradm
>  doing parameter force group = hradm
>  doing parameter force user = hradm
>  doing parameter map archive = no
>  doing parameter map hidden = no
>  doing parameter map system = no
>  doing parameter force directory mode = 02755
>  doing parameter force create mode = 0664
>  doing parameter directory mask = 02755
>  doing parameter create mask = 0664
>[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417)
>  Processing section "[it-grp]"
>[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310)
>  add_a_service: Creating snum = 10 for it-grp
>  doing parameter comment = /corp/it/group -- Group Only Share
>  doing parameter path = /corp/it/group
>  doing parameter writable = yes
>  doing parameter browsable = yes
>  doing parameter write list = @it
>  doing parameter force group = +it
>  doing parameter valid users = +it
>  doing parameter force directory mode = 02770
>  doing parameter force create mode = 0770
>  doing parameter directory mask = 02770
>  doing parameter create mask = 0770
>[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417)
>  Processing section "[it-pub]"
>[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310)
>  add_a_service: Creating snum = 11 for it-pub
>  doing parameter comment = /corp/it/public -- Publicly Readable Share
>  doing parameter path = /corp/it/public
>  doing parameter writable = yes
>  doing parameter browsable = yes
>  doing parameter write list = @it
>  doing parameter force group = +it
>  doing parameter valid users = +it
>  doing parameter force user = it
>  doing parameter force directory mode = 02755
>  doing parameter force create mode = 0755
>  doing parameter directory mask = 02755
>  doing parameter create mask = 0755
>  doing parameter include = /etc/ulcmit/samba/carp/smb.conf.oracleimp
>[2005/02/17 12:16:07, 3] param/params.c:pm_process(566)
>  params.c:pm_process() - Processing configuration file "/etc/ulcmit/samba/carp/smb.conf.oracleimp"
>[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417)
>  Processing section "[OracleImp]"
>[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310)
>  add_a_service: Creating snum = 12 for OracleImp
>  doing parameter comment = ES Group Oracle Implementation
>  doing parameter path = /corp/es/OracleImp
>  doing parameter writable = yes
>  doing parameter browsable = yes
>  doing parameter write list = @esora
>  doing parameter valid users = 
>  doing parameter map archive = no
>  doing parameter map hidden = no
>  doing parameter map system = no
>  doing parameter force directory mode = 02775
>  doing parameter force create mode = 0664
>  doing parameter directory mask = 02775
>  doing parameter create mask = 0664
>  doing parameter include = /etc/ulcmit/samba/carp/smb.conf.q-train
>[2005/02/17 12:16:07, 3] param/params.c:pm_process(566)
>  params.c:pm_process() - Processing configuration file "/etc/ulcmit/samba/carp/smb.conf.q-train"
>[2005/02/17 12:16:07, 2] param/loadparm.c:do_section(3417)
>  Processing section "[Q-Train]"
>[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310)
>  add_a_service: Creating snum = 13 for Q-Train
>  doing parameter comment = Quality Trainer
>  doing parameter path = /corp/qlty/q-train
>  doing parameter writable = yes
>  doing parameter browsable = yes
>  doing parameter valid users = 
>  doing parameter force group = qlty
>  doing parameter force user = qlty
>  doing parameter map archive = no
>  doing parameter map hidden = no
>  doing parameter map system = no
>  doing parameter force directory mode = 0777
>  doing parameter force create mode = 0666
>  doing parameter directory mask = 0777
>  doing parameter create mask = 0666
>[2005/02/17 12:16:07, 4] param/loadparm.c:lp_load(3929)
>  pm_process() returned Yes
>[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310)
>  add_a_service: Creating snum = 14 for IPC$
>[2005/02/17 12:16:07, 3] param/loadparm.c:lp_add_ipc(2392)
>  adding IPC service
>[2005/02/17 12:16:07, 8] param/loadparm.c:add_a_service(2310)
>  add_a_service: Creating snum = 15 for ADMIN$
>[2005/02/17 12:16:07, 3] param/loadparm.c:lp_add_ipc(2392)
>  adding IPC service
>[2005/02/17 12:16:07, 10] param/loadparm.c:set_server_role(3847)
>  set_server_role: role = ROLE_STANDALONE
>[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81)
>  Substituting charset '646' for LOCALE
>[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81)
>  Substituting charset '646' for LOCALE
>[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81)
>  Substituting charset '646' for LOCALE
>[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81)
>  Substituting charset '646' for LOCALE
>[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81)
>  Substituting charset '646' for LOCALE
>[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81)
>  Substituting charset '646' for LOCALE
>[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81)
>  Substituting charset '646' for LOCALE
>[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81)
>  Substituting charset '646' for LOCALE
>[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81)
>  Substituting charset '646' for LOCALE
>[2005/02/17 12:16:07, 5] lib/charcnv.c:charset_name(81)
>  Substituting charset '646' for LOCALE
>[2005/02/17 12:16:07, 7] param/loadparm.c:lp_servicenumber(4039)
>  lp_servicenumber: couldn't find printers
>[2005/02/17 12:16:07, 3] printing/pcap.c:pcap_cache_reload(114)
>  reloading printcap cache
>[2005/02/17 12:16:07, 5] printing/print_cups.c:cups_cache_reload(71)
>  reloading cups printcap cache
>[2005/02/17 12:16:07, 10] printing/print_cups.c:cups_server(51)
>  cups server left to default localhost
>[2005/02/17 12:16:08, 3] printing/pcap.c:pcap_cache_reload(213)
>  reload status: ok
>[2005/02/17 12:16:08, 7] param/loadparm.c:lp_servicenumber(4039)
>  lp_servicenumber: couldn't find printers
>[2005/02/17 12:16:08, 7] param/loadparm.c:lp_servicenumber(4039)
>  lp_servicenumber: couldn't find printers
>[2005/02/17 12:16:08, 2] lib/interface.c:add_interface(79)
>  added interface ip=172.25.0.9 bcast=172.25.255.255 nmask=255.255.0.0
>[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147)
>  socket option SO_KEEPALIVE = 8
>[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147)
>  socket option SO_REUSEADDR = 4
>[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147)
>  socket option SO_BROADCAST = 0
>[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147)
>  socket option TCP_NODELAY = 1
>[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147)
>  socket option IPTOS_LOWDELAY = 0
>[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147)
>  socket option IPTOS_THROUGHPUT = 0
>[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147)
>  socket option SO_SNDBUF = 49152
>[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147)
>  socket option SO_RCVBUF = 49640
>[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(145)
>  Could not test socket option SO_SNDLOWAT.
>[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(145)
>  Could not test socket option SO_RCVLOWAT.
>[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(145)
>  Could not test socket option SO_SNDTIMEO.
>[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(145)
>  Could not test socket option SO_RCVTIMEO.
>[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147)
>  socket option SO_KEEPALIVE = 8
>[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147)
>  socket option SO_REUSEADDR = 4
>[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147)
>  socket option SO_BROADCAST = 0
>[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147)
>  socket option TCP_NODELAY = 1
>[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147)
>  socket option IPTOS_LOWDELAY = 0
>[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147)
>  socket option IPTOS_THROUGHPUT = 0
>[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147)
>  socket option SO_SNDBUF = 49152
>[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(147)
>  socket option SO_RCVBUF = 49640
>[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(145)
>  Could not test socket option SO_SNDLOWAT.
>[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(145)
>  Could not test socket option SO_RCVLOWAT.
>[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(145)
>  Could not test socket option SO_SNDTIMEO.
>[2005/02/17 12:16:08, 5] lib/util_sock.c:print_socket_options(145)
>  Could not test socket option SO_RCVTIMEO.
>[2005/02/17 12:16:08, 5] auth/auth_util.c:make_user_info_map(225)
>  make_user_info_map: Mapping user [AZURITE]\[gaa] from workstation [AZURITE]
>[2005/02/17 12:16:08, 5] auth/auth_util.c:make_user_info(133)
>  attempting to make a user_info for gaa (gaa)
>[2005/02/17 12:16:08, 5] auth/auth_util.c:make_user_info(143)
>  making strings for gaa's user_info struct
>[2005/02/17 12:16:08, 5] auth/auth_util.c:make_user_info(185)
>  making blobs for gaa's user_info struct
>[2005/02/17 12:16:08, 10] auth/auth_util.c:make_user_info(201)
>  made an encrypted user_info for gaa (gaa)
>[2005/02/17 12:16:08, 3] auth/auth.c:check_ntlm_password(219)
>  check_ntlm_password:  Checking password for unmapped user [AZURITE]\[gaa]@[AZURITE] with the new password interface
>[2005/02/17 12:16:08, 3] auth/auth.c:check_ntlm_password(222)
>  check_ntlm_password:  mapped user is: [CARP]\[gaa]@[AZURITE]
>[2005/02/17 12:16:08, 10] auth/auth.c:check_ntlm_password(231)
>  check_ntlm_password: auth_context challenge created by NTLMSSP callback (NTLM2)
>[2005/02/17 12:16:08, 10] auth/auth.c:check_ntlm_password(233)
>  challenge is: 
>[2005/02/17 12:16:08, 5] lib/util.c:dump_data(1990)
>  [000] BC EA B7 0E B4 58 F8 01                           .....X.. 
>[2005/02/17 12:16:08, 10] auth/auth.c:check_ntlm_password(259)
>  check_ntlm_password: guest had nothing to say
>[2005/02/17 12:16:08, 8] lib/util.c:is_myname(1810)
>  is_myname("CARP") returns 1
>[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:push_sec_ctx(256)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
>[2005/02/17 12:16:08, 3] smbd/uid.c:push_conn_ctx(365)
>  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
>[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_search(1031)
>  smbldap_search: base => [dc=ulticom,dc=com], filter => [(&(uid=gaa)(objectclass=sambaSamAccount))], scope => [2]
>[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_close(939)
>  The connection to the LDAP server was closed
>[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_close(939)
>  The connection to the LDAP server was closed
>[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_open_connection(596)
>  smbldap_open_connection: ldap://ldap.ulticom.com
>[2005/02/17 12:16:08, 2] lib/smbldap.c:smbldap_open_connection(692)
>  smbldap_open_connection: connection opened
>[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_connect_system(824)
>  ldap_connect_system: Binding to ldap server ldap://ldap.ulticom.com as "uid=sambaAdmin,ou=Directory Administrators,dc=ulticom,dc=com"
>[2005/02/17 12:16:08, 3] lib/smbldap.c:smbldap_connect_system(866)
>  ldap_connect_system: succesful connection to the LDAP server
>  ldap_connect_system: LDAP server does not support paged results
>[2005/02/17 12:16:08, 4] lib/smbldap.c:smbldap_open(919)
>  The LDAP server is succesfully connected
>[2005/02/17 12:16:08, 2] passdb/pdb_ldap.c:init_sam_from_ldap(512)
>  init_sam_from_ldap: Entry found for user: gaa
>[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_username(617)
>  pdb_set_username: setting username gaa, was 
>[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_domain(644)
>  pdb_set_domain: setting domain CARP, was 
>[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_nt_username(671)
>  pdb_set_nt_username: setting nt username gaa, was 
>[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_user_sid_from_string(557)
>  pdb_set_user_sid_from_string: setting user sid S-1-5-21-104134243-2275341451-782570472-1804
>[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_user_sid(544)
>  pdb_set_user_sid: setting user sid S-1-5-21-104134243-2275341451-782570472-1804
>[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_group_sid_from_string(592)
>  pdb_set_group_sid_from_string: setting group sid S-1-5-21-104134243-2275341451-782570472-3205
>[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_group_sid(580)
>  pdb_set_group_sid: setting group sid S-1-5-21-104134243-2275341451-782570472-3205
>[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
>  smbldap_get_single_attribute: [sambaLogonTime] = [<does not exist>]
>[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
>  smbldap_get_single_attribute: [sambaLogoffTime] = [<does not exist>]
>[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
>  smbldap_get_single_attribute: [sambaKickoffTime] = [<does not exist>]
>[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
>  smbldap_get_single_attribute: [displayName] = [<does not exist>]
>[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_fullname(698)
>  pdb_set_full_name: setting full name Gary Algier, was 
>[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(779)
>  pdb_set_dir_drive: setting dir drive H, was NULL
>[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_homedir(806)
>  pdb_set_homedir: setting home dir \\corp\gaa, was 
>[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
>  smbldap_get_single_attribute: [sambaLogonScript] = [<does not exist>]
>[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_logon_script(725)
>  pdb_set_logon_script: setting logon script , was 
>[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
>  smbldap_get_single_attribute: [sambaProfilePath] = [<does not exist>]
>[2005/02/17 12:16:08, 4] lib/substitute.c:automount_server(335)
>  Home server: carp
>[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_profile_path(752)
>  pdb_set_profile_path: setting profile path \\carp\gaa\profile, was 
>[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
>  smbldap_get_single_attribute: [description] = [<does not exist>]
>[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
>  smbldap_get_single_attribute: [sambaUserWorkstations] = [<does not exist>]
>[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
>  smbldap_get_single_attribute: [sambaMungedDial] = [<does not exist>]
>[2005/02/17 12:16:08, 10] lib/account_pol.c:account_policy_get(210)
>  account_policy_get: password history:0
>[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
>  smbldap_get_single_attribute: [sambaBadPasswordCount] = [<does not exist>]
>[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
>  smbldap_get_single_attribute: [sambaBadPasswordTime] = [<does not exist>]
>[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_get_single_attribute(358)
>  smbldap_get_single_attribute: [sambaLogonHours] = [<does not exist>]
>[2005/02/17 12:16:08, 5] passdb/login_cache.c:login_cache_init(41)
>  Opening cache file at /var/ulcmit/samba/carp/locks/login_cache.tdb
>[2005/02/17 12:16:08, 7] passdb/login_cache.c:login_cache_read(83)
>  Looking up login cache for user gaa
>[2005/02/17 12:16:08, 7] passdb/login_cache.c:login_cache_read(97)
>  No cache entry found
>[2005/02/17 12:16:08, 9] passdb/pdb_ldap.c:init_sam_from_ldap(836)
>  No cache entry, bad count = 0, bad time = 0
>[2005/02/17 12:16:08, 10] lib/account_pol.c:account_policy_get(210)
>  account_policy_get: password history:0
>[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_username(617)
>  pdb_set_username: setting username gaa, was 
>[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_domain(644)
>  pdb_set_domain: setting domain CARP, was 
>[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_nt_username(671)
>  pdb_set_nt_username: setting nt username gaa, was 
>[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_fullname(698)
>  pdb_set_full_name: setting full name Gary Algier, was 
>[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_homedir(806)
>  pdb_set_homedir: setting home dir \\corp\gaa, was 
>[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(779)
>  pdb_set_dir_drive: setting dir drive H, was NULL
>[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_logon_script(725)
>  pdb_set_logon_script: setting logon script , was 
>[2005/02/17 12:16:08, 4] lib/substitute.c:automount_server(335)
>  Home server: carp
>[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_profile_path(752)
>  pdb_set_profile_path: setting profile path \\carp\gaa\profile, was 
>[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_workstations(885)
>  pdb_set_workstations: setting workstations , was 
>[2005/02/17 12:16:08, 10] lib/account_pol.c:account_policy_get(210)
>  account_policy_get: password history:0
>[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_user_sid(544)
>  pdb_set_user_sid: setting user sid S-1-5-21-3834718897-2476707436-3842496652-0
>[2005/02/17 12:16:08, 10] passdb/pdb_compat.c:pdb_set_user_sid_from_rid(73)
>  pdb_set_user_sid_from_rid:
>  	setting user sid S-1-5-21-3834718897-2476707436-3842496652-0 from rid 0
>[2005/02/17 12:16:08, 10] passdb/pdb_get_set.c:pdb_set_group_sid(580)
>  pdb_set_group_sid: setting group sid S-1-5-21-3834718897-2476707436-3842496652-0
>[2005/02/17 12:16:08, 10] passdb/pdb_compat.c:pdb_set_group_sid_from_rid(100)
>  pdb_set_group_sid_from_rid:
>  	setting group sid S-1-5-21-3834718897-2476707436-3842496652-0 from rid 0
>[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2005/02/17 12:16:08, 9] passdb/passdb.c:pdb_update_autolock_flag(2348)
>  pdb_update_autolock_flag: Account gaa not autolocked, no check needed
>[2005/02/17 12:16:08, 4] libsmb/ntlm_check.c:ntlm_password_check(326)
>  ntlm_password_check: Checking NT MD4 password
>[2005/02/17 12:16:08, 4] auth/auth_sam.c:sam_account_ok(119)
>  sam_account_ok: Checking SMB password for user gaa
>[2005/02/17 12:16:08, 5] auth/auth_sam.c:logon_hours_ok(101)
>  logon_hours_ok: user gaa allowed to logon at this time (Thu Feb 17 12:16:08 2005
>  )
>[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:push_sec_ctx(256)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
>[2005/02/17 12:16:08, 3] smbd/uid.c:push_conn_ctx(365)
>  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
>[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2005/02/17 12:16:08, 10] lib/system_smbd.c:sys_getgrouplist(116)
>  sys_getgrouplist: user [gaa]
>[2005/02/17 12:16:08, 10] lib/system_smbd.c:sys_getgrouplist(125)
>  sys_getgrouplist(): disabled winbindd for group lookup [user == gaa]
>[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:push_sec_ctx(256)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2
>[2005/02/17 12:16:08, 3] smbd/uid.c:push_conn_ctx(365)
>  push_conn_ctx(0) : conn_ctx_stack_ndx = 1
>[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
>[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2005/02/17 12:16:08, 8] lib/util_getent.c:remove_duplicate_gids(330)
>  remove_duplicate_gids: Enter 6 gids
>[2005/02/17 12:16:08, 8] lib/util_getent.c:remove_duplicate_gids(348)
>  remove_duplicate_gids: Exit 5 gids
>[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:push_sec_ctx(256)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2
>[2005/02/17 12:16:08, 3] smbd/uid.c:push_conn_ctx(365)
>  push_conn_ctx(0) : conn_ctx_stack_ndx = 1
>[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
>[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_search(1031)
>  smbldap_search: base => [ou=group,dc=ulticom,dc=com], filter => [(&(objectClass=sambaGroupMapping)(gidNumber=101))], scope => [2]
>[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_close(939)
>  The connection to the LDAP server was closed
>[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_open_connection(596)
>  smbldap_open_connection: ldap://ldap.ulticom.com
>[2005/02/17 12:16:08, 2] lib/smbldap.c:smbldap_open_connection(692)
>  smbldap_open_connection: connection opened
>[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_connect_system(824)
>  ldap_connect_system: Binding to ldap server ldap://ldap.ulticom.com as "uid=sambaAdmin,ou=Directory Administrators,dc=ulticom,dc=com"
>[2005/02/17 12:16:08, 3] lib/smbldap.c:smbldap_connect_system(866)
>  ldap_connect_system: succesful connection to the LDAP server
>  ldap_connect_system: LDAP server does not support paged results
>[2005/02/17 12:16:08, 4] lib/smbldap.c:smbldap_open(919)
>  The LDAP server is succesfully connected
>[2005/02/17 12:16:08, 4] passdb/pdb_ldap.c:ldapsam_getgroup(2080)
>  ldapsam_getgroup: Did not find group
>[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2005/02/17 12:16:08, 10] passdb/passdb.c:local_gid_to_sid(1265)
>  local_gid_to_sid: Fall back to algorithmic mapping: 101 -> S-0-0
>[2005/02/17 12:16:08, 8] passdb/passdb.c:algorithmic_gid_to_sid(1231)
>  algorithmic_gid_to_sid: falling back to RID algorithm
>[2005/02/17 12:16:08, 10] passdb/passdb.c:algorithmic_gid_to_sid(1235)
>  algorithmic_gid_to_sid:  gid (101) -> SID S-1-5-21-3834718897-2476707436-3842496652-1203.
>[2005/02/17 12:16:08, 10] passdb/lookup_sid.c:gid_to_sid(372)
>  gid_to_sid: local 101 -> S-1-5-21-3834718897-2476707436-3842496652-1203
>[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:push_sec_ctx(256)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2
>[2005/02/17 12:16:08, 3] smbd/uid.c:push_conn_ctx(365)
>  push_conn_ctx(0) : conn_ctx_stack_ndx = 1
>[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
>[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_search(1031)
>  smbldap_search: base => [ou=group,dc=ulticom,dc=com], filter => [(&(objectClass=sambaGroupMapping)(gidNumber=10))], scope => [2]
>[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_close(939)
>  The connection to the LDAP server was closed
>[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_open_connection(596)
>  smbldap_open_connection: ldap://ldap.ulticom.com
>[2005/02/17 12:16:08, 2] lib/smbldap.c:smbldap_open_connection(692)
>  smbldap_open_connection: connection opened
>[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_connect_system(824)
>  ldap_connect_system: Binding to ldap server ldap://ldap.ulticom.com as "uid=sambaAdmin,ou=Directory Administrators,dc=ulticom,dc=com"
>[2005/02/17 12:16:08, 3] lib/smbldap.c:smbldap_connect_system(866)
>  ldap_connect_system: succesful connection to the LDAP server
>  ldap_connect_system: LDAP server does not support paged results
>[2005/02/17 12:16:08, 4] lib/smbldap.c:smbldap_open(919)
>  The LDAP server is succesfully connected
>[2005/02/17 12:16:08, 4] passdb/pdb_ldap.c:ldapsam_getgroup(2080)
>  ldapsam_getgroup: Did not find group
>[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2005/02/17 12:16:08, 10] passdb/passdb.c:local_gid_to_sid(1265)
>  local_gid_to_sid: Fall back to algorithmic mapping: 10 -> S-0-0
>[2005/02/17 12:16:08, 8] passdb/passdb.c:algorithmic_gid_to_sid(1231)
>  algorithmic_gid_to_sid: falling back to RID algorithm
>[2005/02/17 12:16:08, 10] passdb/passdb.c:algorithmic_gid_to_sid(1235)
>  algorithmic_gid_to_sid:  gid (10) -> SID S-1-5-21-3834718897-2476707436-3842496652-1021.
>[2005/02/17 12:16:08, 10] passdb/lookup_sid.c:gid_to_sid(372)
>  gid_to_sid: local 10 -> S-1-5-21-3834718897-2476707436-3842496652-1021
>[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:push_sec_ctx(256)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2
>[2005/02/17 12:16:08, 3] smbd/uid.c:push_conn_ctx(365)
>  push_conn_ctx(0) : conn_ctx_stack_ndx = 1
>[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
>[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_search(1031)
>  smbldap_search: base => [ou=group,dc=ulticom,dc=com], filter => [(&(objectClass=sambaGroupMapping)(gidNumber=113))], scope => [2]
>[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_close(939)
>  The connection to the LDAP server was closed
>[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_open_connection(596)
>  smbldap_open_connection: ldap://ldap.ulticom.com
>[2005/02/17 12:16:08, 2] lib/smbldap.c:smbldap_open_connection(692)
>  smbldap_open_connection: connection opened
>[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_connect_system(824)
>  ldap_connect_system: Binding to ldap server ldap://ldap.ulticom.com as "uid=sambaAdmin,ou=Directory Administrators,dc=ulticom,dc=com"
>[2005/02/17 12:16:08, 3] lib/smbldap.c:smbldap_connect_system(866)
>  ldap_connect_system: succesful connection to the LDAP server
>  ldap_connect_system: LDAP server does not support paged results
>[2005/02/17 12:16:08, 4] lib/smbldap.c:smbldap_open(919)
>  The LDAP server is succesfully connected
>[2005/02/17 12:16:08, 4] passdb/pdb_ldap.c:ldapsam_getgroup(2080)
>  ldapsam_getgroup: Did not find group
>[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2005/02/17 12:16:08, 10] passdb/passdb.c:local_gid_to_sid(1265)
>  local_gid_to_sid: Fall back to algorithmic mapping: 113 -> S-0-0
>[2005/02/17 12:16:08, 8] passdb/passdb.c:algorithmic_gid_to_sid(1231)
>  algorithmic_gid_to_sid: falling back to RID algorithm
>[2005/02/17 12:16:08, 10] passdb/passdb.c:algorithmic_gid_to_sid(1235)
>  algorithmic_gid_to_sid:  gid (113) -> SID S-1-5-21-3834718897-2476707436-3842496652-1227.
>[2005/02/17 12:16:08, 10] passdb/lookup_sid.c:gid_to_sid(372)
>  gid_to_sid: local 113 -> S-1-5-21-3834718897-2476707436-3842496652-1227
>[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:push_sec_ctx(256)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2
>[2005/02/17 12:16:08, 3] smbd/uid.c:push_conn_ctx(365)
>  push_conn_ctx(0) : conn_ctx_stack_ndx = 1
>[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
>[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_search(1031)
>  smbldap_search: base => [ou=group,dc=ulticom,dc=com], filter => [(&(objectClass=sambaGroupMapping)(gidNumber=1102))], scope => [2]
>[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_close(939)
>  The connection to the LDAP server was closed
>[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_open_connection(596)
>  smbldap_open_connection: ldap://ldap.ulticom.com
>[2005/02/17 12:16:08, 2] lib/smbldap.c:smbldap_open_connection(692)
>  smbldap_open_connection: connection opened
>[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_connect_system(824)
>  ldap_connect_system: Binding to ldap server ldap://ldap.ulticom.com as "uid=sambaAdmin,ou=Directory Administrators,dc=ulticom,dc=com"
>[2005/02/17 12:16:08, 3] lib/smbldap.c:smbldap_connect_system(866)
>  ldap_connect_system: succesful connection to the LDAP server
>  ldap_connect_system: LDAP server does not support paged results
>[2005/02/17 12:16:08, 4] lib/smbldap.c:smbldap_open(919)
>  The LDAP server is succesfully connected
>[2005/02/17 12:16:08, 4] passdb/pdb_ldap.c:ldapsam_getgroup(2080)
>  ldapsam_getgroup: Did not find group
>[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2005/02/17 12:16:08, 10] passdb/passdb.c:local_gid_to_sid(1265)
>  local_gid_to_sid: Fall back to algorithmic mapping: 1102 -> S-0-0
>[2005/02/17 12:16:08, 8] passdb/passdb.c:algorithmic_gid_to_sid(1231)
>  algorithmic_gid_to_sid: falling back to RID algorithm
>[2005/02/17 12:16:08, 10] passdb/passdb.c:algorithmic_gid_to_sid(1235)
>  algorithmic_gid_to_sid:  gid (1102) -> SID S-1-5-21-3834718897-2476707436-3842496652-3205.
>[2005/02/17 12:16:08, 10] passdb/lookup_sid.c:gid_to_sid(372)
>  gid_to_sid: local 1102 -> S-1-5-21-3834718897-2476707436-3842496652-3205
>[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:push_sec_ctx(256)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2
>[2005/02/17 12:16:08, 3] smbd/uid.c:push_conn_ctx(365)
>  push_conn_ctx(0) : conn_ctx_stack_ndx = 1
>[2005/02/17 12:16:08, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
>[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2005/02/17 12:16:08, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_search(1031)
>  smbldap_search: base => [ou=group,dc=ulticom,dc=com], filter => [(&(objectClass=sambaGroupMapping)(gidNumber=1138))], scope => [2]
>[2005/02/17 12:16:08, 5] lib/smbldap.c:smbldap_close(939)
>  The connection to the LDAP server was closed
>[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_open_connection(596)
>  smbldap_open_connection: ldap://ldap.ulticom.com
>[2005/02/17 12:16:08, 2] lib/smbldap.c:smbldap_open_connection(692)
>  smbldap_open_connection: connection opened
>[2005/02/17 12:16:08, 10] lib/smbldap.c:smbldap_connect_system(824)
>  ldap_connect_system: Binding to ldap server ldap://ldap.ulticom.com as "uid=sambaAdmin,ou=Directory Administrators,dc=ulticom,dc=com"
>[2005/02/17 12:16:09, 3] lib/smbldap.c:smbldap_connect_system(866)
>  ldap_connect_system: succesful connection to the LDAP server
>  ldap_connect_system: LDAP server does not support paged results
>[2005/02/17 12:16:09, 4] lib/smbldap.c:smbldap_open(919)
>  The LDAP server is succesfully connected
>[2005/02/17 12:16:09, 4] passdb/pdb_ldap.c:ldapsam_getgroup(2080)
>  ldapsam_getgroup: Did not find group
>[2005/02/17 12:16:09, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2005/02/17 12:16:09, 10] passdb/passdb.c:local_gid_to_sid(1265)
>  local_gid_to_sid: Fall back to algorithmic mapping: 1138 -> S-0-0
>[2005/02/17 12:16:09, 8] passdb/passdb.c:algorithmic_gid_to_sid(1231)
>  algorithmic_gid_to_sid: falling back to RID algorithm
>[2005/02/17 12:16:09, 10] passdb/passdb.c:algorithmic_gid_to_sid(1235)
>  algorithmic_gid_to_sid:  gid (1138) -> SID S-1-5-21-3834718897-2476707436-3842496652-3277.
>[2005/02/17 12:16:09, 10] passdb/lookup_sid.c:gid_to_sid(372)
>  gid_to_sid: local 1138 -> S-1-5-21-3834718897-2476707436-3842496652-3277
>[2005/02/17 12:16:09, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2005/02/17 12:16:09, 10] auth/auth_util.c:debug_nt_user_token(491)
>  NT user token of user S-1-5-21-104134243-2275341451-782570472-1804
>  contains 10 SIDs
>  SID[  0]: S-1-5-21-104134243-2275341451-782570472-1804
>  SID[  1]: S-1-5-21-104134243-2275341451-782570472-3205
>  SID[  2]: S-1-1-0
>  SID[  3]: S-1-5-2
>  SID[  4]: S-1-5-11
>  SID[  5]: S-1-5-21-3834718897-2476707436-3842496652-1203
>  SID[  6]: S-1-5-21-3834718897-2476707436-3842496652-1021
>  SID[  7]: S-1-5-21-3834718897-2476707436-3842496652-1227
>  SID[  8]: S-1-5-21-3834718897-2476707436-3842496652-3205
>  SID[  9]: S-1-5-21-3834718897-2476707436-3842496652-3277
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2005/02/17 12:16:09, 5] auth/auth_util.c:make_server_info_sam(830)
>  make_server_info_sam: made server info for user gaa -> gaa
>[2005/02/17 12:16:09, 3] auth/auth.c:check_ntlm_password(268)
>  check_ntlm_password: sam authentication for user [gaa] succeeded
>[2005/02/17 12:16:09, 3] smbd/sec_ctx.c:push_sec_ctx(256)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
>[2005/02/17 12:16:09, 3] smbd/uid.c:push_conn_ctx(365)
>  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
>[2005/02/17 12:16:09, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2005/02/17 12:16:09, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2005/02/17 12:16:09, 5] auth/auth.c:check_ntlm_password(292)
>  check_ntlm_password:  PAM Account for user [gaa] succeeded
>[2005/02/17 12:16:09, 2] auth/auth.c:check_ntlm_password(305)
>  check_ntlm_password:  authentication for user [gaa] -> [gaa] -> [gaa] succeeded
>[2005/02/17 12:16:09, 5] auth/auth_util.c:free_user_info(1348)
>  attempting to free (and zero) a user_info structure
>[2005/02/17 12:16:09, 10] auth/auth_util.c:free_user_info(1351)
>  structure was created for gaa
>[2005/02/17 12:16:09, 10] auth/auth_ntlmssp.c:auth_ntlmssp_check_password(117)
>  Got NT session key of length 16
>[2005/02/17 12:16:09, 10] auth/auth_ntlmssp.c:auth_ntlmssp_check_password(123)
>  Got LM session key of length 16
>[2005/02/17 12:16:09, 10] libsmb/ntlmssp.c:ntlmssp_server_auth(678)
>  ntlmssp_server_auth: Created NTLM2 session key.
>[2005/02/17 12:16:09, 3] libsmb/ntlmssp_sign.c:ntlmssp_sign_init(319)
>  NTLMSSP Sign/Seal - Initialising with flags:
>[2005/02/17 12:16:09, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(62)
>  Got NTLMSSP neg_flags=0x60088215
>    NTLMSSP_NEGOTIATE_UNICODE
>    NTLMSSP_REQUEST_TARGET
>    NTLMSSP_NEGOTIATE_SIGN
>    NTLMSSP_NEGOTIATE_NTLM
>    NTLMSSP_NEGOTIATE_ALWAYS_SIGN
>    NTLMSSP_NEGOTIATE_NTLM2
>    NTLMSSP_NEGOTIATE_128
>    NTLMSSP_NEGOTIATE_KEY_EXCH
>[2005/02/17 12:16:09, 10] smbd/password.c:register_vuid(158)
>  register_vuid: allocated vuid = 100
>[2005/02/17 12:16:09, 10] lib/util_pw.c:getpwnam_alloc(84)
>  Got gaa from pwnam_cache
>[2005/02/17 12:16:09, 10] smbd/password.c:register_vuid(220)
>  register_vuid: (402,101) gaa gaa CARP guest=0
>[2005/02/17 12:16:09, 3] smbd/password.c:register_vuid(222)
>  User name: gaa	Real name: Gary Algier
>[2005/02/17 12:16:09, 3] smbd/password.c:register_vuid(241)
>  UNIX uid 402 is UNIX user gaa, and will be vuid 100
>[2005/02/17 12:16:09, 2] smbd/utmp.c:sys_utmp_update(419)
>  utmp_update: uname:/var/adm/utmpx wname:/var/adm/wtmpx
>[2005/02/17 12:16:09, 7] param/loadparm.c:lp_servicenumber(4039)
>  lp_servicenumber: couldn't find gaa
>[2005/02/17 12:16:09, 3] smbd/password.c:register_vuid(270)
>  Adding homes service for user 'gaa' using home directory: '/u/gaa'
>[2005/02/17 12:16:09, 8] param/loadparm.c:add_a_service(2310)
>  add_a_service: Creating snum = 16 for gaa
>[2005/02/17 12:16:09, 3] param/loadparm.c:lp_add_home(2351)
>  adding home's share [gaa] for user 'gaa' at '/corp/%S'
>[2005/02/17 12:16:09, 6] param/loadparm.c:lp_file_list_changed(2698)
>  lp_file_list_changed()
>  file /etc/ulcmit/samba/carp/smb.conf.q-train -> /etc/ulcmit/samba/carp/smb.conf.q-train  last mod_time: Wed May  1 08:38:33 2002
>  
>  file /etc/ulcmit/samba/carp/smb.conf.oracleimp -> /etc/ulcmit/samba/carp/smb.conf.oracleimp  last mod_time: Thu May  2 15:57:49 2002
>  
>  file /etc/ulcmit/samba/carp/auto-config/user-%U -> /etc/ulcmit/samba/carp/auto-config/user-gaa  last mod_time: Thu Feb 17 10:22:09 2005
>  
>  file /etc/ulcmit/samba/carp/smb.conf.shares -> /etc/ulcmit/samba/carp/smb.conf.shares  last mod_time: Thu Feb 17 10:14:42 2005
>  
>  file /etc/ulcmit/samba/carp/smb.conf.ip-%I -> /etc/ulcmit/samba/carp/smb.conf.ip-172.25.32.13  last mod_time: Thu Feb 17 12:12:56 2005
>  
>  file /etc/ulcmit/samba/carp/smb.conf -> /etc/ulcmit/samba/carp/smb.conf  last mod_time: Thu Feb 17 12:13:35 2005
>  
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,108)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,108) wrote 108
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 74
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x4a
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 3 of length 78
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=74
>  smb_com=0x75
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=0
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=50816
>  smt_wct=4
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=   74 (0x4A)
>  smb_vwv[ 2]=    8 (0x8)
>  smb_vwv[ 3]=    1 (0x1)
>  smb_bcc=31
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 5C 00 43 00 41  00 52 00 50 00 5C 00 49  .\.\.C.A .R.P.\.I
>  [010] 00 50 00 43 00 24 00 00  00 3F 3F 3F 3F 3F 00     .P.C.$.. .?????.
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtconX (pid 13681) conn 0x0
>[2005/02/17 12:16:09, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2005/02/17 12:16:09, 5] smbd/uid.c:change_to_root_user(296)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2005/02/17 12:16:09, 4] smbd/reply.c:reply_tcon_and_X(407)
>  Client requested device type [?????] for share [IPC$]
>[2005/02/17 12:16:09, 5] smbd/service.c:make_connection(810)
>  making a connection to 'normal' service ipc$
>[2005/02/17 12:16:09, 5] lib/username.c:Get_Pwnam(293)
>  Finding user gaa
>[2005/02/17 12:16:09, 5] lib/username.c:Get_Pwnam_internals(223)
>  Trying _Get_Pwnam(), username as lowercase is gaa
>[2005/02/17 12:16:09, 10] lib/util_pw.c:getpwnam_alloc(84)
>  Got gaa from pwnam_cache
>[2005/02/17 12:16:09, 5] lib/username.c:Get_Pwnam_internals(251)
>  Get_Pwnam_internals did find user [gaa]!
>[2005/02/17 12:16:09, 3] smbd/service.c:make_connection_snum(469)
>  Connect path is '/tmp' for service [IPC$]
>[2005/02/17 12:16:09, 4] rpc_server/srv_srvsvc_nt.c:get_share_security(217)
>  get_share_security: using default secdesc for IPC$
>[2005/02/17 12:16:09, 10] lib/util_seaccess.c:se_map_generic(176)
>  se_map_generic(): mapped mask 0x10000000 to 0x001f01ff
>[2005/02/17 12:16:09, 10] lib/util_seaccess.c:se_access_check(234)
>  se_access_check: requested access 0x00000002, for NT token with 10 entries and first sid S-1-5-21-104134243-2275341451-782570472-1804.
>[2005/02/17 12:16:09, 3] lib/util_seaccess.c:se_access_check(251)
>[2005/02/17 12:16:09, 3] lib/util_seaccess.c:se_access_check(252)
>  se_access_check: user sid is S-1-5-21-104134243-2275341451-782570472-1804
>  se_access_check: also S-1-5-21-104134243-2275341451-782570472-3205
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-11
>  se_access_check: also S-1-5-21-3834718897-2476707436-3842496652-1203
>  se_access_check: also S-1-5-21-3834718897-2476707436-3842496652-1021
>  se_access_check: also S-1-5-21-3834718897-2476707436-3842496652-1227
>  se_access_check: also S-1-5-21-3834718897-2476707436-3842496652-3205
>  se_access_check: also S-1-5-21-3834718897-2476707436-3842496652-3277
>  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2
>[2005/02/17 12:16:09, 5] lib/util_seaccess.c:se_access_check(309)
>  se_access_check: access (2) granted.
>[2005/02/17 12:16:09, 3] smbd/vfs.c:vfs_init_default(206)
>  Initialising default vfs hooks
>[2005/02/17 12:16:09, 5] smbd/connection.c:claim_connection(170)
>  claiming IPC$ 0
>[2005/02/17 12:16:09, 10] smbd/uid.c:is_share_read_only_for_user(99)
>  is_share_read_only_for_user: share IPC$ is read-only for unix user gaa
>[2005/02/17 12:16:09, 4] rpc_server/srv_srvsvc_nt.c:get_share_security(217)
>  get_share_security: using default secdesc for IPC$
>[2005/02/17 12:16:09, 10] lib/util_seaccess.c:se_map_generic(176)
>  se_map_generic(): mapped mask 0x10000000 to 0x001f01ff
>[2005/02/17 12:16:09, 10] lib/util_seaccess.c:se_access_check(234)
>  se_access_check: requested access 0x00000001, for NT token with 10 entries and first sid S-1-5-21-104134243-2275341451-782570472-1804.
>[2005/02/17 12:16:09, 3] lib/util_seaccess.c:se_access_check(251)
>[2005/02/17 12:16:09, 3] lib/util_seaccess.c:se_access_check(252)
>  se_access_check: user sid is S-1-5-21-104134243-2275341451-782570472-1804
>  se_access_check: also S-1-5-21-104134243-2275341451-782570472-3205
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-11
>  se_access_check: also S-1-5-21-3834718897-2476707436-3842496652-1203
>  se_access_check: also S-1-5-21-3834718897-2476707436-3842496652-1021
>  se_access_check: also S-1-5-21-3834718897-2476707436-3842496652-1227
>  se_access_check: also S-1-5-21-3834718897-2476707436-3842496652-3205
>  se_access_check: also S-1-5-21-3834718897-2476707436-3842496652-3277
>  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 1
>[2005/02/17 12:16:09, 5] lib/util_seaccess.c:se_access_check(309)
>  se_access_check: access (1) granted.
>[2005/02/17 12:16:09, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (402, 101) - sec_ctx_stack_ndx = 0
>[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_nt_user_token(491)
>  NT user token of user S-1-5-21-104134243-2275341451-782570472-1804
>  contains 10 SIDs
>  SID[  0]: S-1-5-21-104134243-2275341451-782570472-1804
>  SID[  1]: S-1-5-21-104134243-2275341451-782570472-3205
>  SID[  2]: S-1-1-0
>  SID[  3]: S-1-5-2
>  SID[  4]: S-1-5-11
>  SID[  5]: S-1-5-21-3834718897-2476707436-3842496652-1203
>  SID[  6]: S-1-5-21-3834718897-2476707436-3842496652-1021
>  SID[  7]: S-1-5-21-3834718897-2476707436-3842496652-1227
>  SID[  8]: S-1-5-21-3834718897-2476707436-3842496652-3205
>  SID[  9]: S-1-5-21-3834718897-2476707436-3842496652-3277
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 402
>  Primary group is 101 and contains 5 supplementary groups
>  Group[  0]: 101
>  Group[  1]: 10
>  Group[  2]: 113
>  Group[  3]: 1102
>  Group[  4]: 1138
>[2005/02/17 12:16:09, 5] smbd/uid.c:change_to_user(281)
>  change_to_user uid=(0,402) gid=(0,101)
>[2005/02/17 12:16:09, 3] smbd/service.c:make_connection_snum(645)
>  azurite (172.25.32.13) connect to service IPC$ initially as user gaa (uid=402, gid=101) (pid 13681)
>[2005/02/17 12:16:09, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2005/02/17 12:16:09, 5] smbd/uid.c:change_to_root_user(296)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2005/02/17 12:16:09, 3] smbd/reply.c:reply_tcon_and_X(455)
>  tconX service=IPC$ 
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=48
>  smb_com=0x75
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=50816
>  smt_wct=3
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    1 (0x1)
>  smb_bcc=7
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 49 50 43 00 00 00 00                              IPC.... 
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,52)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,52) wrote 52
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 4 of length 104
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=50880
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  256 (0x100)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 77 00 6B 00 73  00 73 00 76 00 63 00 00  .\.w.k.s .s.v.c..
>  [010] 00                                                . 
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (402, 101) - sec_ctx_stack_ndx = 0
>[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_nt_user_token(491)
>  NT user token of user S-1-5-21-104134243-2275341451-782570472-1804
>  contains 10 SIDs
>  SID[  0]: S-1-5-21-104134243-2275341451-782570472-1804
>  SID[  1]: S-1-5-21-104134243-2275341451-782570472-3205
>  SID[  2]: S-1-1-0
>  SID[  3]: S-1-5-2
>  SID[  4]: S-1-5-11
>  SID[  5]: S-1-5-21-3834718897-2476707436-3842496652-1203
>  SID[  6]: S-1-5-21-3834718897-2476707436-3842496652-1021
>  SID[  7]: S-1-5-21-3834718897-2476707436-3842496652-1227
>  SID[  8]: S-1-5-21-3834718897-2476707436-3842496652-3205
>  SID[  9]: S-1-5-21-3834718897-2476707436-3842496652-3277
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 402
>  Primary group is 101 and contains 5 supplementary groups
>  Group[  0]: 101
>  Group[  1]: 10
>  Group[  2]: 113
>  Group[  3]: 1102
>  Group[  4]: 1138
>[2005/02/17 12:16:09, 5] smbd/uid.c:change_to_user(281)
>  change_to_user uid=(0,402) gid=(0,101)
>[2005/02/17 12:16:09, 4] smbd/vfs.c:vfs_ChDir(657)
>  vfs_ChDir to /tmp
>[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \wkssvc.
>[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe wkssvc opening.
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested wkssvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested wkssvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe wkssvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe wkssvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe wkssvc with handle 7428 (pipes_open=1)
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name wkssvc pnum=7428
>[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \wkssvc
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=50880
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=10240 (0x2800)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 5 of length 160
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=50944
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29736 (0x7428)
>  smb_bcc=89
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [030] 00 98 D0 FF 6B 12 A1 10  36 98 33 46 C3 F8 7E 34  ....k... 6.3F..~4
>  [040] 5A 01 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  Z.....]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7428
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=7428 (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 7428)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7428 name: wkssvc open: Yes len: 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 6bffd098
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : a112
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : 3610
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : 98 33 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 46 c3 f8 7e 34 5a 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000001
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\wkssvc
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000d
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\ntsvcs.
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000017 smb_io_rpc_results 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7428 name: wkssvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=50944
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0D 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6E 74 73 76 63 73 00  00 01 00 00 00 00 00 00  \ntsvcs. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 144
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x90
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 6 of length 148
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=51008
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29736 (0x7428)
>  smb_bcc=77
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 00  00 34 E4 A3 09 07 00 00  .$...... .4......
>  [030] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 63 00 61  ........ .\.\.c.a
>  [040] 00 72 00 70 00 00 00 00  00 64 00 00 00           .r.p.... .d...
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7428
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=7428 (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 7428)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7428 name: wkssvc open: Yes len: 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 003c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000024
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0000
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[0].fn == dc5e4
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_q_query_info 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 ptr_srv_name: 09a3e434
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.c.a.r.p...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0020 switch_value: 0064
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66)
>  _wks_query_info: 66
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40)
>  create_wks_info_100: 40
>[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_info_100(79)
>  Init WKS_INFO_100: 79
>[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139)
>  init_wks_r_unknown_0: 139
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76)
>  _wks_query_info: 76
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_r_query_info 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0000 switch_value: 0064
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0004 ptr_1       : 00000001
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 wks_io_wks_info_100 inf
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 platform_id : 000001f4
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c ptr_compname: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0010 ptr_lan_grp : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0014 ver_major   : 00000004
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0018 ver_minor   : 00000009
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          00001c smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              001c uni_max_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 uni_str_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0028 buffer     : C.A.R.P...
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000034 smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0034 uni_max_len: 00000008
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0038 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              003c uni_str_len: 00000008
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0040 buffer     : U.L.T.I.C.O.M...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
>      0050 status      : NT_STATUS_OK
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called wkssvc successfully
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 92
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 44
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7428 name: wkssvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84.
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 006c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000054
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..108]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=164
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=51008
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  108 (0x6C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  108 (0x6C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=109
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 6C 00 00 00 01 00 00  ........ .l......
>  [010] 00 54 00 00 00 00 00 00  00 64 00 00 00 01 00 00  .T...... .d......
>  [020] 00 F4 01 00 00 01 00 00  00 01 00 00 00 04 00 00  ........ ........
>  [030] 00 09 00 00 00 05 00 00  00 00 00 00 00 05 00 00  ........ ........
>  [040] 00 43 00 41 00 52 00 50  00 00 00 00 00 08 00 00  .C.A.R.P ........
>  [050] 00 00 00 00 00 08 00 00  00 55 00 4C 00 54 00 49  ........ .U.L.T.I
>  [060] 00 43 00 4F 00 4D 00 00  00 00 00 00 00           .C.O.M.. .....
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,168)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,168) wrote 168
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 7 of length 45
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=51072
>  smt_wct=3
>  smb_vwv[ 0]=29736 (0x7428)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7428
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=7428 (pipes_open=1)
>[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:7428
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
>  close_policy_by_pipe: deleted handle list for pipe wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name wkssvc pnum=7428 (pipes_open=0)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=51072
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 8 of length 104
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=51136
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 73 00 72 00 76  00 73 00 76 00 63 00 00  .\.s.r.v .s.v.c..
>  [010] 00                                                . 
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \srvsvc.
>[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe srvsvc opening.
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested srvsvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested srvsvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe srvsvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe srvsvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe srvsvc with handle 7429 (pipes_open=1)
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name srvsvc pnum=7429
>[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \srvsvc
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=51136
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=10496 (0x2900)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 9 of length 160
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=51200
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29737 (0x7429)
>  smb_bcc=89
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [030] 00 C8 4F 32 4B 70 16 D3  01 12 78 5A 47 BF 6E E1  ..O2Kp.. ..xZG.n.
>  [040] 88 03 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7429
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=7429 (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 7429)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7429 name: srvsvc open: Yes len: 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 4b324fc8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : 1670
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : 01d3
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : 12 78 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 5a 47 bf 6e e1 88 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000003
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\srvsvc
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000d
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\ntsvcs.
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000017 smb_io_rpc_results 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7429 name: srvsvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=51200
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0D 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6E 74 73 76 63 73 00  00 01 00 00 00 00 00 00  \ntsvcs. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 144
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x90
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 10 of length 148
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=51264
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29737 (0x7429)
>  smb_bcc=77
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 15  00 34 E4 A3 09 07 00 00  .$...... .4......
>  [030] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 63 00 61  ........ .\.\.c.a
>  [040] 00 72 00 70 00 00 00 00  00 65 00 00 00           .r.p.... .e...
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7429
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=7429 (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 7429)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7429 name: srvsvc open: Yes len: 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 003c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000024
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0015
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\srvsvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[10].fn == e0a54
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 srv_io_q_net_srv_get_info 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 ptr_srv_name  : 09a3e434
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.c.a.r.p...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0020 switch_value  : 00000065
>[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1213)
>  srv_net_srv_get_info: 1213
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_info_101(2736)
>  init_srv_info_101
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_r_net_srv_get_info(2971)
>  init_srv_r_net_srv_get_info
>[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1258)
>  srv_net_srv_get_info: 1258
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 srv_io_r_net_srv_get_info 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 srv_io_info_ctr ctr
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 switch_value: 00000065
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 ptr_srv_ctr : 00000001
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000008 srv_io_info_101 sv101
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0008 platform_id : 000001f4
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              000c ptr_name    : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 ver_major   : 00000004
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0014 ver_minor   : 00000009
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0018 srv_type    : 00009a03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              001c ptr_comment : 00000001
>[2005/02/17 12:16:09, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000020 smb_io_unistr2 uni_name    
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0020 uni_max_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0024 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0028 uni_str_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  002c buffer     : C.A.R.P...
>[2005/02/17 12:16:09, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000036 smb_io_unistr2 uni_comment 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0038 uni_max_len: 00000020
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  003c offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0040 uni_str_len: 00000020
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0044 buffer     : C.a.r.p. .-.-. .a. .t.e.s.t. .i.n.s.t.a.n.c.e. .o.f. .C.o.r.p...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0084 status: WERR_OK
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called srvsvc successfully
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 196
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 44
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7429 name: srvsvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 136.
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 00a0
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000088
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..160]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=216
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=51264
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  160 (0xA0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  160 (0xA0)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=161
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 A0 00 00 00 01 00 00  ........ ........
>  [010] 00 88 00 00 00 00 00 00  00 65 00 00 00 01 00 00  ........ .e......
>  [020] 00 F4 01 00 00 01 00 00  00 04 00 00 00 09 00 00  ........ ........
>  [030] 00 03 9A 00 00 01 00 00  00 05 00 00 00 00 00 00  ........ ........
>  [040] 00 05 00 00 00 43 00 41  00 52 00 50 00 00 00 00  .....C.A .R.P....
>  [050] 00 20 00 00 00 00 00 00  00 20 00 00 00 43 00 61  . ...... . ...C.a
>  [060] 00 72 00 70 00 20 00 2D  00 2D 00 20 00 61 00 20  .r.p. .- .-. .a. 
>  [070] 00 74 00 65 00 73 00 74  00 20 00 69 00 6E 00 73  .t.e.s.t . .i.n.s
>  [080] 00 74 00 61 00 6E 00 63  00 65 00 20 00 6F 00 66  .t.a.n.c .e. .o.f
>  [090] 00 20 00 43 00 6F 00 72  00 70 00 00 00 00 00 00  . .C.o.r .p......
>  [0A0] 00                                                . 
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,220)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,220) wrote 220
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 11 of length 45
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=51328
>  smt_wct=3
>  smb_vwv[ 0]=29737 (0x7429)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7429
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=7429 (pipes_open=1)
>[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:7429
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
>  close_policy_by_pipe: deleted handle list for pipe srvsvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name srvsvc pnum=7429 (pipes_open=0)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=51328
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 12 of length 104
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=51392
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  256 (0x100)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 77 00 6B 00 73  00 73 00 76 00 63 00 00  .\.w.k.s .s.v.c..
>  [010] 00                                                . 
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \wkssvc.
>[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe wkssvc opening.
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested wkssvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested wkssvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe wkssvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe wkssvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe wkssvc with handle 742a (pipes_open=1)
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name wkssvc pnum=742a
>[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \wkssvc
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=51392
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=10752 (0x2A00)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 13 of length 160
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=51456
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29738 (0x742A)
>  smb_bcc=89
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [030] 00 98 D0 FF 6B 12 A1 10  36 98 33 46 C3 F8 7E 34  ....k... 6.3F..~4
>  [040] 5A 01 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  Z.....]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=742a
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=742a (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 742a)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 742a name: wkssvc open: Yes len: 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 6bffd098
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : a112
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : 3610
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : 98 33 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 46 c3 f8 7e 34 5a 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000001
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\wkssvc
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000d
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\ntsvcs.
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000017 smb_io_rpc_results 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 742a name: wkssvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=51456
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0D 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6E 74 73 76 63 73 00  00 01 00 00 00 00 00 00  \ntsvcs. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 144
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x90
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 14 of length 148
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=51520
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29738 (0x742A)
>  smb_bcc=77
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 00  00 94 E1 A3 09 07 00 00  .$...... ........
>  [030] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 63 00 61  ........ .\.\.c.a
>  [040] 00 72 00 70 00 00 00 00  00 64 00 00 00           .r.p.... .d...
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=742a
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=742a (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 742a)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 742a name: wkssvc open: Yes len: 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 003c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000024
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0000
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[0].fn == dc5e4
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_q_query_info 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 ptr_srv_name: 09a3e194
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.c.a.r.p...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0020 switch_value: 0064
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66)
>  _wks_query_info: 66
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40)
>  create_wks_info_100: 40
>[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_info_100(79)
>  Init WKS_INFO_100: 79
>[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139)
>  init_wks_r_unknown_0: 139
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76)
>  _wks_query_info: 76
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_r_query_info 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0000 switch_value: 0064
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0004 ptr_1       : 00000001
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 wks_io_wks_info_100 inf
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 platform_id : 000001f4
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c ptr_compname: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0010 ptr_lan_grp : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0014 ver_major   : 00000004
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0018 ver_minor   : 00000009
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          00001c smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              001c uni_max_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 uni_str_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0028 buffer     : C.A.R.P...
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000034 smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0034 uni_max_len: 00000008
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0038 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              003c uni_str_len: 00000008
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0040 buffer     : U.L.T.I.C.O.M...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
>      0050 status      : NT_STATUS_OK
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called wkssvc successfully
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 92
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 44
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 742a name: wkssvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84.
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 006c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000054
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..108]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=164
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=51520
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  108 (0x6C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  108 (0x6C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=109
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 6C 00 00 00 01 00 00  ........ .l......
>  [010] 00 54 00 00 00 00 00 00  00 64 00 00 00 01 00 00  .T...... .d......
>  [020] 00 F4 01 00 00 01 00 00  00 01 00 00 00 04 00 00  ........ ........
>  [030] 00 09 00 00 00 05 00 00  00 00 00 00 00 05 00 00  ........ ........
>  [040] 00 43 00 41 00 52 00 50  00 00 00 00 00 08 00 00  .C.A.R.P ........
>  [050] 00 00 00 00 00 08 00 00  00 55 00 4C 00 54 00 49  ........ .U.L.T.I
>  [060] 00 43 00 4F 00 4D 00 00  00 00 00 00 00           .C.O.M.. .....
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,168)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,168) wrote 168
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 15 of length 45
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=51584
>  smt_wct=3
>  smb_vwv[ 0]=29738 (0x742A)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=742a
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=742a (pipes_open=1)
>[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:742a
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
>  close_policy_by_pipe: deleted handle list for pipe wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name wkssvc pnum=742a (pipes_open=0)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=51584
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 16 of length 104
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=51648
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 73 00 72 00 76  00 73 00 76 00 63 00 00  .\.s.r.v .s.v.c..
>  [010] 00                                                . 
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \srvsvc.
>[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe srvsvc opening.
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested srvsvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested srvsvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe srvsvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe srvsvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe srvsvc with handle 742b (pipes_open=1)
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name srvsvc pnum=742b
>[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \srvsvc
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=51648
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=11008 (0x2B00)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 17 of length 160
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=51712
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29739 (0x742B)
>  smb_bcc=89
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [030] 00 C8 4F 32 4B 70 16 D3  01 12 78 5A 47 BF 6E E1  ..O2Kp.. ..xZG.n.
>  [040] 88 03 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=742b
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=742b (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 742b)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 742b name: srvsvc open: Yes len: 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 4b324fc8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : 1670
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : 01d3
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : 12 78 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 5a 47 bf 6e e1 88 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000003
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\srvsvc
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000d
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\ntsvcs.
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000017 smb_io_rpc_results 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 742b name: srvsvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=51712
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0D 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6E 74 73 76 63 73 00  00 01 00 00 00 00 00 00  \ntsvcs. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 144
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x90
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 18 of length 148
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=51776
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29739 (0x742B)
>  smb_bcc=77
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 15  00 94 E1 A3 09 07 00 00  .$...... ........
>  [030] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 63 00 61  ........ .\.\.c.a
>  [040] 00 72 00 70 00 00 00 00  00 65 00 00 00           .r.p.... .e...
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=742b
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=742b (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 742b)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 742b name: srvsvc open: Yes len: 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 003c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000024
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0015
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\srvsvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[10].fn == e0a54
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 srv_io_q_net_srv_get_info 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 ptr_srv_name  : 09a3e194
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.c.a.r.p...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0020 switch_value  : 00000065
>[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1213)
>  srv_net_srv_get_info: 1213
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_info_101(2736)
>  init_srv_info_101
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_r_net_srv_get_info(2971)
>  init_srv_r_net_srv_get_info
>[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1258)
>  srv_net_srv_get_info: 1258
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 srv_io_r_net_srv_get_info 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 srv_io_info_ctr ctr
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 switch_value: 00000065
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 ptr_srv_ctr : 00000001
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000008 srv_io_info_101 sv101
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0008 platform_id : 000001f4
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              000c ptr_name    : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 ver_major   : 00000004
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0014 ver_minor   : 00000009
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0018 srv_type    : 00009a03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              001c ptr_comment : 00000001
>[2005/02/17 12:16:09, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000020 smb_io_unistr2 uni_name    
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0020 uni_max_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0024 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0028 uni_str_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  002c buffer     : C.A.R.P...
>[2005/02/17 12:16:09, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000036 smb_io_unistr2 uni_comment 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0038 uni_max_len: 00000020
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  003c offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0040 uni_str_len: 00000020
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0044 buffer     : C.a.r.p. .-.-. .a. .t.e.s.t. .i.n.s.t.a.n.c.e. .o.f. .C.o.r.p...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0084 status: WERR_OK
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called srvsvc successfully
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 196
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 44
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 742b name: srvsvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 136.
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 00a0
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000088
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..160]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=216
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=51776
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  160 (0xA0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  160 (0xA0)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=161
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 A0 00 00 00 01 00 00  ........ ........
>  [010] 00 88 00 00 00 00 00 00  00 65 00 00 00 01 00 00  ........ .e......
>  [020] 00 F4 01 00 00 01 00 00  00 04 00 00 00 09 00 00  ........ ........
>  [030] 00 03 9A 00 00 01 00 00  00 05 00 00 00 00 00 00  ........ ........
>  [040] 00 05 00 00 00 43 00 41  00 52 00 50 00 00 00 00  .....C.A .R.P....
>  [050] 00 20 00 00 00 00 00 00  00 20 00 00 00 43 00 61  . ...... . ...C.a
>  [060] 00 72 00 70 00 20 00 2D  00 2D 00 20 00 61 00 20  .r.p. .- .-. .a. 
>  [070] 00 74 00 65 00 73 00 74  00 20 00 69 00 6E 00 73  .t.e.s.t . .i.n.s
>  [080] 00 74 00 61 00 6E 00 63  00 65 00 20 00 6F 00 66  .t.a.n.c .e. .o.f
>  [090] 00 20 00 43 00 6F 00 72  00 70 00 00 00 00 00 00  . .C.o.r .p......
>  [0A0] 00                                                . 
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,220)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,220) wrote 220
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 19 of length 45
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=51840
>  smt_wct=3
>  smb_vwv[ 0]=29739 (0x742B)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=742b
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=742b (pipes_open=1)
>[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:742b
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
>  close_policy_by_pipe: deleted handle list for pipe srvsvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name srvsvc pnum=742b (pipes_open=0)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=51840
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 20 of length 104
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=51904
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  256 (0x100)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 77 00 6B 00 73  00 73 00 76 00 63 00 00  .\.w.k.s .s.v.c..
>  [010] 00                                                . 
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \wkssvc.
>[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe wkssvc opening.
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested wkssvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested wkssvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe wkssvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe wkssvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe wkssvc with handle 742c (pipes_open=1)
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name wkssvc pnum=742c
>[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \wkssvc
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=51904
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=11264 (0x2C00)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 21 of length 160
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=51968
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29740 (0x742C)
>  smb_bcc=89
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [030] 00 98 D0 FF 6B 12 A1 10  36 98 33 46 C3 F8 7E 34  ....k... 6.3F..~4
>  [040] 5A 01 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  Z.....]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=742c
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=742c (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 742c)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 742c name: wkssvc open: Yes len: 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 6bffd098
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : a112
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : 3610
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : 98 33 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 46 c3 f8 7e 34 5a 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000001
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\wkssvc
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000d
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\ntsvcs.
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000017 smb_io_rpc_results 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 742c name: wkssvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=51968
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0D 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6E 74 73 76 63 73 00  00 01 00 00 00 00 00 00  \ntsvcs. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 144
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x90
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 22 of length 148
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=52032
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29740 (0x742C)
>  smb_bcc=77
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 00  00 C4 E3 A3 09 07 00 00  .$...... ........
>  [030] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 63 00 61  ........ .\.\.c.a
>  [040] 00 72 00 70 00 00 00 00  00 64 00 00 00           .r.p.... .d...
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=742c
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=742c (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 742c)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 742c name: wkssvc open: Yes len: 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 003c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000024
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0000
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[0].fn == dc5e4
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_q_query_info 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 ptr_srv_name: 09a3e3c4
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.c.a.r.p...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0020 switch_value: 0064
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66)
>  _wks_query_info: 66
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40)
>  create_wks_info_100: 40
>[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_info_100(79)
>  Init WKS_INFO_100: 79
>[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139)
>  init_wks_r_unknown_0: 139
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76)
>  _wks_query_info: 76
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_r_query_info 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0000 switch_value: 0064
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0004 ptr_1       : 00000001
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 wks_io_wks_info_100 inf
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 platform_id : 000001f4
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c ptr_compname: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0010 ptr_lan_grp : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0014 ver_major   : 00000004
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0018 ver_minor   : 00000009
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          00001c smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              001c uni_max_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 uni_str_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0028 buffer     : C.A.R.P...
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000034 smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0034 uni_max_len: 00000008
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0038 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              003c uni_str_len: 00000008
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0040 buffer     : U.L.T.I.C.O.M...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
>      0050 status      : NT_STATUS_OK
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called wkssvc successfully
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 92
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 44
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 742c name: wkssvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84.
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 006c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000054
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..108]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=164
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=52032
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  108 (0x6C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  108 (0x6C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=109
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 6C 00 00 00 01 00 00  ........ .l......
>  [010] 00 54 00 00 00 00 00 00  00 64 00 00 00 01 00 00  .T...... .d......
>  [020] 00 F4 01 00 00 01 00 00  00 01 00 00 00 04 00 00  ........ ........
>  [030] 00 09 00 00 00 05 00 00  00 00 00 00 00 05 00 00  ........ ........
>  [040] 00 43 00 41 00 52 00 50  00 00 00 00 00 08 00 00  .C.A.R.P ........
>  [050] 00 00 00 00 00 08 00 00  00 55 00 4C 00 54 00 49  ........ .U.L.T.I
>  [060] 00 43 00 4F 00 4D 00 00  00 00 00 00 00           .C.O.M.. .....
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,168)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,168) wrote 168
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 23 of length 45
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=52096
>  smt_wct=3
>  smb_vwv[ 0]=29740 (0x742C)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=742c
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=742c (pipes_open=1)
>[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:742c
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
>  close_policy_by_pipe: deleted handle list for pipe wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name wkssvc pnum=742c (pipes_open=0)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=52096
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 24 of length 104
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=52160
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 73 00 72 00 76  00 73 00 76 00 63 00 00  .\.s.r.v .s.v.c..
>  [010] 00                                                . 
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \srvsvc.
>[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe srvsvc opening.
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested srvsvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested srvsvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe srvsvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe srvsvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe srvsvc with handle 742d (pipes_open=1)
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name srvsvc pnum=742d
>[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \srvsvc
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=52160
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=11520 (0x2D00)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 25 of length 160
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=52224
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29741 (0x742D)
>  smb_bcc=89
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [030] 00 C8 4F 32 4B 70 16 D3  01 12 78 5A 47 BF 6E E1  ..O2Kp.. ..xZG.n.
>  [040] 88 03 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=742d
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=742d (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 742d)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 742d name: srvsvc open: Yes len: 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 4b324fc8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : 1670
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : 01d3
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : 12 78 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 5a 47 bf 6e e1 88 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000003
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\srvsvc
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000d
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\ntsvcs.
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000017 smb_io_rpc_results 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 742d name: srvsvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=52224
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0D 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6E 74 73 76 63 73 00  00 01 00 00 00 00 00 00  \ntsvcs. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 144
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x90
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 26 of length 148
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=52288
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29741 (0x742D)
>  smb_bcc=77
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 15  00 C4 E3 A3 09 07 00 00  .$...... ........
>  [030] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 63 00 61  ........ .\.\.c.a
>  [040] 00 72 00 70 00 00 00 00  00 65 00 00 00           .r.p.... .e...
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=742d
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=742d (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 742d)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 742d name: srvsvc open: Yes len: 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 003c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000024
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0015
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\srvsvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[10].fn == e0a54
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 srv_io_q_net_srv_get_info 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 ptr_srv_name  : 09a3e3c4
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.c.a.r.p...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0020 switch_value  : 00000065
>[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1213)
>  srv_net_srv_get_info: 1213
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_info_101(2736)
>  init_srv_info_101
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_r_net_srv_get_info(2971)
>  init_srv_r_net_srv_get_info
>[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1258)
>  srv_net_srv_get_info: 1258
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 srv_io_r_net_srv_get_info 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 srv_io_info_ctr ctr
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 switch_value: 00000065
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 ptr_srv_ctr : 00000001
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000008 srv_io_info_101 sv101
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0008 platform_id : 000001f4
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              000c ptr_name    : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 ver_major   : 00000004
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0014 ver_minor   : 00000009
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0018 srv_type    : 00009a03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              001c ptr_comment : 00000001
>[2005/02/17 12:16:09, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000020 smb_io_unistr2 uni_name    
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0020 uni_max_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0024 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0028 uni_str_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  002c buffer     : C.A.R.P...
>[2005/02/17 12:16:09, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000036 smb_io_unistr2 uni_comment 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0038 uni_max_len: 00000020
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  003c offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0040 uni_str_len: 00000020
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0044 buffer     : C.a.r.p. .-.-. .a. .t.e.s.t. .i.n.s.t.a.n.c.e. .o.f. .C.o.r.p...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0084 status: WERR_OK
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called srvsvc successfully
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 196
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 44
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 742d name: srvsvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 136.
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 00a0
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000088
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..160]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=216
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=52288
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  160 (0xA0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  160 (0xA0)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=161
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 A0 00 00 00 01 00 00  ........ ........
>  [010] 00 88 00 00 00 00 00 00  00 65 00 00 00 01 00 00  ........ .e......
>  [020] 00 F4 01 00 00 01 00 00  00 04 00 00 00 09 00 00  ........ ........
>  [030] 00 03 9A 00 00 01 00 00  00 05 00 00 00 00 00 00  ........ ........
>  [040] 00 05 00 00 00 43 00 41  00 52 00 50 00 00 00 00  .....C.A .R.P....
>  [050] 00 20 00 00 00 00 00 00  00 20 00 00 00 43 00 61  . ...... . ...C.a
>  [060] 00 72 00 70 00 20 00 2D  00 2D 00 20 00 61 00 20  .r.p. .- .-. .a. 
>  [070] 00 74 00 65 00 73 00 74  00 20 00 69 00 6E 00 73  .t.e.s.t . .i.n.s
>  [080] 00 74 00 61 00 6E 00 63  00 65 00 20 00 6F 00 66  .t.a.n.c .e. .o.f
>  [090] 00 20 00 43 00 6F 00 72  00 70 00 00 00 00 00 00  . .C.o.r .p......
>  [0A0] 00                                                . 
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,220)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,220) wrote 220
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 27 of length 45
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=52352
>  smt_wct=3
>  smb_vwv[ 0]=29741 (0x742D)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=742d
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=742d (pipes_open=1)
>[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:742d
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
>  close_policy_by_pipe: deleted handle list for pipe srvsvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name srvsvc pnum=742d (pipes_open=0)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=52352
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 28 of length 104
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=52416
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  256 (0x100)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 77 00 6B 00 73  00 73 00 76 00 63 00 00  .\.w.k.s .s.v.c..
>  [010] 00                                                . 
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \wkssvc.
>[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe wkssvc opening.
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested wkssvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested wkssvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe wkssvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe wkssvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe wkssvc with handle 742e (pipes_open=1)
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name wkssvc pnum=742e
>[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \wkssvc
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=52416
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=11776 (0x2E00)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 29 of length 160
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=52480
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29742 (0x742E)
>  smb_bcc=89
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [030] 00 98 D0 FF 6B 12 A1 10  36 98 33 46 C3 F8 7E 34  ....k... 6.3F..~4
>  [040] 5A 01 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  Z.....]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=742e
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=742e (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 742e)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 742e name: wkssvc open: Yes len: 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 6bffd098
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : a112
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : 3610
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : 98 33 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 46 c3 f8 7e 34 5a 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000001
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\wkssvc
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000d
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\ntsvcs.
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000017 smb_io_rpc_results 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 742e name: wkssvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=52480
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0D 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6E 74 73 76 63 73 00  00 01 00 00 00 00 00 00  \ntsvcs. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 144
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x90
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 30 of length 148
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=52544
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29742 (0x742E)
>  smb_bcc=77
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 00  00 A0 BE A3 09 07 00 00  .$...... ........
>  [030] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 63 00 61  ........ .\.\.c.a
>  [040] 00 72 00 70 00 00 00 00  00 64 00 00 00           .r.p.... .d...
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=742e
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=742e (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 742e)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 742e name: wkssvc open: Yes len: 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 003c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000024
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0000
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[0].fn == dc5e4
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_q_query_info 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 ptr_srv_name: 09a3bea0
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.c.a.r.p...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0020 switch_value: 0064
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66)
>  _wks_query_info: 66
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40)
>  create_wks_info_100: 40
>[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_info_100(79)
>  Init WKS_INFO_100: 79
>[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139)
>  init_wks_r_unknown_0: 139
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76)
>  _wks_query_info: 76
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_r_query_info 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0000 switch_value: 0064
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0004 ptr_1       : 00000001
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 wks_io_wks_info_100 inf
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 platform_id : 000001f4
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c ptr_compname: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0010 ptr_lan_grp : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0014 ver_major   : 00000004
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0018 ver_minor   : 00000009
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          00001c smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              001c uni_max_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 uni_str_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0028 buffer     : C.A.R.P...
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000034 smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0034 uni_max_len: 00000008
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0038 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              003c uni_str_len: 00000008
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0040 buffer     : U.L.T.I.C.O.M...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
>      0050 status      : NT_STATUS_OK
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called wkssvc successfully
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 92
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 44
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 742e name: wkssvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84.
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 006c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000054
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..108]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=164
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=52544
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  108 (0x6C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  108 (0x6C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=109
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 6C 00 00 00 01 00 00  ........ .l......
>  [010] 00 54 00 00 00 00 00 00  00 64 00 00 00 01 00 00  .T...... .d......
>  [020] 00 F4 01 00 00 01 00 00  00 01 00 00 00 04 00 00  ........ ........
>  [030] 00 09 00 00 00 05 00 00  00 00 00 00 00 05 00 00  ........ ........
>  [040] 00 43 00 41 00 52 00 50  00 00 00 00 00 08 00 00  .C.A.R.P ........
>  [050] 00 00 00 00 00 08 00 00  00 55 00 4C 00 54 00 49  ........ .U.L.T.I
>  [060] 00 43 00 4F 00 4D 00 00  00 00 00 00 00           .C.O.M.. .....
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,168)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,168) wrote 168
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 31 of length 45
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=52608
>  smt_wct=3
>  smb_vwv[ 0]=29742 (0x742E)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=742e
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=742e (pipes_open=1)
>[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:742e
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
>  close_policy_by_pipe: deleted handle list for pipe wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name wkssvc pnum=742e (pipes_open=0)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=52608
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 32 of length 104
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=52672
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 73 00 72 00 76  00 73 00 76 00 63 00 00  .\.s.r.v .s.v.c..
>  [010] 00                                                . 
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \srvsvc.
>[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe srvsvc opening.
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested srvsvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested srvsvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe srvsvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe srvsvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe srvsvc with handle 742f (pipes_open=1)
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name srvsvc pnum=742f
>[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \srvsvc
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=52672
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=12032 (0x2F00)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 33 of length 160
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=52736
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29743 (0x742F)
>  smb_bcc=89
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [030] 00 C8 4F 32 4B 70 16 D3  01 12 78 5A 47 BF 6E E1  ..O2Kp.. ..xZG.n.
>  [040] 88 03 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=742f
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=742f (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 742f)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 742f name: srvsvc open: Yes len: 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 4b324fc8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : 1670
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : 01d3
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : 12 78 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 5a 47 bf 6e e1 88 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000003
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\srvsvc
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000d
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\ntsvcs.
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000017 smb_io_rpc_results 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 742f name: srvsvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=52736
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0D 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6E 74 73 76 63 73 00  00 01 00 00 00 00 00 00  \ntsvcs. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 144
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x90
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 34 of length 148
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=52800
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29743 (0x742F)
>  smb_bcc=77
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 15  00 A0 BE A3 09 07 00 00  .$...... ........
>  [030] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 63 00 61  ........ .\.\.c.a
>  [040] 00 72 00 70 00 00 00 00  00 65 00 00 00           .r.p.... .e...
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=742f
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=742f (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 742f)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 742f name: srvsvc open: Yes len: 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 003c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000024
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0015
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\srvsvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[10].fn == e0a54
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 srv_io_q_net_srv_get_info 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 ptr_srv_name  : 09a3bea0
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.c.a.r.p...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0020 switch_value  : 00000065
>[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1213)
>  srv_net_srv_get_info: 1213
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_info_101(2736)
>  init_srv_info_101
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_r_net_srv_get_info(2971)
>  init_srv_r_net_srv_get_info
>[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1258)
>  srv_net_srv_get_info: 1258
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 srv_io_r_net_srv_get_info 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 srv_io_info_ctr ctr
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 switch_value: 00000065
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 ptr_srv_ctr : 00000001
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000008 srv_io_info_101 sv101
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0008 platform_id : 000001f4
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              000c ptr_name    : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 ver_major   : 00000004
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0014 ver_minor   : 00000009
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0018 srv_type    : 00009a03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              001c ptr_comment : 00000001
>[2005/02/17 12:16:09, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000020 smb_io_unistr2 uni_name    
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0020 uni_max_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0024 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0028 uni_str_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  002c buffer     : C.A.R.P...
>[2005/02/17 12:16:09, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000036 smb_io_unistr2 uni_comment 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0038 uni_max_len: 00000020
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  003c offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0040 uni_str_len: 00000020
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0044 buffer     : C.a.r.p. .-.-. .a. .t.e.s.t. .i.n.s.t.a.n.c.e. .o.f. .C.o.r.p...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0084 status: WERR_OK
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called srvsvc successfully
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 196
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 44
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 742f name: srvsvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 136.
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 00a0
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000088
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..160]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=216
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=52800
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  160 (0xA0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  160 (0xA0)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=161
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 A0 00 00 00 01 00 00  ........ ........
>  [010] 00 88 00 00 00 00 00 00  00 65 00 00 00 01 00 00  ........ .e......
>  [020] 00 F4 01 00 00 01 00 00  00 04 00 00 00 09 00 00  ........ ........
>  [030] 00 03 9A 00 00 01 00 00  00 05 00 00 00 00 00 00  ........ ........
>  [040] 00 05 00 00 00 43 00 41  00 52 00 50 00 00 00 00  .....C.A .R.P....
>  [050] 00 20 00 00 00 00 00 00  00 20 00 00 00 43 00 61  . ...... . ...C.a
>  [060] 00 72 00 70 00 20 00 2D  00 2D 00 20 00 61 00 20  .r.p. .- .-. .a. 
>  [070] 00 74 00 65 00 73 00 74  00 20 00 69 00 6E 00 73  .t.e.s.t . .i.n.s
>  [080] 00 74 00 61 00 6E 00 63  00 65 00 20 00 6F 00 66  .t.a.n.c .e. .o.f
>  [090] 00 20 00 43 00 6F 00 72  00 70 00 00 00 00 00 00  . .C.o.r .p......
>  [0A0] 00                                                . 
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,220)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,220) wrote 220
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 35 of length 45
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=52864
>  smt_wct=3
>  smb_vwv[ 0]=29743 (0x742F)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=742f
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=742f (pipes_open=1)
>[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:742f
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
>  close_policy_by_pipe: deleted handle list for pipe srvsvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name srvsvc pnum=742f (pipes_open=0)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=52864
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 36 of length 104
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=52928
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  256 (0x100)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 77 00 6B 00 73  00 73 00 76 00 63 00 00  .\.w.k.s .s.v.c..
>  [010] 00                                                . 
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \wkssvc.
>[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe wkssvc opening.
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested wkssvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested wkssvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe wkssvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe wkssvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe wkssvc with handle 7430 (pipes_open=1)
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name wkssvc pnum=7430
>[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \wkssvc
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=52928
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=12288 (0x3000)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 37 of length 160
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=52992
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29744 (0x7430)
>  smb_bcc=89
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [030] 00 98 D0 FF 6B 12 A1 10  36 98 33 46 C3 F8 7E 34  ....k... 6.3F..~4
>  [040] 5A 01 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  Z.....]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7430
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=7430 (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 7430)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7430 name: wkssvc open: Yes len: 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 6bffd098
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : a112
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : 3610
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : 98 33 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 46 c3 f8 7e 34 5a 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000001
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\wkssvc
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000d
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\ntsvcs.
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000017 smb_io_rpc_results 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7430 name: wkssvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=52992
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0D 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6E 74 73 76 63 73 00  00 01 00 00 00 00 00 00  \ntsvcs. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 144
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x90
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 38 of length 148
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=53056
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29744 (0x7430)
>  smb_bcc=77
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 00  00 A4 BE A3 09 07 00 00  .$...... ........
>  [030] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 63 00 61  ........ .\.\.c.a
>  [040] 00 72 00 70 00 00 00 00  00 64 00 00 00           .r.p.... .d...
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7430
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=7430 (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 7430)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7430 name: wkssvc open: Yes len: 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 003c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000024
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0000
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[0].fn == dc5e4
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_q_query_info 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 ptr_srv_name: 09a3bea4
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.c.a.r.p...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0020 switch_value: 0064
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66)
>  _wks_query_info: 66
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40)
>  create_wks_info_100: 40
>[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_info_100(79)
>  Init WKS_INFO_100: 79
>[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139)
>  init_wks_r_unknown_0: 139
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76)
>  _wks_query_info: 76
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_r_query_info 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0000 switch_value: 0064
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0004 ptr_1       : 00000001
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 wks_io_wks_info_100 inf
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 platform_id : 000001f4
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c ptr_compname: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0010 ptr_lan_grp : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0014 ver_major   : 00000004
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0018 ver_minor   : 00000009
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          00001c smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              001c uni_max_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 uni_str_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0028 buffer     : C.A.R.P...
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000034 smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0034 uni_max_len: 00000008
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0038 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              003c uni_str_len: 00000008
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0040 buffer     : U.L.T.I.C.O.M...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
>      0050 status      : NT_STATUS_OK
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called wkssvc successfully
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 92
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 44
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7430 name: wkssvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84.
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 006c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000054
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..108]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=164
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=53056
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  108 (0x6C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  108 (0x6C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=109
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 6C 00 00 00 01 00 00  ........ .l......
>  [010] 00 54 00 00 00 00 00 00  00 64 00 00 00 01 00 00  .T...... .d......
>  [020] 00 F4 01 00 00 01 00 00  00 01 00 00 00 04 00 00  ........ ........
>  [030] 00 09 00 00 00 05 00 00  00 00 00 00 00 05 00 00  ........ ........
>  [040] 00 43 00 41 00 52 00 50  00 00 00 00 00 08 00 00  .C.A.R.P ........
>  [050] 00 00 00 00 00 08 00 00  00 55 00 4C 00 54 00 49  ........ .U.L.T.I
>  [060] 00 43 00 4F 00 4D 00 00  00 00 00 00 00           .C.O.M.. .....
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,168)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,168) wrote 168
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 39 of length 45
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=53120
>  smt_wct=3
>  smb_vwv[ 0]=29744 (0x7430)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7430
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=7430 (pipes_open=1)
>[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:7430
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
>  close_policy_by_pipe: deleted handle list for pipe wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name wkssvc pnum=7430 (pipes_open=0)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=53120
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 40 of length 104
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=53184
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  256 (0x100)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 77 00 6B 00 73  00 73 00 76 00 63 00 00  .\.w.k.s .s.v.c..
>  [010] 00                                                . 
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \wkssvc.
>[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe wkssvc opening.
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested wkssvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested wkssvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe wkssvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe wkssvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe wkssvc with handle 7431 (pipes_open=1)
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name wkssvc pnum=7431
>[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \wkssvc
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=53184
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=12544 (0x3100)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 41 of length 160
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=53248
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29745 (0x7431)
>  smb_bcc=89
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [030] 00 98 D0 FF 6B 12 A1 10  36 98 33 46 C3 F8 7E 34  ....k... 6.3F..~4
>  [040] 5A 01 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  Z.....]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7431
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=7431 (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 7431)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7431 name: wkssvc open: Yes len: 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 6bffd098
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : a112
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : 3610
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : 98 33 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 46 c3 f8 7e 34 5a 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000001
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\wkssvc
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000d
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\ntsvcs.
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000017 smb_io_rpc_results 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7431 name: wkssvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=53248
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0D 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6E 74 73 76 63 73 00  00 01 00 00 00 00 00 00  \ntsvcs. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 144
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x90
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 42 of length 148
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=53312
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29745 (0x7431)
>  smb_bcc=77
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 00  00 D8 C5 A3 09 07 00 00  .$...... ........
>  [030] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 63 00 61  ........ .\.\.c.a
>  [040] 00 72 00 70 00 00 00 00  00 64 00 00 00           .r.p.... .d...
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7431
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=7431 (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 7431)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7431 name: wkssvc open: Yes len: 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 003c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000024
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0000
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[0].fn == dc5e4
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_q_query_info 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 ptr_srv_name: 09a3c5d8
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.c.a.r.p...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0020 switch_value: 0064
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66)
>  _wks_query_info: 66
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40)
>  create_wks_info_100: 40
>[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_info_100(79)
>  Init WKS_INFO_100: 79
>[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139)
>  init_wks_r_unknown_0: 139
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76)
>  _wks_query_info: 76
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_r_query_info 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0000 switch_value: 0064
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0004 ptr_1       : 00000001
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 wks_io_wks_info_100 inf
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 platform_id : 000001f4
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c ptr_compname: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0010 ptr_lan_grp : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0014 ver_major   : 00000004
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0018 ver_minor   : 00000009
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          00001c smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              001c uni_max_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 uni_str_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0028 buffer     : C.A.R.P...
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000034 smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0034 uni_max_len: 00000008
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0038 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              003c uni_str_len: 00000008
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0040 buffer     : U.L.T.I.C.O.M...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
>      0050 status      : NT_STATUS_OK
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called wkssvc successfully
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 92
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 44
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7431 name: wkssvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84.
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 006c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000054
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..108]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=164
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=53312
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  108 (0x6C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  108 (0x6C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=109
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 6C 00 00 00 01 00 00  ........ .l......
>  [010] 00 54 00 00 00 00 00 00  00 64 00 00 00 01 00 00  .T...... .d......
>  [020] 00 F4 01 00 00 01 00 00  00 01 00 00 00 04 00 00  ........ ........
>  [030] 00 09 00 00 00 05 00 00  00 00 00 00 00 05 00 00  ........ ........
>  [040] 00 43 00 41 00 52 00 50  00 00 00 00 00 08 00 00  .C.A.R.P ........
>  [050] 00 00 00 00 00 08 00 00  00 55 00 4C 00 54 00 49  ........ .U.L.T.I
>  [060] 00 43 00 4F 00 4D 00 00  00 00 00 00 00           .C.O.M.. .....
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,168)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,168) wrote 168
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 43 of length 45
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=53376
>  smt_wct=3
>  smb_vwv[ 0]=29745 (0x7431)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7431
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=7431 (pipes_open=1)
>[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:7431
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
>  close_policy_by_pipe: deleted handle list for pipe wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name wkssvc pnum=7431 (pipes_open=0)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=53376
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 44 of length 104
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=53440
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 73 00 72 00 76  00 73 00 76 00 63 00 00  .\.s.r.v .s.v.c..
>  [010] 00                                                . 
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \srvsvc.
>[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe srvsvc opening.
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested srvsvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested srvsvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe srvsvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe srvsvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe srvsvc with handle 7432 (pipes_open=1)
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name srvsvc pnum=7432
>[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \srvsvc
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=53440
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=12800 (0x3200)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 45 of length 160
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=53504
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29746 (0x7432)
>  smb_bcc=89
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [030] 00 C8 4F 32 4B 70 16 D3  01 12 78 5A 47 BF 6E E1  ..O2Kp.. ..xZG.n.
>  [040] 88 03 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7432
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=7432 (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 7432)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7432 name: srvsvc open: Yes len: 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 4b324fc8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : 1670
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : 01d3
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : 12 78 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 5a 47 bf 6e e1 88 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000003
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\srvsvc
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000d
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\ntsvcs.
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000017 smb_io_rpc_results 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7432 name: srvsvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=53504
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0D 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6E 74 73 76 63 73 00  00 01 00 00 00 00 00 00  \ntsvcs. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 144
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x90
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 46 of length 148
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=53568
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29746 (0x7432)
>  smb_bcc=77
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 15  00 D8 C5 A3 09 07 00 00  .$...... ........
>  [030] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 63 00 61  ........ .\.\.c.a
>  [040] 00 72 00 70 00 00 00 00  00 65 00 00 00           .r.p.... .e...
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7432
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=7432 (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 7432)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7432 name: srvsvc open: Yes len: 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 003c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000024
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0015
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\srvsvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[10].fn == e0a54
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 srv_io_q_net_srv_get_info 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 ptr_srv_name  : 09a3c5d8
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.c.a.r.p...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0020 switch_value  : 00000065
>[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1213)
>  srv_net_srv_get_info: 1213
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_info_101(2736)
>  init_srv_info_101
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_r_net_srv_get_info(2971)
>  init_srv_r_net_srv_get_info
>[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1258)
>  srv_net_srv_get_info: 1258
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 srv_io_r_net_srv_get_info 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 srv_io_info_ctr ctr
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 switch_value: 00000065
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 ptr_srv_ctr : 00000001
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000008 srv_io_info_101 sv101
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0008 platform_id : 000001f4
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              000c ptr_name    : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 ver_major   : 00000004
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0014 ver_minor   : 00000009
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0018 srv_type    : 00009a03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              001c ptr_comment : 00000001
>[2005/02/17 12:16:09, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000020 smb_io_unistr2 uni_name    
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0020 uni_max_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0024 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0028 uni_str_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  002c buffer     : C.A.R.P...
>[2005/02/17 12:16:09, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000036 smb_io_unistr2 uni_comment 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0038 uni_max_len: 00000020
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  003c offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0040 uni_str_len: 00000020
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0044 buffer     : C.a.r.p. .-.-. .a. .t.e.s.t. .i.n.s.t.a.n.c.e. .o.f. .C.o.r.p...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0084 status: WERR_OK
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called srvsvc successfully
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 196
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 44
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7432 name: srvsvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 136.
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 00a0
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000088
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..160]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=216
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=53568
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  160 (0xA0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  160 (0xA0)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=161
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 A0 00 00 00 01 00 00  ........ ........
>  [010] 00 88 00 00 00 00 00 00  00 65 00 00 00 01 00 00  ........ .e......
>  [020] 00 F4 01 00 00 01 00 00  00 04 00 00 00 09 00 00  ........ ........
>  [030] 00 03 9A 00 00 01 00 00  00 05 00 00 00 00 00 00  ........ ........
>  [040] 00 05 00 00 00 43 00 41  00 52 00 50 00 00 00 00  .....C.A .R.P....
>  [050] 00 20 00 00 00 00 00 00  00 20 00 00 00 43 00 61  . ...... . ...C.a
>  [060] 00 72 00 70 00 20 00 2D  00 2D 00 20 00 61 00 20  .r.p. .- .-. .a. 
>  [070] 00 74 00 65 00 73 00 74  00 20 00 69 00 6E 00 73  .t.e.s.t . .i.n.s
>  [080] 00 74 00 61 00 6E 00 63  00 65 00 20 00 6F 00 66  .t.a.n.c .e. .o.f
>  [090] 00 20 00 43 00 6F 00 72  00 70 00 00 00 00 00 00  . .C.o.r .p......
>  [0A0] 00                                                . 
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,220)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,220) wrote 220
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 47 of length 45
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=53632
>  smt_wct=3
>  smb_vwv[ 0]=29746 (0x7432)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7432
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=7432 (pipes_open=1)
>[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:7432
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
>  close_policy_by_pipe: deleted handle list for pipe srvsvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name srvsvc pnum=7432 (pipes_open=0)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=53632
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 48 of length 104
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=53696
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  256 (0x100)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 77 00 6B 00 73  00 73 00 76 00 63 00 00  .\.w.k.s .s.v.c..
>  [010] 00                                                . 
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \wkssvc.
>[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe wkssvc opening.
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested wkssvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested wkssvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe wkssvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe wkssvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe wkssvc with handle 7433 (pipes_open=1)
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name wkssvc pnum=7433
>[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \wkssvc
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=53696
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=13056 (0x3300)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 49 of length 160
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=53760
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29747 (0x7433)
>  smb_bcc=89
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [030] 00 98 D0 FF 6B 12 A1 10  36 98 33 46 C3 F8 7E 34  ....k... 6.3F..~4
>  [040] 5A 01 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  Z.....]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7433
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=7433 (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 7433)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7433 name: wkssvc open: Yes len: 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 6bffd098
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : a112
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : 3610
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : 98 33 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 46 c3 f8 7e 34 5a 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000001
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\wkssvc
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000d
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\ntsvcs.
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000017 smb_io_rpc_results 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7433 name: wkssvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=53760
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0D 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6E 74 73 76 63 73 00  00 01 00 00 00 00 00 00  \ntsvcs. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:09, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2005/02/17 12:16:09, 5] smbd/uid.c:change_to_root_user(296)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 144
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x90
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 50 of length 148
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=53824
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29747 (0x7433)
>  smb_bcc=77
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 00  00 DC C5 A3 09 07 00 00  .$...... ........
>  [030] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 63 00 61  ........ .\.\.c.a
>  [040] 00 72 00 70 00 00 00 00  00 64 00 00 00           .r.p.... .d...
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (402, 101) - sec_ctx_stack_ndx = 0
>[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_nt_user_token(491)
>  NT user token of user S-1-5-21-104134243-2275341451-782570472-1804
>  contains 10 SIDs
>  SID[  0]: S-1-5-21-104134243-2275341451-782570472-1804
>  SID[  1]: S-1-5-21-104134243-2275341451-782570472-3205
>  SID[  2]: S-1-1-0
>  SID[  3]: S-1-5-2
>  SID[  4]: S-1-5-11
>  SID[  5]: S-1-5-21-3834718897-2476707436-3842496652-1203
>  SID[  6]: S-1-5-21-3834718897-2476707436-3842496652-1021
>  SID[  7]: S-1-5-21-3834718897-2476707436-3842496652-1227
>  SID[  8]: S-1-5-21-3834718897-2476707436-3842496652-3205
>  SID[  9]: S-1-5-21-3834718897-2476707436-3842496652-3277
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2005/02/17 12:16:09, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 402
>  Primary group is 101 and contains 5 supplementary groups
>  Group[  0]: 101
>  Group[  1]: 10
>  Group[  2]: 113
>  Group[  3]: 1102
>  Group[  4]: 1138
>[2005/02/17 12:16:09, 5] smbd/uid.c:change_to_user(281)
>  change_to_user uid=(0,402) gid=(0,101)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7433
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=7433 (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 7433)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7433 name: wkssvc open: Yes len: 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 003c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000024
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0000
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[0].fn == dc5e4
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_q_query_info 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 ptr_srv_name: 09a3c5dc
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.c.a.r.p...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0020 switch_value: 0064
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66)
>  _wks_query_info: 66
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40)
>  create_wks_info_100: 40
>[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_info_100(79)
>  Init WKS_INFO_100: 79
>[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139)
>  init_wks_r_unknown_0: 139
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76)
>  _wks_query_info: 76
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_r_query_info 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0000 switch_value: 0064
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0004 ptr_1       : 00000001
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 wks_io_wks_info_100 inf
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 platform_id : 000001f4
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c ptr_compname: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0010 ptr_lan_grp : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0014 ver_major   : 00000004
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0018 ver_minor   : 00000009
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          00001c smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              001c uni_max_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 uni_str_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0028 buffer     : C.A.R.P...
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000034 smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0034 uni_max_len: 00000008
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0038 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              003c uni_str_len: 00000008
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0040 buffer     : U.L.T.I.C.O.M...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
>      0050 status      : NT_STATUS_OK
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called wkssvc successfully
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 92
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 44
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7433 name: wkssvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84.
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 006c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000054
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..108]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=164
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=53824
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  108 (0x6C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  108 (0x6C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=109
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 6C 00 00 00 01 00 00  ........ .l......
>  [010] 00 54 00 00 00 00 00 00  00 64 00 00 00 01 00 00  .T...... .d......
>  [020] 00 F4 01 00 00 01 00 00  00 01 00 00 00 04 00 00  ........ ........
>  [030] 00 09 00 00 00 05 00 00  00 00 00 00 00 05 00 00  ........ ........
>  [040] 00 43 00 41 00 52 00 50  00 00 00 00 00 08 00 00  .C.A.R.P ........
>  [050] 00 00 00 00 00 08 00 00  00 55 00 4C 00 54 00 49  ........ .U.L.T.I
>  [060] 00 43 00 4F 00 4D 00 00  00 00 00 00 00           .C.O.M.. .....
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,168)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,168) wrote 168
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 51 of length 45
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=53888
>  smt_wct=3
>  smb_vwv[ 0]=29747 (0x7433)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7433
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=7433 (pipes_open=1)
>[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:7433
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
>  close_policy_by_pipe: deleted handle list for pipe wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name wkssvc pnum=7433 (pipes_open=0)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=53888
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 52 of length 104
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=53952
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  256 (0x100)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 77 00 6B 00 73  00 73 00 76 00 63 00 00  .\.w.k.s .s.v.c..
>  [010] 00                                                . 
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \wkssvc.
>[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe wkssvc opening.
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested wkssvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested wkssvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe wkssvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe wkssvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe wkssvc with handle 7434 (pipes_open=1)
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name wkssvc pnum=7434
>[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \wkssvc
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=53952
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=13312 (0x3400)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 53 of length 160
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=54016
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29748 (0x7434)
>  smb_bcc=89
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 69  .\.P.I.P .E.\...i
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [030] 00 98 D0 FF 6B 12 A1 10  36 98 33 46 C3 F8 7E 34  ....k... 6.3F..~4
>  [040] 5A 01 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  Z.....]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7434
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=7434 (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 7434)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7434 name: wkssvc open: Yes len: 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 6bffd098
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : a112
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : 3610
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : 98 33 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 46 c3 f8 7e 34 5a 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000001
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\wkssvc
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000d
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\ntsvcs.
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000017 smb_io_rpc_results 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7434 name: wkssvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=54016
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0D 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6E 74 73 76 63 73 00  00 01 00 00 00 00 00 00  \ntsvcs. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 144
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x90
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 54 of length 148
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=54080
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29748 (0x7434)
>  smb_bcc=77
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 69  .\.P.I.P .E.\...i
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 00  00 2C D1 FB 00 07 00 00  .$...... .,......
>  [030] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 63 00 61  ........ .\.\.c.a
>  [040] 00 72 00 70 00 00 00 00  00 64 00 00 00           .r.p.... .d...
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7434
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=7434 (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 7434)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7434 name: wkssvc open: Yes len: 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 003c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000024
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0000
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[0].fn == dc5e4
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_q_query_info 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 ptr_srv_name: 00fbd12c
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.c.a.r.p...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0020 switch_value: 0064
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66)
>  _wks_query_info: 66
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40)
>  create_wks_info_100: 40
>[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_info_100(79)
>  Init WKS_INFO_100: 79
>[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139)
>  init_wks_r_unknown_0: 139
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76)
>  _wks_query_info: 76
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_r_query_info 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0000 switch_value: 0064
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0004 ptr_1       : 00000001
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 wks_io_wks_info_100 inf
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 platform_id : 000001f4
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c ptr_compname: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0010 ptr_lan_grp : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0014 ver_major   : 00000004
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0018 ver_minor   : 00000009
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          00001c smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              001c uni_max_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 uni_str_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0028 buffer     : C.A.R.P...
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000034 smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0034 uni_max_len: 00000008
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0038 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              003c uni_str_len: 00000008
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0040 buffer     : U.L.T.I.C.O.M...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
>      0050 status      : NT_STATUS_OK
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called wkssvc successfully
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 92
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 44
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7434 name: wkssvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84.
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 006c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000054
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..108]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=164
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=54080
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  108 (0x6C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  108 (0x6C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=109
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 6C 00 00 00 01 00 00  ........ .l......
>  [010] 00 54 00 00 00 00 00 00  00 64 00 00 00 01 00 00  .T...... .d......
>  [020] 00 F4 01 00 00 01 00 00  00 01 00 00 00 04 00 00  ........ ........
>  [030] 00 09 00 00 00 05 00 00  00 00 00 00 00 05 00 00  ........ ........
>  [040] 00 43 00 41 00 52 00 50  00 00 00 00 00 08 00 00  .C.A.R.P ........
>  [050] 00 00 00 00 00 08 00 00  00 55 00 4C 00 54 00 49  ........ .U.L.T.I
>  [060] 00 43 00 4F 00 4D 00 00  00 00 00 00 00           .C.O.M.. .....
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,168)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,168) wrote 168
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 55 of length 45
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=54144
>  smt_wct=3
>  smb_vwv[ 0]=29748 (0x7434)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7434
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=7434 (pipes_open=1)
>[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:7434
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
>  close_policy_by_pipe: deleted handle list for pipe wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name wkssvc pnum=7434 (pipes_open=0)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=54144
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 56 of length 104
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=54208
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 73 00 72 00 76  00 73 00 76 00 63 00 00  .\.s.r.v .s.v.c..
>  [010] 00                                                . 
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \srvsvc.
>[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe srvsvc opening.
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested srvsvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested srvsvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe srvsvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe srvsvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe srvsvc with handle 7435 (pipes_open=1)
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name srvsvc pnum=7435
>[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \srvsvc
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=54208
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=13568 (0x3500)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 57 of length 160
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=54272
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29749 (0x7435)
>  smb_bcc=89
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 69  .\.P.I.P .E.\...i
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [030] 00 C8 4F 32 4B 70 16 D3  01 12 78 5A 47 BF 6E E1  ..O2Kp.. ..xZG.n.
>  [040] 88 03 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7435
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=7435 (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 7435)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7435 name: srvsvc open: Yes len: 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 4b324fc8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : 1670
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : 01d3
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : 12 78 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 5a 47 bf 6e e1 88 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000003
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\srvsvc
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000d
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\ntsvcs.
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000017 smb_io_rpc_results 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7435 name: srvsvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=54272
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0D 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6E 74 73 76 63 73 00  00 01 00 00 00 00 00 00  \ntsvcs. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 144
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x90
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 58 of length 148
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=54336
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29749 (0x7435)
>  smb_bcc=77
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 69  .\.P.I.P .E.\...i
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 15  00 2C D1 FB 00 07 00 00  .$...... .,......
>  [030] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 63 00 61  ........ .\.\.c.a
>  [040] 00 72 00 70 00 00 00 00  00 65 00 00 00           .r.p.... .e...
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7435
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=7435 (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 7435)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7435 name: srvsvc open: Yes len: 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 003c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000024
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0015
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\srvsvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[10].fn == e0a54
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 srv_io_q_net_srv_get_info 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 ptr_srv_name  : 00fbd12c
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.c.a.r.p...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0020 switch_value  : 00000065
>[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1213)
>  srv_net_srv_get_info: 1213
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_info_101(2736)
>  init_srv_info_101
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_r_net_srv_get_info(2971)
>  init_srv_r_net_srv_get_info
>[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1258)
>  srv_net_srv_get_info: 1258
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 srv_io_r_net_srv_get_info 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 srv_io_info_ctr ctr
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 switch_value: 00000065
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 ptr_srv_ctr : 00000001
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000008 srv_io_info_101 sv101
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0008 platform_id : 000001f4
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              000c ptr_name    : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 ver_major   : 00000004
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0014 ver_minor   : 00000009
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0018 srv_type    : 00009a03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              001c ptr_comment : 00000001
>[2005/02/17 12:16:09, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000020 smb_io_unistr2 uni_name    
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0020 uni_max_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0024 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0028 uni_str_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  002c buffer     : C.A.R.P...
>[2005/02/17 12:16:09, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000036 smb_io_unistr2 uni_comment 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0038 uni_max_len: 00000020
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  003c offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0040 uni_str_len: 00000020
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0044 buffer     : C.a.r.p. .-.-. .a. .t.e.s.t. .i.n.s.t.a.n.c.e. .o.f. .C.o.r.p...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0084 status: WERR_OK
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called srvsvc successfully
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 196
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 44
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7435 name: srvsvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 136.
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 00a0
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000088
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..160]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=216
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=54336
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  160 (0xA0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  160 (0xA0)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=161
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 A0 00 00 00 01 00 00  ........ ........
>  [010] 00 88 00 00 00 00 00 00  00 65 00 00 00 01 00 00  ........ .e......
>  [020] 00 F4 01 00 00 01 00 00  00 04 00 00 00 09 00 00  ........ ........
>  [030] 00 03 9A 00 00 01 00 00  00 05 00 00 00 00 00 00  ........ ........
>  [040] 00 05 00 00 00 43 00 41  00 52 00 50 00 00 00 00  .....C.A .R.P....
>  [050] 00 20 00 00 00 00 00 00  00 20 00 00 00 43 00 61  . ...... . ...C.a
>  [060] 00 72 00 70 00 20 00 2D  00 2D 00 20 00 61 00 20  .r.p. .- .-. .a. 
>  [070] 00 74 00 65 00 73 00 74  00 20 00 69 00 6E 00 73  .t.e.s.t . .i.n.s
>  [080] 00 74 00 61 00 6E 00 63  00 65 00 20 00 6F 00 66  .t.a.n.c .e. .o.f
>  [090] 00 20 00 43 00 6F 00 72  00 70 00 00 00 00 00 00  . .C.o.r .p......
>  [0A0] 00                                                . 
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,220)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,220) wrote 220
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 59 of length 45
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=54400
>  smt_wct=3
>  smb_vwv[ 0]=29749 (0x7435)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7435
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=7435 (pipes_open=1)
>[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:7435
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
>  close_policy_by_pipe: deleted handle list for pipe srvsvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name srvsvc pnum=7435 (pipes_open=0)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=54400
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 60 of length 104
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=54464
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  256 (0x100)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 77 00 6B 00 73  00 73 00 76 00 63 00 00  .\.w.k.s .s.v.c..
>  [010] 00                                                . 
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \wkssvc.
>[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe wkssvc opening.
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested wkssvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested wkssvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe wkssvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe wkssvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe wkssvc with handle 7436 (pipes_open=1)
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name wkssvc pnum=7436
>[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \wkssvc
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=54464
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=13824 (0x3600)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 61 of length 160
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=54528
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29750 (0x7436)
>  smb_bcc=89
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 69  .\.P.I.P .E.\...i
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [030] 00 98 D0 FF 6B 12 A1 10  36 98 33 46 C3 F8 7E 34  ....k... 6.3F..~4
>  [040] 5A 01 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  Z.....]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7436
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=7436 (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 7436)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7436 name: wkssvc open: Yes len: 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 6bffd098
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : a112
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : 3610
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : 98 33 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 46 c3 f8 7e 34 5a 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000001
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\wkssvc
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000d
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\ntsvcs.
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000017 smb_io_rpc_results 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7436 name: wkssvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=54528
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0D 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6E 74 73 76 63 73 00  00 01 00 00 00 00 00 00  \ntsvcs. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 144
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x90
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 62 of length 148
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=54592
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29750 (0x7436)
>  smb_bcc=77
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 00  00 30 D1 FB 00 07 00 00  .$...... .0......
>  [030] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 63 00 61  ........ .\.\.c.a
>  [040] 00 72 00 70 00 00 00 00  00 64 00 00 00           .r.p.... .d...
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7436
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=7436 (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 7436)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7436 name: wkssvc open: Yes len: 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 003c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000024
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0000
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[0].fn == dc5e4
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_q_query_info 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 ptr_srv_name: 00fbd130
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.c.a.r.p...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0020 switch_value: 0064
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66)
>  _wks_query_info: 66
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40)
>  create_wks_info_100: 40
>[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_info_100(79)
>  Init WKS_INFO_100: 79
>[2005/02/17 12:16:09, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139)
>  init_wks_r_unknown_0: 139
>[2005/02/17 12:16:09, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76)
>  _wks_query_info: 76
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_r_query_info 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0000 switch_value: 0064
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0004 ptr_1       : 00000001
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 wks_io_wks_info_100 inf
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 platform_id : 000001f4
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c ptr_compname: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0010 ptr_lan_grp : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0014 ver_major   : 00000004
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0018 ver_minor   : 00000009
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          00001c smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              001c uni_max_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 uni_str_len: 00000005
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0028 buffer     : C.A.R.P...
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000034 smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0034 uni_max_len: 00000008
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0038 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              003c uni_str_len: 00000008
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0040 buffer     : U.L.T.I.C.O.M...
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
>      0050 status      : NT_STATUS_OK
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called wkssvc successfully
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 92
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 44
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7436 name: wkssvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84.
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 006c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000054
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..108]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=164
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=54592
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  108 (0x6C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  108 (0x6C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=109
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 6C 00 00 00 01 00 00  ........ .l......
>  [010] 00 54 00 00 00 00 00 00  00 64 00 00 00 01 00 00  .T...... .d......
>  [020] 00 F4 01 00 00 01 00 00  00 01 00 00 00 04 00 00  ........ ........
>  [030] 00 09 00 00 00 05 00 00  00 00 00 00 00 05 00 00  ........ ........
>  [040] 00 43 00 41 00 52 00 50  00 00 00 00 00 08 00 00  .C.A.R.P ........
>  [050] 00 00 00 00 00 08 00 00  00 55 00 4C 00 54 00 49  ........ .U.L.T.I
>  [060] 00 43 00 4F 00 4D 00 00  00 00 00 00 00           .C.O.M.. .....
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,168)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,168) wrote 168
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 63 of length 45
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=54656
>  smt_wct=3
>  smb_vwv[ 0]=29750 (0x7436)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7436
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=7436 (pipes_open=1)
>[2005/02/17 12:16:09, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:7436
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
>  close_policy_by_pipe: deleted handle list for pipe wkssvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name wkssvc pnum=7436 (pipes_open=0)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=54656
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 64 of length 104
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=54720
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 73 00 72 00 76  00 73 00 76 00 63 00 00  .\.s.r.v .s.v.c..
>  [010] 00                                                . 
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:09, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \srvsvc.
>[2005/02/17 12:16:09, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe srvsvc opening.
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested srvsvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested srvsvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe srvsvc
>[2005/02/17 12:16:09, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe srvsvc (pipes_open=0)
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe srvsvc with handle 7437 (pipes_open=1)
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name srvsvc pnum=7437
>[2005/02/17 12:16:09, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \srvsvc
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=54720
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=14080 (0x3700)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 65 of length 160
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=54784
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29751 (0x7437)
>  smb_bcc=89
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [030] 00 C8 4F 32 4B 70 16 D3  01 12 78 5A 47 BF 6E E1  ..O2Kp.. ..xZG.n.
>  [040] 88 03 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7437
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=7437 (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 7437)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7437 name: srvsvc open: Yes len: 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 4b324fc8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : 1670
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : 01d3
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : 12 78 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 5a 47 bf 6e e1 88 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000003
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\srvsvc
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000d
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\ntsvcs.
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000017 smb_io_rpc_results 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7437 name: srvsvc len: 1024
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:09, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=54784
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0D 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6E 74 73 76 63 73 00  00 01 00 00 00 00 00 00  \ntsvcs. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:09, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:09, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 168
>[2005/02/17 12:16:09, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0xa8
>[2005/02/17 12:16:09, 3] smbd/process.c:process_smb(1091)
>  Transaction 66 of length 172
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:09, 5] lib/util.c:show_msg(474)
>  size=168
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=54848
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   84 (0x54)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   84 (0x54)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29751 (0x7437)
>  smb_bcc=101
>[2005/02/17 12:16:09, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 00 03 10 00 00  00 54 00 00 00 01 00 00  ........ .T......
>  [020] 00 3C 00 00 00 00 00 0F  00 04 73 81 00 07 00 00  .<...... ..s.....
>  [030] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 63 00 61  ........ .\.\.c.a
>  [040] 00 72 00 70 00 00 00 00  00 01 00 00 00 01 00 00  .r.p.... ........
>  [050] 00 F8 DD CF 09 00 00 00  00 00 00 00 00 FF FF FF  ........ ........
>  [060] FF 00 00 00 00                                    ..... 
>[2005/02/17 12:16:09, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:09, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:09, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=84 params=0 setup=2
>[2005/02/17 12:16:09, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:09, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:09, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7437
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=7437 (pipes_open=1)
>[2005/02/17 12:16:09, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 7437)
>[2005/02/17 12:16:09, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7437 name: srvsvc open: Yes len: 84
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 84
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 84
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 84, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 68
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 68
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0054
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 68
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 68, incoming data = 68
>[2005/02/17 12:16:09, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 0000003c
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000f
>[2005/02/17 12:16:09, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:09, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\srvsvc
>[2005/02/17 12:16:09, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: srvsvc op 0xf - api_rpcTNP: rpc command: SRV_NET_SHARE_ENUM_ALL
>[2005/02/17 12:16:09, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[2].fn == e0e30
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 srv_io_q_net_share_enum 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 ptr_srv_name: 00817304
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000007
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.c.a.r.p...
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00001e srv_io_srv_share_ctr share_ctr
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 info_level: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 switch_value: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 ptr_share_info: 09cfddf8
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          002c num_entries: 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 ptr_entries: 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0034 preferred_len: ffffffff
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000038 smb_io_enum_hnd enum_hnd
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0038 ptr_hnd: 00000000
>[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_share_enum_all(1357)
>  _srv_net_share_enum: 1357
>[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:init_srv_r_net_share_enum(730)
>  init_srv_r_net_share_enum: 730
>[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:init_srv_share_info_ctr(502)
>  init_srv_share_info_ctr
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142)
>  init_srv_share_info1: users        0 Links to all the user's home directories
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101)
>  init_srv_share_info1_str
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142)
>  init_srv_share_info1: hosts        0 Links to other file servers in the same NIS domain.
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101)
>  init_srv_share_info1_str
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142)
>  init_srv_share_info1: public        0 Here are files for public consumption
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101)
>  init_srv_share_info1_str
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142)
>  init_srv_share_info1: doc-grp        0 /corp/doc/group -- Group Only Share
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101)
>  init_srv_share_info1_str
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142)
>  init_srv_share_info1: doc-pub        0 /corp/doc/public -- Publicly Readable Share
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101)
>  init_srv_share_info1_str
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142)
>  init_srv_share_info1: doc-web        0 /corp/doc/public_html -- Group's webspace
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101)
>  init_srv_share_info1_str
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142)
>  init_srv_share_info1: hradm-grp        0 /u/hradm/group -- Group Only Share
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101)
>  init_srv_share_info1_str
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142)
>  init_srv_share_info1: hradm-pub        0 /u/hradm/public -- Publicly Readable Share
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101)
>  init_srv_share_info1_str
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142)
>  init_srv_share_info1: hradm-web        0 /u/hradm/public_html -- Group's webspace
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101)
>  init_srv_share_info1_str
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142)
>  init_srv_share_info1: it-grp        0 /corp/it/group -- Group Only Share
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101)
>  init_srv_share_info1_str
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142)
>  init_srv_share_info1: it-pub        0 /corp/it/public -- Publicly Readable Share
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101)
>  init_srv_share_info1_str
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142)
>  init_srv_share_info1: OracleImp        0 ES Group Oracle Implementation
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101)
>  init_srv_share_info1_str
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142)
>  init_srv_share_info1: Q-Train        0 Quality Trainer
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101)
>  init_srv_share_info1_str
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142)
>  init_srv_share_info1: IPC$        3 IPC Service (Carp -- a test instance of Corp)
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101)
>  init_srv_share_info1_str
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142)
>  init_srv_share_info1: ADMIN$        3 IPC Service (Carp -- a test instance of Corp)
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101)
>  init_srv_share_info1_str
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142)
>  init_srv_share_info1: gaa        0 My Corporate Directory
>[2005/02/17 12:16:09, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101)
>  init_srv_share_info1_str
>[2005/02/17 12:16:09, 5] rpc_parse/parse_misc.c:init_enum_hnd(171)
>  smb_io_enum_hnd
>[2005/02/17 12:16:09, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_share_enum_all(1369)
>  _srv_net_share_enum: 1369
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 srv_io_r_net_share_enum 
>[2005/02/17 12:16:09, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 srv_io_srv_share_ctr share_ctr
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 info_level: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 switch_value: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 ptr_share_info: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c num_entries: 00000010
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0010 ptr_entries: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0014 num_entries2: 00000010
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000018 srv_io_share_info1 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0018 ptr_netname: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              001c type       : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 ptr_remark : 00000001
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 srv_io_share_info1 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 ptr_netname: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0028 type       : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              002c ptr_remark : 00000001
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000030 srv_io_share_info1 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0030 ptr_netname: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0034 type       : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0038 ptr_remark : 00000001
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          00003c srv_io_share_info1 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              003c ptr_netname: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0040 type       : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0044 ptr_remark : 00000001
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000048 srv_io_share_info1 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0048 ptr_netname: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              004c type       : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0050 ptr_remark : 00000001
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000054 srv_io_share_info1 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0054 ptr_netname: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0058 type       : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              005c ptr_remark : 00000001
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000060 srv_io_share_info1 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0060 ptr_netname: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0064 type       : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0068 ptr_remark : 00000001
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          00006c srv_io_share_info1 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              006c ptr_netname: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0070 type       : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0074 ptr_remark : 00000001
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000078 srv_io_share_info1 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0078 ptr_netname: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              007c type       : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0080 ptr_remark : 00000001
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000084 srv_io_share_info1 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0084 ptr_netname: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0088 type       : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              008c ptr_remark : 00000001
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000090 srv_io_share_info1 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0090 ptr_netname: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0094 type       : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0098 ptr_remark : 00000001
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          00009c srv_io_share_info1 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              009c ptr_netname: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              00a0 type       : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              00a4 ptr_remark : 00000001
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          0000a8 srv_io_share_info1 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              00a8 ptr_netname: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              00ac type       : 00000000
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              00b0 ptr_remark : 00000001
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          0000b4 srv_io_share_info1 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              00b4 ptr_netname: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              00b8 type       : 00000003
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              00bc ptr_remark : 00000001
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          0000c0 srv_io_share_info1 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              00c0 ptr_netname: 00000001
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              00c4 type       : 00000003
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              00c8 ptr_remark : 00000001
>[2005/02/17 12:16:09, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          0000cc srv_io_share_info1 
>[2005/02/17 12:16:09, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              00cc ptr_netname: 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              00d0 type       : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              00d4 ptr_remark : 00000001
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          0000d8 srv_io_share_info1_str 
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              0000d8 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  00d8 uni_max_len: 00000006
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  00dc offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  00e0 uni_str_len: 00000006
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  00e4 buffer     : u.s.e.r.s...
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              0000f0 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  00f0 uni_max_len: 00000029
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  00f4 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  00f8 uni_str_len: 00000029
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  00fc buffer     : L.i.n.k.s. .t.o. .a.l.l. .t.h.e. .u.s.e.r.'.s. .h.o.m.e. .d.i.r.e.c.t.o.r.i.e.s...
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          00014e srv_io_share_info1_str 
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000150 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0150 uni_max_len: 00000006
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0154 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0158 uni_str_len: 00000006
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  015c buffer     : h.o.s.t.s...
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000168 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0168 uni_max_len: 00000034
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  016c offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0170 uni_str_len: 00000034
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0174 buffer     : L.i.n.k.s. .t.o. .o.t.h.e.r. .f.i.l.e. .s.e.r.v.e.r.s. .i.n. .t.h.e. .s.a.m.e. .N.I.S. .d.o.m.a.i.n.....
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          0001dc srv_io_share_info1_str 
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              0001dc smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  01dc uni_max_len: 00000007
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  01e0 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  01e4 uni_str_len: 00000007
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  01e8 buffer     : p.u.b.l.i.c...
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              0001f8 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  01f8 uni_max_len: 00000026
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  01fc offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0200 uni_str_len: 00000026
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0204 buffer     : H.e.r.e. .a.r.e. .f.i.l.e.s. .f.o.r. .p.u.b.l.i.c. .c.o.n.s.u.m.p.t.i.o.n...
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000250 srv_io_share_info1_str 
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000250 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0250 uni_max_len: 00000008
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0254 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0258 uni_str_len: 00000008
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  025c buffer     : d.o.c.-.g.r.p...
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              00026c smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  026c uni_max_len: 00000024
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0270 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0274 uni_str_len: 00000024
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0278 buffer     : /.c.o.r.p./.d.o.c./.g.r.o.u.p. .-.-. .G.r.o.u.p. .O.n.l.y. .S.h.a.r.e...
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          0002c0 srv_io_share_info1_str 
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              0002c0 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  02c0 uni_max_len: 00000008
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  02c4 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  02c8 uni_str_len: 00000008
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  02cc buffer     : d.o.c.-.p.u.b...
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              0002dc smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  02dc uni_max_len: 0000002c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  02e0 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  02e4 uni_str_len: 0000002c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  02e8 buffer     : /.c.o.r.p./.d.o.c./.p.u.b.l.i.c. .-.-. .P.u.b.l.i.c.l.y. .R.e.a.d.a.b.l.e. .S.h.a.r.e...
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000340 srv_io_share_info1_str 
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000340 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0340 uni_max_len: 00000008
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0344 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0348 uni_str_len: 00000008
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  034c buffer     : d.o.c.-.w.e.b...
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              00035c smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  035c uni_max_len: 0000002a
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0360 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0364 uni_str_len: 0000002a
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0368 buffer     : /.c.o.r.p./.d.o.c./.p.u.b.l.i.c._.h.t.m.l. .-.-. .G.r.o.u.p.'.s. .w.e.b.s.p.a.c.e...
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          0003bc srv_io_share_info1_str 
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              0003bc smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  03bc uni_max_len: 0000000a
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  03c0 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  03c4 uni_str_len: 0000000a
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  03c8 buffer     : h.r.a.d.m.-.g.r.p...
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              0003dc smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  03dc uni_max_len: 00000023
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  03e0 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  03e4 uni_str_len: 00000023
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  03e8 buffer     : /.u./.h.r.a.d.m./.g.r.o.u.p. .-.-. .G.r.o.u.p. .O.n.l.y. .S.h.a.r.e...
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          00042e srv_io_share_info1_str 
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000430 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0430 uni_max_len: 0000000a
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0434 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0438 uni_str_len: 0000000a
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  043c buffer     : h.r.a.d.m.-.p.u.b...
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000450 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0450 uni_max_len: 0000002b
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0454 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0458 uni_str_len: 0000002b
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  045c buffer     : /.u./.h.r.a.d.m./.p.u.b.l.i.c. .-.-. .P.u.b.l.i.c.l.y. .R.e.a.d.a.b.l.e. .S.h.a.r.e...
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          0004b2 srv_io_share_info1_str 
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              0004b4 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  04b4 uni_max_len: 0000000a
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  04b8 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  04bc uni_str_len: 0000000a
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  04c0 buffer     : h.r.a.d.m.-.w.e.b...
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              0004d4 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  04d4 uni_max_len: 00000029
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  04d8 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  04dc uni_str_len: 00000029
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  04e0 buffer     : /.u./.h.r.a.d.m./.p.u.b.l.i.c._.h.t.m.l. .-.-. .G.r.o.u.p.'.s. .w.e.b.s.p.a.c.e...
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000532 srv_io_share_info1_str 
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000534 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0534 uni_max_len: 00000007
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0538 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  053c uni_str_len: 00000007
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0540 buffer     : i.t.-.g.r.p...
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000550 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0550 uni_max_len: 00000023
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0554 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0558 uni_str_len: 00000023
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  055c buffer     : /.c.o.r.p./.i.t./.g.r.o.u.p. .-.-. .G.r.o.u.p. .O.n.l.y. .S.h.a.r.e...
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          0005a2 srv_io_share_info1_str 
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              0005a4 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  05a4 uni_max_len: 00000007
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  05a8 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  05ac uni_str_len: 00000007
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  05b0 buffer     : i.t.-.p.u.b...
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              0005c0 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  05c0 uni_max_len: 0000002b
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  05c4 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  05c8 uni_str_len: 0000002b
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  05cc buffer     : /.c.o.r.p./.i.t./.p.u.b.l.i.c. .-.-. .P.u.b.l.i.c.l.y. .R.e.a.d.a.b.l.e. .S.h.a.r.e...
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000622 srv_io_share_info1_str 
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000624 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0624 uni_max_len: 0000000a
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0628 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  062c uni_str_len: 0000000a
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0630 buffer     : O.r.a.c.l.e.I.m.p...
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000644 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0644 uni_max_len: 0000001f
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0648 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  064c uni_str_len: 0000001f
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0650 buffer     : E.S. .G.r.o.u.p. .O.r.a.c.l.e. .I.m.p.l.e.m.e.n.t.a.t.i.o.n...
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          00068e srv_io_share_info1_str 
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000690 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0690 uni_max_len: 00000008
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0694 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0698 uni_str_len: 00000008
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  069c buffer     : Q.-.T.r.a.i.n...
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              0006ac smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  06ac uni_max_len: 00000010
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  06b0 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  06b4 uni_str_len: 00000010
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  06b8 buffer     : Q.u.a.l.i.t.y. .T.r.a.i.n.e.r...
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          0006d8 srv_io_share_info1_str 
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              0006d8 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  06d8 uni_max_len: 00000005
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  06dc offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  06e0 uni_str_len: 00000005
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  06e4 buffer     : I.P.C.$...
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              0006f0 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  06f0 uni_max_len: 0000002e
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  06f4 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  06f8 uni_str_len: 0000002e
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  06fc buffer     : I.P.C. .S.e.r.v.i.c.e. .(.C.a.r.p. .-.-. .a. .t.e.s.t. .i.n.s.t.a.n.c.e. .o.f. .C.o.r.p.)...
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000758 srv_io_share_info1_str 
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000758 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0758 uni_max_len: 00000007
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  075c offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0760 uni_str_len: 00000007
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0764 buffer     : A.D.M.I.N.$...
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000774 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0774 uni_max_len: 0000002e
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0778 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  077c uni_str_len: 0000002e
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0780 buffer     : I.P.C. .S.e.r.v.i.c.e. .(.C.a.r.p. .-.-. .a. .t.e.s.t. .i.n.s.t.a.n.c.e. .o.f. .C.o.r.p.)...
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          0007dc srv_io_share_info1_str 
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              0007dc smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  07dc uni_max_len: 00000004
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  07e0 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  07e4 uni_str_len: 00000004
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  07e8 buffer     : g.a.a...
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              0007f0 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  07f0 uni_max_len: 00000017
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  07f4 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  07f8 uni_str_len: 00000017
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  07fc buffer     : M.y. .C.o.r.p.o.r.a.t.e. .D.i.r.e.c.t.o.r.y...
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      082c total_entries: 00000010
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000830 smb_io_enum_hnd enum_hnd
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0830 ptr_hnd: 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0834 status: WERR_OK
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called srvsvc successfully
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 2248
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 68
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7437 name: srvsvc len: 1024
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 2104.
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0850
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000838
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:10, 5] smbd/ipc.c:send_trans_reply(89)
>  send_trans_reply: buffer 1024 too large
>[2005/02/17 12:16:10, 3] smbd/error.c:error_packet(129)
>  error packet at smbd/ipc.c(97) cmd=37 (SMBtrans) STATUS_BUFFER_OVERFLOW
>[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..1024]
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=1080
>  smb_com=0x25
>  smb_rcls=5
>  smb_reh=0
>  smb_err=32768
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=54848
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]= 1024 (0x400)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]= 1024 (0x400)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=1025
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 50 08 00 00 01 00 00  ........ .P......
>  [010] 00 38 08 00 00 00 00 00  00 01 00 00 00 01 00 00  .8...... ........
>  [020] 00 01 00 00 00 10 00 00  00 01 00 00 00 10 00 00  ........ ........
>  [030] 00 01 00 00 00 00 00 00  00 01 00 00 00 01 00 00  ........ ........
>  [040] 00 00 00 00 00 01 00 00  00 01 00 00 00 00 00 00  ........ ........
>  [050] 00 01 00 00 00 01 00 00  00 00 00 00 00 01 00 00  ........ ........
>  [060] 00 01 00 00 00 00 00 00  00 01 00 00 00 01 00 00  ........ ........
>  [070] 00 00 00 00 00 01 00 00  00 01 00 00 00 00 00 00  ........ ........
>  [080] 00 01 00 00 00 01 00 00  00 00 00 00 00 01 00 00  ........ ........
>  [090] 00 01 00 00 00 00 00 00  00 01 00 00 00 01 00 00  ........ ........
>  [0A0] 00 00 00 00 00 01 00 00  00 01 00 00 00 00 00 00  ........ ........
>  [0B0] 00 01 00 00 00 01 00 00  00 00 00 00 00 01 00 00  ........ ........
>  [0C0] 00 01 00 00 00 00 00 00  00 01 00 00 00 01 00 00  ........ ........
>  [0D0] 00 03 00 00 00 01 00 00  00 01 00 00 00 03 00 00  ........ ........
>  [0E0] 00 01 00 00 00 01 00 00  00 00 00 00 00 01 00 00  ........ ........
>  [0F0] 00 06 00 00 00 00 00 00  00 06 00 00 00 75 00 73  ........ .....u.s
>  [100] 00 65 00 72 00 73 00 00  00 29 00 00 00 00 00 00  .e.r.s.. .)......
>  [110] 00 29 00 00 00 4C 00 69  00 6E 00 6B 00 73 00 20  .)...L.i .n.k.s. 
>  [120] 00 74 00 6F 00 20 00 61  00 6C 00 6C 00 20 00 74  .t.o. .a .l.l. .t
>  [130] 00 68 00 65 00 20 00 75  00 73 00 65 00 72 00 27  .h.e. .u .s.e.r.'
>  [140] 00 73 00 20 00 68 00 6F  00 6D 00 65 00 20 00 64  .s. .h.o .m.e. .d
>  [150] 00 69 00 72 00 65 00 63  00 74 00 6F 00 72 00 69  .i.r.e.c .t.o.r.i
>  [160] 00 65 00 73 00 00 00 00  00 06 00 00 00 00 00 00  .e.s.... ........
>  [170] 00 06 00 00 00 68 00 6F  00 73 00 74 00 73 00 00  .....h.o .s.t.s..
>  [180] 00 34 00 00 00 00 00 00  00 34 00 00 00 4C 00 69  .4...... .4...L.i
>  [190] 00 6E 00 6B 00 73 00 20  00 74 00 6F 00 20 00 6F  .n.k.s.  .t.o. .o
>  [1A0] 00 74 00 68 00 65 00 72  00 20 00 66 00 69 00 6C  .t.h.e.r . .f.i.l
>  [1B0] 00 65 00 20 00 73 00 65  00 72 00 76 00 65 00 72  .e. .s.e .r.v.e.r
>  [1C0] 00 73 00 20 00 69 00 6E  00 20 00 74 00 68 00 65  .s. .i.n . .t.h.e
>  [1D0] 00 20 00 73 00 61 00 6D  00 65 00 20 00 4E 00 49  . .s.a.m .e. .N.I
>  [1E0] 00 53 00 20 00 64 00 6F  00 6D 00 61 00 69 00 6E  .S. .d.o .m.a.i.n
>  [1F0] 00 2E 00 00 00 07 00 00  00 00 00 00 00 07 00 00  ........ ........
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,1084)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,1084) wrote 1084
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 59
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x3b
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 67 of length 63
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=59
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=54912
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]=29751 (0x7437)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]= 1104 (0x450)
>  smb_vwv[ 6]= 1104 (0x450)
>  smb_vwv[ 7]=65535 (0xFFFF)
>  smb_vwv[ 8]=65535 (0xFFFF)
>  smb_vwv[ 9]= 1104 (0x450)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=0
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBreadX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7437
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=7437 (pipes_open=1)
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7437 name: srvsvc len: 1104
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: srvsvc: current_pdu_len = 2128, current_pdu_sent = 1024 returning 1104 bytes.
>[2005/02/17 12:16:10, 3] smbd/pipes.c:reply_pipe_read_and_X(242)
>  readX-IPC pnum=7437 min=1104 max=1104 nread=1104
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=1163
>  smb_com=0x2e
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=54912
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]= 1104 (0x450)
>  smb_vwv[ 6]=   59 (0x3B)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_bcc=1104
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 2F 00 75 00 2F 00 68 00  72 00 61 00 64 00 6D 00  /.u./.h. r.a.d.m.
>  [010] 2F 00 67 00 72 00 6F 00  75 00 70 00 20 00 2D 00  /.g.r.o. u.p. .-.
>  [020] 2D 00 20 00 47 00 72 00  6F 00 75 00 70 00 20 00  -. .G.r. o.u.p. .
>  [030] 4F 00 6E 00 6C 00 79 00  20 00 53 00 68 00 61 00  O.n.l.y.  .S.h.a.
>  [040] 72 00 65 00 00 00 00 00  0A 00 00 00 00 00 00 00  r.e..... ........
>  [050] 0A 00 00 00 68 00 72 00  61 00 64 00 6D 00 2D 00  ....h.r. a.d.m.-.
>  [060] 70 00 75 00 62 00 00 00  2B 00 00 00 00 00 00 00  p.u.b... +.......
>  [070] 2B 00 00 00 2F 00 75 00  2F 00 68 00 72 00 61 00  +.../.u. /.h.r.a.
>  [080] 64 00 6D 00 2F 00 70 00  75 00 62 00 6C 00 69 00  d.m./.p. u.b.l.i.
>  [090] 63 00 20 00 2D 00 2D 00  20 00 50 00 75 00 62 00  c. .-.-.  .P.u.b.
>  [0A0] 6C 00 69 00 63 00 6C 00  79 00 20 00 52 00 65 00  l.i.c.l. y. .R.e.
>  [0B0] 61 00 64 00 61 00 62 00  6C 00 65 00 20 00 53 00  a.d.a.b. l.e. .S.
>  [0C0] 68 00 61 00 72 00 65 00  00 00 00 00 0A 00 00 00  h.a.r.e. ........
>  [0D0] 00 00 00 00 0A 00 00 00  68 00 72 00 61 00 64 00  ........ h.r.a.d.
>  [0E0] 6D 00 2D 00 77 00 65 00  62 00 00 00 29 00 00 00  m.-.w.e. b...)...
>  [0F0] 00 00 00 00 29 00 00 00  2F 00 75 00 2F 00 68 00  ....)... /.u./.h.
>  [100] 72 00 61 00 64 00 6D 00  2F 00 70 00 75 00 62 00  r.a.d.m. /.p.u.b.
>  [110] 6C 00 69 00 63 00 5F 00  68 00 74 00 6D 00 6C 00  l.i.c._. h.t.m.l.
>  [120] 20 00 2D 00 2D 00 20 00  47 00 72 00 6F 00 75 00   .-.-. . G.r.o.u.
>  [130] 70 00 27 00 73 00 20 00  77 00 65 00 62 00 73 00  p.'.s. . w.e.b.s.
>  [140] 70 00 61 00 63 00 65 00  00 00 00 00 07 00 00 00  p.a.c.e. ........
>  [150] 00 00 00 00 07 00 00 00  69 00 74 00 2D 00 67 00  ........ i.t.-.g.
>  [160] 72 00 70 00 00 00 00 00  23 00 00 00 00 00 00 00  r.p..... #.......
>  [170] 23 00 00 00 2F 00 63 00  6F 00 72 00 70 00 2F 00  #.../.c. o.r.p./.
>  [180] 69 00 74 00 2F 00 67 00  72 00 6F 00 75 00 70 00  i.t./.g. r.o.u.p.
>  [190] 20 00 2D 00 2D 00 20 00  47 00 72 00 6F 00 75 00   .-.-. . G.r.o.u.
>  [1A0] 70 00 20 00 4F 00 6E 00  6C 00 79 00 20 00 53 00  p. .O.n. l.y. .S.
>  [1B0] 68 00 61 00 72 00 65 00  00 00 00 00 07 00 00 00  h.a.r.e. ........
>  [1C0] 00 00 00 00 07 00 00 00  69 00 74 00 2D 00 70 00  ........ i.t.-.p.
>  [1D0] 75 00 62 00 00 00 00 00  2B 00 00 00 00 00 00 00  u.b..... +.......
>  [1E0] 2B 00 00 00 2F 00 63 00  6F 00 72 00 70 00 2F 00  +.../.c. o.r.p./.
>  [1F0] 69 00 74 00 2F 00 70 00  75 00 62 00 6C 00 69 00  i.t./.p. u.b.l.i.
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,1167)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,1167) wrote 1167
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 68 of length 45
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=54976
>  smt_wct=3
>  smb_vwv[ 0]=29751 (0x7437)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7437
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=7437 (pipes_open=1)
>[2005/02/17 12:16:10, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:7437
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
>  close_policy_by_pipe: deleted handle list for pipe srvsvc
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name srvsvc pnum=7437 (pipes_open=0)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=54976
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 69 of length 104
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=55040
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  256 (0x100)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 66 5C 00 77 00 6B 00 73  00 73 00 76 00 63 00 00  f\.w.k.s .s.v.c..
>  [010] 00                                                . 
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:10, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \wkssvc.
>[2005/02/17 12:16:10, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe wkssvc opening.
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested wkssvc (pipes_open=0)
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested wkssvc
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe wkssvc
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe wkssvc (pipes_open=0)
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe wkssvc with handle 7438 (pipes_open=1)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name wkssvc pnum=7438
>[2005/02/17 12:16:10, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \wkssvc
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=55040
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=14336 (0x3800)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 102
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x66
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 70 of length 106
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=102
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=528
>  smb_uid=100
>  smb_mid=55105
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 4096 (0x1000)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  768 (0x300)
>  smb_bcc=19
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] A0 5C 00 73 00 70 00 6F  00 6F 00 6C 00 73 00 73  .\.s.p.o .o.l.s.s
>  [010] 00 00 00                                          ... 
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:10, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \spoolss.
>[2005/02/17 12:16:10, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe spoolss opening.
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested spoolss (pipes_open=1)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(205)
>  open_rpc_pipe_p: name wkssvc pnum=7438
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested spoolss
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe spoolss
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe spoolss
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe spoolss (pipes_open=1)
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe spoolss with handle 7439 (pipes_open=2)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name spoolss pnum=7439
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name wkssvc pnum=7438
>[2005/02/17 12:16:10, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \spoolss
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=528
>  smb_uid=100
>  smb_mid=55105
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=14592 (0x3900)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 71 of length 160
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=55168
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29752 (0x7438)
>  smb_bcc=89
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [030] 00 98 D0 FF 6B 12 A1 10  36 98 33 46 C3 F8 7E 34  ....k... 6.3F..~4
>  [040] 5A 01 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  Z.....]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7438
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=7439 (pipes_open=2)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=7438 (pipes_open=2)
>[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 7438)
>[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7438 name: wkssvc open: Yes len: 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 6bffd098
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : a112
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : 3610
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : 98 33 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 46 c3 f8 7e 34 5a 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000001
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\wkssvc
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000d
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\ntsvcs.
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000017 smb_io_rpc_results 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7438 name: wkssvc len: 1024
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=55168
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0D 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6E 74 73 76 63 73 00  00 01 00 00 00 00 00 00  \ntsvcs. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 72 of length 160
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=528
>  smb_uid=100
>  smb_mid=55233
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29753 (0x7439)
>  smb_bcc=89
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [030] 00 78 56 34 12 34 12 CD  AB EF 00 01 23 45 67 89  .xV4.4.. ....#Eg.
>  [040] AB 01 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7439
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=7439 (pipes_open=2)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=7438 (pipes_open=2)
>[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 7439)
>[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2e5878 max_trans_reply: 1024
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7439 name: spoolss open: Yes len: 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\spoolss -> \PIPE\spoolss
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 12345678
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : 1234
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : abcd
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : ef 00 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 01 23 45 67 89 ab 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000001
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\spoolss
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000e
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\spoolss.
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000018 smb_io_rpc_results 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7439 name: spoolss len: 1024
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: spoolss: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=528
>  smb_uid=100
>  smb_mid=55233
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0E 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 73 70 6F 6F 6C 73 73  00 01 00 00 00 00 00 00  \spoolss ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 144
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x90
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 73 of length 148
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=55296
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29752 (0x7438)
>  smb_bcc=77
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 30  .\.P.I.P .E.\...0
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 00  00 1C 8B CF 09 07 00 00  .$...... ........
>  [030] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 63 00 61  ........ .\.\.c.a
>  [040] 00 72 00 70 00 00 00 00  00 64 00 00 00           .r.p.... .d...
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7438
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=7439 (pipes_open=2)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=7438 (pipes_open=2)
>[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 7438)
>[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7438 name: wkssvc open: Yes len: 60
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 60
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 003c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000024
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0000
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\wkssvc
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[0].fn == dc5e4
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_q_query_info 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 ptr_srv_name: 09cf8b1c
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000007
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000007
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.c.a.r.p...
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0020 switch_value: 0064
>[2005/02/17 12:16:10, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66)
>  _wks_query_info: 66
>[2005/02/17 12:16:10, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40)
>  create_wks_info_100: 40
>[2005/02/17 12:16:10, 5] rpc_parse/parse_wks.c:init_wks_info_100(79)
>  Init WKS_INFO_100: 79
>[2005/02/17 12:16:10, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139)
>  init_wks_r_unknown_0: 139
>[2005/02/17 12:16:10, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76)
>  _wks_query_info: 76
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_r_query_info 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0000 switch_value: 0064
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0004 ptr_1       : 00000001
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 wks_io_wks_info_100 inf
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 platform_id : 000001f4
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c ptr_compname: 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0010 ptr_lan_grp : 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0014 ver_major   : 00000004
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0018 ver_minor   : 00000009
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          00001c smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              001c uni_max_len: 00000005
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 uni_str_len: 00000005
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0028 buffer     : C.A.R.P...
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000034 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0034 uni_max_len: 00000008
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0038 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              003c uni_str_len: 00000008
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0040 buffer     : U.L.T.I.C.O.M...
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
>      0050 status      : NT_STATUS_OK
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called wkssvc successfully
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 92
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 44
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7438 name: wkssvc len: 1024
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84.
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 006c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000054
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..108]
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=164
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=55296
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  108 (0x6C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  108 (0x6C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=109
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 6C 00 00 00 01 00 00  ........ .l......
>  [010] 00 54 00 00 00 00 00 00  00 64 00 00 00 01 00 00  .T...... .d......
>  [020] 00 F4 01 00 00 01 00 00  00 01 00 00 00 04 00 00  ........ ........
>  [030] 00 09 00 00 00 05 00 00  00 00 00 00 00 05 00 00  ........ ........
>  [040] 00 43 00 41 00 52 00 50  00 00 00 00 00 08 00 00  .C.A.R.P ........
>  [050] 00 00 00 00 00 08 00 00  00 55 00 4C 00 54 00 49  ........ .U.L.T.I
>  [060] 00 43 00 4F 00 4D 00 00  00 00 00 00 00           .C.O.M.. .....
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,168)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,168) wrote 168
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 268
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x10c
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 74 of length 272
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=268
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=528
>  smb_uid=100
>  smb_mid=55361
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  184 (0xB8)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  184 (0xB8)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29753 (0x7439)
>  smb_bcc=201
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 30  .\.P.I.P .E.\...0
>  [010] 00 05 00 00 03 10 00 00  00 B8 00 00 00 01 00 00  ........ ........
>  [020] 00 A0 00 00 00 00 00 45  00 30 24 EC 00 07 00 00  .......E .0$.....
>  [030] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 63 00 61  ........ .\.\.c.a
>  [040] 00 72 00 70 00 00 00 00  00 00 00 00 00 00 00 00  .r.p.... ........
>  [050] 00 00 00 00 00 00 00 00  00 01 00 00 00 01 00 00  ........ ........
>  [060] 00 A0 F7 86 05 1C 00 00  00 C8 45 EB 00 8C F5 86  ........ ..E.....
>  [070] 05 93 08 00 00 03 00 00  00 00 00 00 00 00 00 00  ........ ........
>  [080] 00 0A 00 00 00 00 00 00  00 0A 00 00 00 5C 00 5C  ........ .....\.\
>  [090] 00 41 00 5A 00 55 00 52  00 49 00 54 00 45 00 00  .A.Z.U.R .I.T.E..
>  [0A0] 00 0E 00 00 00 00 00 00  00 0E 00 00 00 41 00 64  ........ .....A.d
>  [0B0] 00 6D 00 69 00 6E 00 69  00 73 00 74 00 72 00 61  .m.i.n.i .s.t.r.a
>  [0C0] 00 74 00 6F 00 72 00 00  00                       .t.o.r.. .
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=184 params=0 setup=2
>[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7439
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=7439 (pipes_open=2)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=7438 (pipes_open=2)
>[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 7439)
>[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2e5878 max_trans_reply: 1024
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7439 name: spoolss open: Yes len: 184
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 184
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 184
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 184, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 168
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 168
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 00b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 168
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 168, incoming data = 168
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 000000a0
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0045
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0x45 - api_rpcTNP: rpc command: SPOOLSS_OPENPRINTEREX
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[1].fn == e7aac
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_open_printer_ex 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 printername_ptr: 00ec2430
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000007
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000007
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.c.a.r.p...
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 spoolss_io_printer_default 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 datatype_ptr: 00000000
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_unistr2 - NULL datatype
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 spoolss_io_devmode_cont 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 size: 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0028 devmode_ptr: 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          002c access_required: 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0030 user_switch: 00000001
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000034 spool_io_user_level 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 level: 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0038 ptr: 0586f7a0
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          00003c  
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              003c size: 0000001c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0040 client_name_ptr: 00eb45c8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0044 user_name_ptr: 0586f58c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0048 build: 00000893
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              004c major: 00000003
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0050 minor: 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0054 processor: 00000000
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000058 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0058 uni_max_len: 0000000a
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  005c offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0060 uni_str_len: 0000000a
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0064 buffer     : \.\.A.Z.U.R.I.T.E...
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000078 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0078 uni_max_len: 0000000e
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  007c offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0080 uni_str_len: 0000000e
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0084 buffer     : A.d.m.i.n.i.s.t.r.a.t.o.r...
>  checking name: \\carp
>[2005/02/17 12:16:10, 10] rpc_server/srv_spoolss_nt.c:open_printer_hnd(607)
>  open_printer_hnd: name [\\carp]
>[2005/02/17 12:16:10, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142)
>  Opened policy hnd[1] [000] 00 00 00 00 01 00 00 00  00 00 00 00 5A D1 14 42  ........ ....Z..B
>  [010] 71 35 00 00                                       q5.. 
>[2005/02/17 12:16:10, 3] rpc_server/srv_spoolss_nt.c:set_printer_hnd_printertype(469)
>  Setting printer type=\\carp
>  Printer is a print server
>[2005/02/17 12:16:10, 4] rpc_server/srv_spoolss_nt.c:set_printer_hnd_name(505)
>  Setting printer name=\\carp (len=6)
>[2005/02/17 12:16:10, 5] rpc_server/srv_spoolss_nt.c:open_printer_hnd(642)
>  1 printer handles active
>[2005/02/17 12:16:10, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 01 00 00 00  00 00 00 00 5A D1 14 42  ........ ....Z..B
>  [010] 71 35 00 00                                       q5.. 
>[2005/02/17 12:16:10, 4] rpc_server/srv_spoolss_nt.c:_spoolss_open_printer_ex(1734)
>  Setting print server access = SERVER_ACCESS_ENUMERATE
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_open_printer_ex 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_pol_hnd printer handle
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 data1: 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 data2: 01000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 data3: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          000a data4: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000c data5: 5a d1 14 42 71 35 00 00 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0014 status code: WERR_OK
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 62
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 168
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7439 name: spoolss len: 1024
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: spoolss: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24.
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0030
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000018
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..48]
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=528
>  smb_uid=100
>  smb_mid=55361
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 30 00 00 00 01 00 00  ........ .0......
>  [010] 00 18 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........
>  [020] 01 00 00 00 00 5A D1 14  42 71 35 00 00 00 00 00  .....Z.. Bq5.....
>  [030] 00                                                . 
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,108)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,108) wrote 108
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 75 of length 45
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=55424
>  smt_wct=3
>  smb_vwv[ 0]=29752 (0x7438)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7438
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=7439 (pipes_open=2)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=7438 (pipes_open=2)
>[2005/02/17 12:16:10, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:7438
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
>  close_policy_by_pipe: deleted handle list for pipe wkssvc
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name wkssvc pnum=7438 (pipes_open=1)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=55424
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 128
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x80
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 76 of length 132
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=128
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=528
>  smb_uid=100
>  smb_mid=55489
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   44 (0x2C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   44 (0x2C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29753 (0x7439)
>  smb_bcc=61
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 30  .\.P.I.P .E.\...0
>  [010] 00 05 00 00 03 10 00 00  00 2C 00 00 00 02 00 00  ........ .,......
>  [020] 00 14 00 00 00 00 00 1D  00 00 00 00 00 00 00 00  ........ ........
>  [030] 01 00 00 00 00 5A D1 14  42 71 35 00 00           .....Z.. Bq5..
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=44 params=0 setup=2
>[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7439
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=7439 (pipes_open=1)
>[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "spoolss" (pnum 7439)
>[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2e5878 max_trans_reply: 1024
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7439 name: spoolss open: Yes len: 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 28
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 002c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000002
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 28
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 28, incoming data = 28
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000014
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 001d
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\spoolss
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: spoolss op 0x1d - api_rpcTNP: rpc command: SPOOLSS_CLOSEPRINTER
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[3].fn == e7f84
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_q_closeprinter 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_pol_hnd printer handle
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 data1: 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 data2: 01000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 data3: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          000a data4: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000c data5: 5a d1 14 42 71 35 00 00 
>[2005/02/17 12:16:10, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 01 00 00 00  00 00 00 00 5A D1 14 42  ........ ....Z..B
>  [010] 71 35 00 00                                       q5.. 
>[2005/02/17 12:16:10, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 01 00 00 00  00 00 00 00 5A D1 14 42  ........ ....Z..B
>  [010] 71 35 00 00                                       q5.. 
>[2005/02/17 12:16:10, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 01 00 00 00  00 00 00 00 5A D1 14 42  ........ ....Z..B
>  [010] 71 35 00 00                                       q5.. 
>[2005/02/17 12:16:10, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
>  Closed policy
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 spoolss_io_r_closeprinter 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_pol_hnd printer handle
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 data1: 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 data2: 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 data3: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          000a data4: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000c data5: 00 00 00 00 00 00 00 00 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0014 status: WERR_OK
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called spoolss successfully
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 28
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7439 name: spoolss len: 1024
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: spoolss: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24.
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0030
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000002
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000018
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..48]
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=528
>  smb_uid=100
>  smb_mid=55489
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 30 00 00 00 02 00 00  ........ .0......
>  [010] 00 18 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........
>  [020] 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........
>  [030] 00                                                . 
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,108)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,108) wrote 108
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 77 of length 104
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=55552
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 73 00 72 00 76  00 73 00 76 00 63 00 00  .\.s.r.v .s.v.c..
>  [010] 00                                                . 
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:10, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \srvsvc.
>[2005/02/17 12:16:10, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe srvsvc opening.
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested srvsvc (pipes_open=1)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(205)
>  open_rpc_pipe_p: name spoolss pnum=7439
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested srvsvc
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe srvsvc
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe srvsvc (pipes_open=1)
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe srvsvc with handle 743a (pipes_open=2)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name srvsvc pnum=743a
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name spoolss pnum=7439
>[2005/02/17 12:16:10, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \srvsvc
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=55552
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=14848 (0x3A00)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 78 of length 45
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=55617
>  smt_wct=3
>  smb_vwv[ 0]=29753 (0x7439)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7439
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=743a (pipes_open=2)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name spoolss pnum=7439 (pipes_open=2)
>[2005/02/17 12:16:10, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:7439
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
>  close_policy_by_pipe: deleted handle list for pipe spoolss
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name spoolss pnum=7439 (pipes_open=1)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=55617
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 79 of length 160
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=55680
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29754 (0x743A)
>  smb_bcc=89
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 30  .\.P.I.P .E.\...0
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [030] 00 C8 4F 32 4B 70 16 D3  01 12 78 5A 47 BF 6E E1  ..O2Kp.. ..xZG.n.
>  [040] 88 03 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=743a
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=743a (pipes_open=1)
>[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 743a)
>[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 743a name: srvsvc open: Yes len: 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 4b324fc8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : 1670
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : 01d3
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : 12 78 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 5a 47 bf 6e e1 88 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000003
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\srvsvc
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000d
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\ntsvcs.
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000017 smb_io_rpc_results 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 743a name: srvsvc len: 1024
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=55680
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0D 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6E 74 73 76 63 73 00  00 01 00 00 00 00 00 00  \ntsvcs. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 80 of length 104
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=55745
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  256 (0x100)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 77 00 6B 00 73  00 73 00 76 00 63 00 00  .\.w.k.s .s.v.c..
>  [010] 00                                                . 
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:10, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \wkssvc.
>[2005/02/17 12:16:10, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe wkssvc opening.
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested wkssvc (pipes_open=1)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(205)
>  open_rpc_pipe_p: name srvsvc pnum=743a
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested wkssvc
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe wkssvc
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe wkssvc (pipes_open=1)
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe wkssvc with handle 743b (pipes_open=2)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name wkssvc pnum=743b
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name srvsvc pnum=743a
>[2005/02/17 12:16:10, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \wkssvc
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=55745
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=15104 (0x3B00)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 144
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x90
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 81 of length 148
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=55808
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29754 (0x743A)
>  smb_bcc=77
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 30  .\.P.I.P .E.\...0
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 15  00 1C 8B CF 09 07 00 00  .$...... ........
>  [030] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 63 00 61  ........ .\.\.c.a
>  [040] 00 72 00 70 00 00 00 00  00 65 00 00 00           .r.p.... .e...
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=743a
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=743b (pipes_open=2)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=743a (pipes_open=2)
>[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 743a)
>[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 743a name: srvsvc open: Yes len: 60
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 60
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 003c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000024
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0015
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\srvsvc
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[10].fn == e0a54
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 srv_io_q_net_srv_get_info 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 ptr_srv_name  : 09cf8b1c
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000007
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000007
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.c.a.r.p...
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0020 switch_value  : 00000065
>[2005/02/17 12:16:10, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1213)
>  srv_net_srv_get_info: 1213
>[2005/02/17 12:16:10, 5] rpc_parse/parse_srv.c:init_srv_info_101(2736)
>  init_srv_info_101
>[2005/02/17 12:16:10, 5] rpc_parse/parse_srv.c:init_srv_r_net_srv_get_info(2971)
>  init_srv_r_net_srv_get_info
>[2005/02/17 12:16:10, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1258)
>  srv_net_srv_get_info: 1258
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 srv_io_r_net_srv_get_info 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 srv_io_info_ctr ctr
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 switch_value: 00000065
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 ptr_srv_ctr : 00000001
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000008 srv_io_info_101 sv101
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0008 platform_id : 000001f4
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              000c ptr_name    : 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 ver_major   : 00000004
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0014 ver_minor   : 00000009
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0018 srv_type    : 00009a03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              001c ptr_comment : 00000001
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000020 smb_io_unistr2 uni_name    
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0020 uni_max_len: 00000005
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0024 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0028 uni_str_len: 00000005
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  002c buffer     : C.A.R.P...
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000036 smb_io_unistr2 uni_comment 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0038 uni_max_len: 00000020
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  003c offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0040 uni_str_len: 00000020
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0044 buffer     : C.a.r.p. .-.-. .a. .t.e.s.t. .i.n.s.t.a.n.c.e. .o.f. .C.o.r.p...
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0084 status: WERR_OK
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called srvsvc successfully
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 196
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 44
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 743a name: srvsvc len: 1024
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 136.
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 00a0
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000088
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..160]
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=216
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=55808
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  160 (0xA0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  160 (0xA0)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=161
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 A0 00 00 00 01 00 00  ........ ........
>  [010] 00 88 00 00 00 00 00 00  00 65 00 00 00 01 00 00  ........ .e......
>  [020] 00 F4 01 00 00 01 00 00  00 04 00 00 00 09 00 00  ........ ........
>  [030] 00 03 9A 00 00 01 00 00  00 05 00 00 00 00 00 00  ........ ........
>  [040] 00 05 00 00 00 43 00 41  00 52 00 50 00 00 00 00  .....C.A .R.P....
>  [050] 00 20 00 00 00 00 00 00  00 20 00 00 00 43 00 61  . ...... . ...C.a
>  [060] 00 72 00 70 00 20 00 2D  00 2D 00 20 00 61 00 20  .r.p. .- .-. .a. 
>  [070] 00 74 00 65 00 73 00 74  00 20 00 69 00 6E 00 73  .t.e.s.t . .i.n.s
>  [080] 00 74 00 61 00 6E 00 63  00 65 00 20 00 6F 00 66  .t.a.n.c .e. .o.f
>  [090] 00 20 00 43 00 6F 00 72  00 70 00 00 00 00 00 00  . .C.o.r .p......
>  [0A0] 00                                                . 
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,220)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,220) wrote 220
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 82 of length 160
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=55873
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29755 (0x743B)
>  smb_bcc=89
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 30  .\.P.I.P .E.\...0
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [030] 00 98 D0 FF 6B 12 A1 10  36 98 33 46 C3 F8 7E 34  ....k... 6.3F..~4
>  [040] 5A 01 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  Z.....]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=743b
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=743b (pipes_open=2)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=743a (pipes_open=2)
>[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 743b)
>[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2f2be8 max_trans_reply: 1024
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 743b name: wkssvc open: Yes len: 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 6bffd098
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : a112
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : 3610
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : 98 33 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 46 c3 f8 7e 34 5a 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000001
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\wkssvc
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000d
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\ntsvcs.
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000017 smb_io_rpc_results 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 743b name: wkssvc len: 1024
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=55873
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0D 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6E 74 73 76 63 73 00  00 01 00 00 00 00 00 00  \ntsvcs. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 83 of length 45
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=55936
>  smt_wct=3
>  smb_vwv[ 0]=29754 (0x743A)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=743a
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=743b (pipes_open=2)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=743a (pipes_open=2)
>[2005/02/17 12:16:10, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:743a
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
>  close_policy_by_pipe: deleted handle list for pipe srvsvc
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name srvsvc pnum=743a (pipes_open=1)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=55936
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 144
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x90
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 84 of length 148
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=56001
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29755 (0x743B)
>  smb_bcc=77
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 30  .\.P.I.P .E.\...0
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 00  00 40 F6 C3 09 07 00 00  .$...... .@......
>  [030] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 63 00 61  ........ .\.\.c.a
>  [040] 00 72 00 70 00 00 00 00  00 64 00 00 00           .r.p.... .d...
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=743b
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=743b (pipes_open=1)
>[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 743b)
>[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2f2be8 max_trans_reply: 1024
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 743b name: wkssvc open: Yes len: 60
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 60
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 003c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000024
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0000
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\wkssvc
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[0].fn == dc5e4
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_q_query_info 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 ptr_srv_name: 09c3f640
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000007
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000007
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.c.a.r.p...
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0020 switch_value: 0064
>[2005/02/17 12:16:10, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66)
>  _wks_query_info: 66
>[2005/02/17 12:16:10, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40)
>  create_wks_info_100: 40
>[2005/02/17 12:16:10, 5] rpc_parse/parse_wks.c:init_wks_info_100(79)
>  Init WKS_INFO_100: 79
>[2005/02/17 12:16:10, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139)
>  init_wks_r_unknown_0: 139
>[2005/02/17 12:16:10, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76)
>  _wks_query_info: 76
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_r_query_info 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0000 switch_value: 0064
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0004 ptr_1       : 00000001
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 wks_io_wks_info_100 inf
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 platform_id : 000001f4
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c ptr_compname: 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0010 ptr_lan_grp : 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0014 ver_major   : 00000004
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0018 ver_minor   : 00000009
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          00001c smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              001c uni_max_len: 00000005
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 uni_str_len: 00000005
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0028 buffer     : C.A.R.P...
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000034 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0034 uni_max_len: 00000008
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0038 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              003c uni_str_len: 00000008
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0040 buffer     : U.L.T.I.C.O.M...
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
>      0050 status      : NT_STATUS_OK
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called wkssvc successfully
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 92
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 44
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 743b name: wkssvc len: 1024
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84.
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 006c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000054
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..108]
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=164
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=56001
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  108 (0x6C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  108 (0x6C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=109
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 6C 00 00 00 01 00 00  ........ .l......
>  [010] 00 54 00 00 00 00 00 00  00 64 00 00 00 01 00 00  .T...... .d......
>  [020] 00 F4 01 00 00 01 00 00  00 01 00 00 00 04 00 00  ........ ........
>  [030] 00 09 00 00 00 05 00 00  00 00 00 00 00 05 00 00  ........ ........
>  [040] 00 43 00 41 00 52 00 50  00 00 00 00 00 08 00 00  .C.A.R.P ........
>  [050] 00 00 00 00 00 08 00 00  00 55 00 4C 00 54 00 49  ........ .U.L.T.I
>  [060] 00 43 00 4F 00 4D 00 00  00 00 00 00 00           .C.O.M.. .....
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,168)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,168) wrote 168
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 85 of length 104
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=56064
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  256 (0x100)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 77 00 6B 00 73  00 73 00 76 00 63 00 00  .\.w.k.s .s.v.c..
>  [010] 00                                                . 
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:10, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \wkssvc.
>[2005/02/17 12:16:10, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe wkssvc opening.
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested wkssvc (pipes_open=1)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(205)
>  open_rpc_pipe_p: name wkssvc pnum=743b
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested wkssvc
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 2 for pipe wkssvc
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe wkssvc (pipes_open=1)
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe wkssvc with handle 743c (pipes_open=2)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name wkssvc pnum=743c
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name wkssvc pnum=743b
>[2005/02/17 12:16:10, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \wkssvc
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=56064
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=15360 (0x3C00)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 86 of length 104
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=56129
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 73 00 72 00 76  00 73 00 76 00 63 00 00  .\.s.r.v .s.v.c..
>  [010] 00                                                . 
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:10, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \srvsvc.
>[2005/02/17 12:16:10, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe srvsvc opening.
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested srvsvc (pipes_open=2)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(205)
>  open_rpc_pipe_p: name wkssvc pnum=743c
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(205)
>  open_rpc_pipe_p: name wkssvc pnum=743b
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested srvsvc
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe srvsvc
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe srvsvc (pipes_open=2)
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe srvsvc with handle 743d (pipes_open=3)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name srvsvc pnum=743d
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name wkssvc pnum=743c
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name wkssvc pnum=743b
>[2005/02/17 12:16:10, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \srvsvc
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=56129
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=15616 (0x3D00)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 87 of length 160
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=56192
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29756 (0x743C)
>  smb_bcc=89
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 30  .\.P.I.P .E.\...0
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 02 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 F0 53 00  00 01 00 00 00 00 00 01  ......S. ........
>  [030] 00 98 D0 FF 6B 12 A1 10  36 98 33 46 C3 F8 7E 34  ....k... 6.3F..~4
>  [040] 5A 01 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  Z.....]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=743c
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=743d (pipes_open=3)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=743c (pipes_open=3)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=743b (pipes_open=3)
>[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 743c)
>[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 743c name: wkssvc open: Yes len: 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000002
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 6bffd098
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : a112
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : 3610
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : 98 33 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 46 c3 f8 7e 34 5a 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000001
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\wkssvc
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000d
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\ntsvcs.
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000017 smb_io_rpc_results 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000002
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 743c name: wkssvc len: 1024
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=56192
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 02 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0D 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6E 74 73 76 63 73 00  00 01 00 00 00 00 00 00  \ntsvcs. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 88 of length 160
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=56257
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29757 (0x743D)
>  smb_bcc=89
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 30  .\.P.I.P .E.\...0
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [030] 00 C8 4F 32 4B 70 16 D3  01 12 78 5A 47 BF 6E E1  ..O2Kp.. ..xZG.n.
>  [040] 88 03 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=743d
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=743d (pipes_open=3)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=743c (pipes_open=3)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=743b (pipes_open=3)
>[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 743d)
>[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2e5878 max_trans_reply: 1024
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 743d name: srvsvc open: Yes len: 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 4b324fc8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : 1670
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : 01d3
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : 12 78 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 5a 47 bf 6e e1 88 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000003
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\srvsvc
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000d
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\ntsvcs.
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000017 smb_io_rpc_results 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 743d name: srvsvc len: 1024
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=56257
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0D 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6E 74 73 76 63 73 00  00 01 00 00 00 00 00 00  \ntsvcs. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 144
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x90
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 89 of length 148
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=56320
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29756 (0x743C)
>  smb_bcc=77
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 30  .\.P.I.P .E.\...0
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 02 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 00  00 20 8B CF 09 07 00 00  .$...... . ......
>  [030] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 63 00 61  ........ .\.\.c.a
>  [040] 00 72 00 70 00 00 00 00  00 64 00 00 00           .r.p.... .d...
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=743c
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=743d (pipes_open=3)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=743c (pipes_open=3)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=743b (pipes_open=3)
>[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 743c)
>[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 743c name: wkssvc open: Yes len: 60
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 60
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 003c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000002
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000024
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0000
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\wkssvc
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[0].fn == dc5e4
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_q_query_info 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 ptr_srv_name: 09cf8b20
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000007
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000007
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.c.a.r.p...
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0020 switch_value: 0064
>[2005/02/17 12:16:10, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66)
>  _wks_query_info: 66
>[2005/02/17 12:16:10, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40)
>  create_wks_info_100: 40
>[2005/02/17 12:16:10, 5] rpc_parse/parse_wks.c:init_wks_info_100(79)
>  Init WKS_INFO_100: 79
>[2005/02/17 12:16:10, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139)
>  init_wks_r_unknown_0: 139
>[2005/02/17 12:16:10, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76)
>  _wks_query_info: 76
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_r_query_info 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0000 switch_value: 0064
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0004 ptr_1       : 00000001
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 wks_io_wks_info_100 inf
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 platform_id : 000001f4
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c ptr_compname: 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0010 ptr_lan_grp : 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0014 ver_major   : 00000004
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0018 ver_minor   : 00000009
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          00001c smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              001c uni_max_len: 00000005
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 uni_str_len: 00000005
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0028 buffer     : C.A.R.P...
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000034 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0034 uni_max_len: 00000008
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0038 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              003c uni_str_len: 00000008
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0040 buffer     : U.L.T.I.C.O.M...
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
>      0050 status      : NT_STATUS_OK
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called wkssvc successfully
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 92
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 44
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 743c name: wkssvc len: 1024
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84.
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 006c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000002
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000054
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..108]
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=164
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=56320
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  108 (0x6C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  108 (0x6C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=109
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 6C 00 00 00 02 00 00  ........ .l......
>  [010] 00 54 00 00 00 00 00 00  00 64 00 00 00 01 00 00  .T...... .d......
>  [020] 00 F4 01 00 00 01 00 00  00 01 00 00 00 04 00 00  ........ ........
>  [030] 00 09 00 00 00 05 00 00  00 00 00 00 00 05 00 00  ........ ........
>  [040] 00 43 00 41 00 52 00 50  00 00 00 00 00 08 00 00  .C.A.R.P ........
>  [050] 00 00 00 00 00 08 00 00  00 55 00 4C 00 54 00 49  ........ .U.L.T.I
>  [060] 00 43 00 4F 00 4D 00 00  00 00 00 00 00           .C.O.M.. .....
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,168)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,168) wrote 168
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 144
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x90
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 90 of length 148
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=56385
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29757 (0x743D)
>  smb_bcc=77
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 30  .\.P.I.P .E.\...0
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 15  00 40 F6 C3 09 07 00 00  .$...... .@......
>  [030] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 63 00 61  ........ .\.\.c.a
>  [040] 00 72 00 70 00 00 00 00  00 65 00 00 00           .r.p.... .e...
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=743d
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=743d (pipes_open=3)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=743c (pipes_open=3)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=743b (pipes_open=3)
>[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 743d)
>[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2e5878 max_trans_reply: 1024
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 743d name: srvsvc open: Yes len: 60
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 60
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 003c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000024
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0015
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\srvsvc
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[10].fn == e0a54
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 srv_io_q_net_srv_get_info 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 ptr_srv_name  : 09c3f640
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000007
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000007
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.c.a.r.p...
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0020 switch_value  : 00000065
>[2005/02/17 12:16:10, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1213)
>  srv_net_srv_get_info: 1213
>[2005/02/17 12:16:10, 5] rpc_parse/parse_srv.c:init_srv_info_101(2736)
>  init_srv_info_101
>[2005/02/17 12:16:10, 5] rpc_parse/parse_srv.c:init_srv_r_net_srv_get_info(2971)
>  init_srv_r_net_srv_get_info
>[2005/02/17 12:16:10, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1258)
>  srv_net_srv_get_info: 1258
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 srv_io_r_net_srv_get_info 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 srv_io_info_ctr ctr
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 switch_value: 00000065
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 ptr_srv_ctr : 00000001
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000008 srv_io_info_101 sv101
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0008 platform_id : 000001f4
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              000c ptr_name    : 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 ver_major   : 00000004
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0014 ver_minor   : 00000009
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0018 srv_type    : 00009a03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              001c ptr_comment : 00000001
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000020 smb_io_unistr2 uni_name    
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0020 uni_max_len: 00000005
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0024 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0028 uni_str_len: 00000005
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  002c buffer     : C.A.R.P...
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000036 smb_io_unistr2 uni_comment 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0038 uni_max_len: 00000020
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  003c offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0040 uni_str_len: 00000020
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0044 buffer     : C.a.r.p. .-.-. .a. .t.e.s.t. .i.n.s.t.a.n.c.e. .o.f. .C.o.r.p...
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0084 status: WERR_OK
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called srvsvc successfully
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 196
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 44
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 743d name: srvsvc len: 1024
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 136.
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 00a0
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000088
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..160]
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=216
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=56385
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  160 (0xA0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  160 (0xA0)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=161
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 A0 00 00 00 01 00 00  ........ ........
>  [010] 00 88 00 00 00 00 00 00  00 65 00 00 00 01 00 00  ........ .e......
>  [020] 00 F4 01 00 00 01 00 00  00 04 00 00 00 09 00 00  ........ ........
>  [030] 00 03 9A 00 00 01 00 00  00 05 00 00 00 00 00 00  ........ ........
>  [040] 00 05 00 00 00 43 00 41  00 52 00 50 00 00 00 00  .....C.A .R.P....
>  [050] 00 20 00 00 00 00 00 00  00 20 00 00 00 43 00 61  . ...... . ...C.a
>  [060] 00 72 00 70 00 20 00 2D  00 2D 00 20 00 61 00 20  .r.p. .- .-. .a. 
>  [070] 00 74 00 65 00 73 00 74  00 20 00 69 00 6E 00 73  .t.e.s.t . .i.n.s
>  [080] 00 74 00 61 00 6E 00 63  00 65 00 20 00 6F 00 66  .t.a.n.c .e. .o.f
>  [090] 00 20 00 43 00 6F 00 72  00 70 00 00 00 00 00 00  . .C.o.r .p......
>  [0A0] 00                                                . 
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,220)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,220) wrote 220
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 91 of length 45
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=56448
>  smt_wct=3
>  smb_vwv[ 0]=29755 (0x743B)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=743b
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=743d (pipes_open=3)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=743c (pipes_open=3)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=743b (pipes_open=3)
>[2005/02/17 12:16:10, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:743b
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name wkssvc pnum=743b (pipes_open=2)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=56448
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 92 of length 45
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=56513
>  smt_wct=3
>  smb_vwv[ 0]=29757 (0x743D)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=743d
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=743d (pipes_open=2)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=743c (pipes_open=2)
>[2005/02/17 12:16:10, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:743d
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
>  close_policy_by_pipe: deleted handle list for pipe srvsvc
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name srvsvc pnum=743d (pipes_open=1)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=56513
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 93 of length 45
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=56576
>  smt_wct=3
>  smb_vwv[ 0]=29756 (0x743C)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=743c
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=743c (pipes_open=1)
>[2005/02/17 12:16:10, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:743c
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
>  close_policy_by_pipe: deleted handle list for pipe wkssvc
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name wkssvc pnum=743c (pipes_open=0)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=56576
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 94 of length 104
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=56640
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  256 (0x100)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 77 00 6B 00 73  00 73 00 76 00 63 00 00  .\.w.k.s .s.v.c..
>  [010] 00                                                . 
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:10, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \wkssvc.
>[2005/02/17 12:16:10, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe wkssvc opening.
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested wkssvc (pipes_open=0)
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested wkssvc
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe wkssvc
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe wkssvc
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe wkssvc (pipes_open=0)
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe wkssvc with handle 743e (pipes_open=1)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name wkssvc pnum=743e
>[2005/02/17 12:16:10, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \wkssvc
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=56640
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=15872 (0x3E00)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 95 of length 160
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=56704
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29758 (0x743E)
>  smb_bcc=89
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [030] 00 98 D0 FF 6B 12 A1 10  36 98 33 46 C3 F8 7E 34  ....k... 6.3F..~4
>  [040] 5A 01 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  Z.....]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=743e
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=743e (pipes_open=1)
>[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 743e)
>[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 743e name: wkssvc open: Yes len: 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\wkssvc -> \PIPE\ntsvcs
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 6bffd098
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : a112
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : 3610
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : 98 33 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 46 c3 f8 7e 34 5a 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000001
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\wkssvc
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000d
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\ntsvcs.
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000017 smb_io_rpc_results 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 743e name: wkssvc len: 1024
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: wkssvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=56704
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0D 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6E 74 73 76 63 73 00  00 01 00 00 00 00 00 00  \ntsvcs. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 144
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x90
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 96 of length 148
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=56768
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29758 (0x743E)
>  smb_bcc=77
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 00  00 40 F6 C3 09 07 00 00  .$...... .@......
>  [030] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 63 00 61  ........ .\.\.c.a
>  [040] 00 72 00 70 00 00 00 00  00 64 00 00 00           .r.p.... .d...
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=743e
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=743e (pipes_open=1)
>[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "wkssvc" (pnum 743e)
>[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 743e name: wkssvc open: Yes len: 60
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 60
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 003c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000024
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0000
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\wkssvc
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: wkssvc op 0x0 - api_rpcTNP: rpc command: WKS_Q_QUERY_INFO
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[0].fn == dc5e4
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_q_query_info 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 ptr_srv_name: 09c3f640
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000007
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000007
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.c.a.r.p...
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0020 switch_value: 0064
>[2005/02/17 12:16:10, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(66)
>  _wks_query_info: 66
>[2005/02/17 12:16:10, 5] rpc_server/srv_wkssvc_nt.c:create_wks_info_100(40)
>  create_wks_info_100: 40
>[2005/02/17 12:16:10, 5] rpc_parse/parse_wks.c:init_wks_info_100(79)
>  Init WKS_INFO_100: 79
>[2005/02/17 12:16:10, 5] rpc_parse/parse_wks.c:init_wks_r_query_info(139)
>  init_wks_r_unknown_0: 139
>[2005/02/17 12:16:10, 5] rpc_server/srv_wkssvc_nt.c:_wks_query_info(76)
>  _wks_query_info: 76
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 wks_io_r_query_info 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0000 switch_value: 0064
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0004 ptr_1       : 00000001
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 wks_io_wks_info_100 inf
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 platform_id : 000001f4
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c ptr_compname: 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0010 ptr_lan_grp : 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0014 ver_major   : 00000004
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0018 ver_minor   : 00000009
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          00001c smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              001c uni_max_len: 00000005
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 uni_str_len: 00000005
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0028 buffer     : C.A.R.P...
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000034 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0034 uni_max_len: 00000008
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0038 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              003c uni_str_len: 00000008
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>              0040 buffer     : U.L.T.I.C.O.M...
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_ntstatus(672)
>      0050 status      : NT_STATUS_OK
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called wkssvc successfully
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 92
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 44
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 743e name: wkssvc len: 1024
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: wkssvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 84.
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 006c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000054
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..108]
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=164
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=56768
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  108 (0x6C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  108 (0x6C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=109
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 6C 00 00 00 01 00 00  ........ .l......
>  [010] 00 54 00 00 00 00 00 00  00 64 00 00 00 01 00 00  .T...... .d......
>  [020] 00 F4 01 00 00 01 00 00  00 01 00 00 00 04 00 00  ........ ........
>  [030] 00 09 00 00 00 05 00 00  00 00 00 00 00 05 00 00  ........ ........
>  [040] 00 43 00 41 00 52 00 50  00 00 00 00 00 08 00 00  .C.A.R.P ........
>  [050] 00 00 00 00 00 08 00 00  00 55 00 4C 00 54 00 49  ........ .U.L.T.I
>  [060] 00 43 00 4F 00 4D 00 00  00 00 00 00 00           .C.O.M.. .....
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,168)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,168) wrote 168
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 97 of length 45
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=56832
>  smt_wct=3
>  smb_vwv[ 0]=29758 (0x743E)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=743e
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name wkssvc pnum=743e (pipes_open=1)
>[2005/02/17 12:16:10, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:743e
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
>  close_policy_by_pipe: deleted handle list for pipe wkssvc
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name wkssvc pnum=743e (pipes_open=0)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=56832
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 98 of length 104
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=56896
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 73 00 72 00 76  00 73 00 76 00 63 00 00  .\.s.r.v .s.v.c..
>  [010] 00                                                . 
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:10, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \srvsvc.
>[2005/02/17 12:16:10, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe srvsvc opening.
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested srvsvc (pipes_open=0)
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested srvsvc
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe srvsvc
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe srvsvc (pipes_open=0)
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe srvsvc with handle 743f (pipes_open=1)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name srvsvc pnum=743f
>[2005/02/17 12:16:10, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \srvsvc
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=56896
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=16128 (0x3F00)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 99 of length 160
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=56960
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29759 (0x743F)
>  smb_bcc=89
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [030] 00 C8 4F 32 4B 70 16 D3  01 12 78 5A 47 BF 6E E1  ..O2Kp.. ..xZG.n.
>  [040] 88 03 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=743f
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=743f (pipes_open=1)
>[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 743f)
>[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 743f name: srvsvc open: Yes len: 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 4b324fc8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : 1670
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : 01d3
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : 12 78 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 5a 47 bf 6e e1 88 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000003
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\srvsvc
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000d
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\ntsvcs.
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000017 smb_io_rpc_results 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 743f name: srvsvc len: 1024
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=56960
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0D 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6E 74 73 76 63 73 00  00 01 00 00 00 00 00 00  \ntsvcs. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:10, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2005/02/17 12:16:10, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2005/02/17 12:16:10, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2005/02/17 12:16:10, 5] smbd/uid.c:change_to_root_user(296)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 144
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x90
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 100 of length 148
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=57024
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29759 (0x743F)
>  smb_bcc=77
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 00 03 10 00 00  00 3C 00 00 00 01 00 00  ........ .<......
>  [020] 00 24 00 00 00 00 00 15  00 40 F6 C3 09 07 00 00  .$...... .@......
>  [030] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 63 00 61  ........ .\.\.c.a
>  [040] 00 72 00 70 00 00 00 00  00 65 00 00 00           .r.p.... .e...
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (402, 101) - sec_ctx_stack_ndx = 0
>[2005/02/17 12:16:10, 5] auth/auth_util.c:debug_nt_user_token(491)
>  NT user token of user S-1-5-21-104134243-2275341451-782570472-1804
>  contains 10 SIDs
>  SID[  0]: S-1-5-21-104134243-2275341451-782570472-1804
>  SID[  1]: S-1-5-21-104134243-2275341451-782570472-3205
>  SID[  2]: S-1-1-0
>  SID[  3]: S-1-5-2
>  SID[  4]: S-1-5-11
>  SID[  5]: S-1-5-21-3834718897-2476707436-3842496652-1203
>  SID[  6]: S-1-5-21-3834718897-2476707436-3842496652-1021
>  SID[  7]: S-1-5-21-3834718897-2476707436-3842496652-1227
>  SID[  8]: S-1-5-21-3834718897-2476707436-3842496652-3205
>  SID[  9]: S-1-5-21-3834718897-2476707436-3842496652-3277
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2005/02/17 12:16:10, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 402
>  Primary group is 101 and contains 5 supplementary groups
>  Group[  0]: 101
>  Group[  1]: 10
>  Group[  2]: 113
>  Group[  3]: 1102
>  Group[  4]: 1138
>[2005/02/17 12:16:10, 5] smbd/uid.c:change_to_user(281)
>  change_to_user uid=(0,402) gid=(0,101)
>[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=743f
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=743f (pipes_open=1)
>[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 743f)
>[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 743f name: srvsvc open: Yes len: 60
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 60
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 003c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 44, incoming data = 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000024
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0015
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\srvsvc
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: srvsvc op 0x15 - api_rpcTNP: rpc command: SRV_NET_SRV_GET_INFO
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[10].fn == e0a54
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 srv_io_q_net_srv_get_info 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 ptr_srv_name  : 09c3f640
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000007
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000007
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.c.a.r.p...
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0020 switch_value  : 00000065
>[2005/02/17 12:16:10, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1213)
>  srv_net_srv_get_info: 1213
>[2005/02/17 12:16:10, 5] rpc_parse/parse_srv.c:init_srv_info_101(2736)
>  init_srv_info_101
>[2005/02/17 12:16:10, 5] rpc_parse/parse_srv.c:init_srv_r_net_srv_get_info(2971)
>  init_srv_r_net_srv_get_info
>[2005/02/17 12:16:10, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_srv_get_info(1258)
>  srv_net_srv_get_info: 1258
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 srv_io_r_net_srv_get_info 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 srv_io_info_ctr ctr
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 switch_value: 00000065
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 ptr_srv_ctr : 00000001
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000008 srv_io_info_101 sv101
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0008 platform_id : 000001f4
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              000c ptr_name    : 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 ver_major   : 00000004
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0014 ver_minor   : 00000009
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0018 srv_type    : 00009a03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              001c ptr_comment : 00000001
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000020 smb_io_unistr2 uni_name    
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0020 uni_max_len: 00000005
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0024 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0028 uni_str_len: 00000005
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  002c buffer     : C.A.R.P...
>[2005/02/17 12:16:10, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000036 smb_io_unistr2 uni_comment 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0038 uni_max_len: 00000020
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  003c offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0040 uni_str_len: 00000020
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0044 buffer     : C.a.r.p. .-.-. .a. .t.e.s.t. .i.n.s.t.a.n.c.e. .o.f. .C.o.r.p...
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0084 status: WERR_OK
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called srvsvc successfully
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 196
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 44
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 743f name: srvsvc len: 1024
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 136.
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 00a0
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000088
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..160]
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=216
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=57024
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  160 (0xA0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  160 (0xA0)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=161
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 A0 00 00 00 01 00 00  ........ ........
>  [010] 00 88 00 00 00 00 00 00  00 65 00 00 00 01 00 00  ........ .e......
>  [020] 00 F4 01 00 00 01 00 00  00 04 00 00 00 09 00 00  ........ ........
>  [030] 00 03 9A 00 00 01 00 00  00 05 00 00 00 00 00 00  ........ ........
>  [040] 00 05 00 00 00 43 00 41  00 52 00 50 00 00 00 00  .....C.A .R.P....
>  [050] 00 20 00 00 00 00 00 00  00 20 00 00 00 43 00 61  . ...... . ...C.a
>  [060] 00 72 00 70 00 20 00 2D  00 2D 00 20 00 61 00 20  .r.p. .- .-. .a. 
>  [070] 00 74 00 65 00 73 00 74  00 20 00 69 00 6E 00 73  .t.e.s.t . .i.n.s
>  [080] 00 74 00 61 00 6E 00 63  00 65 00 20 00 6F 00 66  .t.a.n.c .e. .o.f
>  [090] 00 20 00 43 00 6F 00 72  00 70 00 00 00 00 00 00  . .C.o.r .p......
>  [0A0] 00                                                . 
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,220)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,220) wrote 220
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 101 of length 45
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=57088
>  smt_wct=3
>  smb_vwv[ 0]=29759 (0x743F)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=743f
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=743f (pipes_open=1)
>[2005/02/17 12:16:10, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:743f
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
>  close_policy_by_pipe: deleted handle list for pipe srvsvc
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name srvsvc pnum=743f (pipes_open=0)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=57088
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 102 of length 104
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=57152
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  768 (0x300)
>  smb_bcc=17
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 77 00 69 00 6E  00 72 00 65 00 67 00 00  .\.w.i.n .r.e.g..
>  [010] 00                                                . 
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x40 root_dir_fid = 0x0
>[2005/02/17 12:16:10, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \winreg.
>[2005/02/17 12:16:10, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe winreg opening.
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested winreg (pipes_open=0)
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested winreg
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe winreg
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe winreg
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe winreg (pipes_open=0)
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe winreg with handle 7440 (pipes_open=1)
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name winreg pnum=7440
>[2005/02/17 12:16:10, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \winreg
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=57152
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=16384 (0x4000)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 103 of length 160
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=57216
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29760 (0x7440)
>  smb_bcc=89
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [030] 00 01 D0 8C 33 44 22 F1  31 AA AA 90 00 38 00 10  ....3D". 1....8..
>  [040] 03 01 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7440
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name winreg pnum=7440 (pipes_open=1)
>[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "winreg" (pnum 7440)
>[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7440 name: winreg open: Yes len: 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\winreg -> \PIPE\winreg
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 338cd001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : 2244
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : 31f1
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : aa aa 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 90 00 38 00 10 03 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000001
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\winreg
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000d
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\winreg.
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000017 smb_io_rpc_results 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:10, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7440 name: winreg len: 1024
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: winreg: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=57216
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0D 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 77 69 6E 72 65 67 00  00 01 00 00 00 00 00 00  \winreg. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 120
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x78
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 104 of length 124
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=120
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=57280
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   36 (0x24)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   36 (0x24)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29760 (0x7440)
>  smb_bcc=53
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 00 03 10 00 00  00 24 00 00 00 01 00 00  ........ .$......
>  [020] 00 0C 00 00 00 00 00 02  00 D4 F9 C3 09 F8 B6 00  ........ ........
>  [030] 00 00 00 00 02                                    ..... 
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=36 params=0 setup=2
>[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7440
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name winreg pnum=7440 (pipes_open=1)
>[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "winreg" (pnum 7440)
>[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7440 name: winreg open: Yes len: 36
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 36
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 36
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 36, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 20
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 20
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0024
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 20
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 20, incoming data = 20
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 0000000c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0002
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\winreg
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: winreg op 0x2 - api_rpcTNP: rpc command: REG_OPEN_HKLM
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[3].fn == d9dac
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 reg_io_q_open_hklm 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 ptr      : 09c3f9d4
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 unknown_0: b6f8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 unknown_1: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 access_mask: 02000000
>[2005/02/17 12:16:10, 7] rpc_server/srv_reg_nt.c:open_registry_key(92)
>  open_registry_key: name = [NULL][HKLM]
>[2005/02/17 12:16:10, 10] registry/reg_cachehook.c:reghook_cache_find(94)
>  reghook_cache_find: Searching for keyname [/HKLM]
>[2005/02/17 12:16:10, 10] lib/adt_tree.c:sorted_tree_find(387)
>  sorted_tree_find: Enter [/HKLM]
>[2005/02/17 12:16:10, 10] lib/adt_tree.c:sorted_tree_find(459)
>  sorted_tree_find: Exit
>[2005/02/17 12:16:10, 10] registry/reg_db.c:regdb_fetch_reg_keys(245)
>  regdb_fetch_reg_keys: Enter key => [HKLM]
>[2005/02/17 12:16:10, 10] registry/reg_db.c:regdb_fetch_reg_keys(272)
>  regdb_fetch_reg_keys: Exit [1] items
>[2005/02/17 12:16:10, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142)
>  Opened policy hnd[1] [000] 00 00 00 00 02 00 00 00  00 00 00 00 5A D1 14 42  ........ ....Z..B
>  [010] 71 35 00 00                                       q5.. 
>[2005/02/17 12:16:10, 7] rpc_server/srv_reg_nt.c:open_registry_key(164)
>  open_registry_key: exit
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 reg_io_r_open_hklm 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_pol_hnd 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 data1: 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 data2: 02000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 data3: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          000a data4: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000c data5: 5a d1 14 42 71 35 00 00 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0014 status: WERR_OK
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called winreg successfully
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 20
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7440 name: winreg len: 1024
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: winreg: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24.
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0030
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000018
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..48]
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=57280
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 30 00 00 00 01 00 00  ........ .0......
>  [010] 00 18 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........
>  [020] 02 00 00 00 00 5A D1 14  42 71 35 00 00 00 00 00  .....Z.. Bq5.....
>  [030] 00                                                . 
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,108)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,108) wrote 108
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 228
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0xe4
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 105 of length 232
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=228
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=57344
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  144 (0x90)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=  144 (0x90)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29760 (0x7440)
>  smb_bcc=161
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 00 03 10 00 00  00 90 00 00 00 02 00 00  ........ ........
>  [020] 00 78 00 00 00 00 00 0F  00 00 00 00 00 00 00 00  .x...... ........
>  [030] 02 00 00 00 00 5A D1 14  42 71 35 00 00 46 00 46  .....Z.. Bq5..F.F
>  [040] 00 EC 1B C2 6A 23 00 00  00 00 00 00 00 23 00 00  ....j#.. .....#..
>  [050] 00 53 00 4F 00 46 00 54  00 57 00 41 00 52 00 45  .S.O.F.T .W.A.R.E
>  [060] 00 5C 00 4D 00 69 00 63  00 72 00 6F 00 73 00 6F  .\.M.i.c .r.o.s.o
>  [070] 00 66 00 74 00 5C 00 53  00 63 00 68 00 65 00 64  .f.t.\.S .c.h.e.d
>  [080] 00 75 00 6C 00 69 00 6E  00 67 00 41 00 67 00 65  .u.l.i.n .g.A.g.e
>  [090] 00 6E 00 74 00 00 00 00  00 00 00 00 00 3F 00 0F  .n.t.... .....?..
>  [0A0] 00                                                . 
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=144 params=0 setup=2
>[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7440
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name winreg pnum=7440 (pipes_open=1)
>[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "winreg" (pnum 7440)
>[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7440 name: winreg open: Yes len: 144
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 144
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 144
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 144, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 128
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 128
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0090
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000002
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 128
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 128, incoming data = 128
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000078
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 000f
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\winreg
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: winreg op 0xf - api_rpcTNP: rpc command: REG_OPEN_ENTRY
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[1].fn == d9fbc
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 reg_io_q_entry 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_pol_hnd 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 data1: 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 data2: 02000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 data3: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          000a data4: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000c data5: 5a d1 14 42 71 35 00 00 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000014 smb_io_unihdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0014 uni_str_len: 0046
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0016 uni_max_len: 0046
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0018 buffer     : 6ac21bec
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00001c smb_io_unistr2 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          001c uni_max_len: 00000023
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 offset     : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 uni_str_len: 00000023
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0028 buffer     : S.O.F.T.W.A.R.E.\.M.i.c.r.o.s.o.f.t.\.S.c.h.e.d.u.l.i.n.g.A.g.e.n.t...
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0070 unknown_0        : 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0074 access_desired  : 000f003f
>[2005/02/17 12:16:10, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 02 00 00 00  00 00 00 00 5A D1 14 42  ........ ....Z..B
>  [010] 71 35 00 00                                       q5.. 
>[2005/02/17 12:16:10, 5] rpc_server/srv_reg_nt.c:_reg_open_entry(326)
>  reg_open_entry: Enter
>[2005/02/17 12:16:10, 7] rpc_server/srv_reg_nt.c:open_registry_key(92)
>  open_registry_key: name = [HKLM][SOFTWARE\Microsoft\SchedulingAgent]
>[2005/02/17 12:16:10, 10] registry/reg_cachehook.c:reghook_cache_find(94)
>  reghook_cache_find: Searching for keyname [/HKLM/SOFTWARE/Microsoft/SchedulingAgent]
>[2005/02/17 12:16:10, 10] lib/adt_tree.c:sorted_tree_find(387)
>  sorted_tree_find: Enter [/HKLM/SOFTWARE/Microsoft/SchedulingAgent]
>[2005/02/17 12:16:10, 10] lib/adt_tree.c:sorted_tree_find(459)
>  sorted_tree_find: Exit
>[2005/02/17 12:16:10, 10] registry/reg_db.c:regdb_fetch_reg_keys(245)
>  regdb_fetch_reg_keys: Enter key => [HKLM\SOFTWARE\Microsoft\SchedulingAgent]
>[2005/02/17 12:16:10, 5] registry/reg_db.c:regdb_fetch_reg_keys(259)
>  regdb_fetch_reg_keys: tdb lookup failed to locate key [HKLM\SOFTWARE\Microsoft\SchedulingAgent]
>[2005/02/17 12:16:10, 7] rpc_server/srv_reg_nt.c:open_registry_key(164)
>  open_registry_key: exit
>[2005/02/17 12:16:10, 5] rpc_server/srv_reg_nt.c:_reg_open_entry(337)
>  reg_open_entry: Exit
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 reg_io_r_open_entry 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_pol_hnd 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 data1: 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 data2: 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 data3: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          000a data4: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000c data5: 00 00 00 00 00 00 00 00 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0014 status: WERR_BADFILE
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called winreg successfully
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 70
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 128
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7440 name: winreg len: 1024
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: winreg: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24.
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0030
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000002
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000018
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..48]
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=57344
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 30 00 00 00 02 00 00  ........ .0......
>  [010] 00 18 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........
>  [020] 00 00 00 00 00 00 00 00  00 00 00 00 00 02 00 00  ........ ........
>  [030] 00                                                . 
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,108)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,108) wrote 108
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 128
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x80
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 106 of length 132
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=128
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=57408
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   44 (0x2C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   44 (0x2C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29760 (0x7440)
>  smb_bcc=61
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 6C  .\.P.I.P .E.\...l
>  [010] 00 05 00 00 03 10 00 00  00 2C 00 00 00 03 00 00  ........ .,......
>  [020] 00 14 00 00 00 00 00 05  00 00 00 00 00 00 00 00  ........ ........
>  [030] 02 00 00 00 00 5A D1 14  42 71 35 00 00           .....Z.. Bq5..
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=44 params=0 setup=2
>[2005/02/17 12:16:10, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:10, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:10, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7440
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name winreg pnum=7440 (pipes_open=1)
>[2005/02/17 12:16:10, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "winreg" (pnum 7440)
>[2005/02/17 12:16:10, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2ebb78 max_trans_reply: 1024
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7440 name: winreg open: Yes len: 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 28
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 002c
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000003
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 28
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 28, incoming data = 28
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000014
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0005
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\winreg
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: winreg op 0x5 - api_rpcTNP: rpc command: REG_CLOSE
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[0].fn == d9cf8
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 reg_io_q_close 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_pol_hnd 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 data1: 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 data2: 02000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 data3: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          000a data4: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000c data5: 5a d1 14 42 71 35 00 00 
>[2005/02/17 12:16:10, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 02 00 00 00  00 00 00 00 5A D1 14 42  ........ ....Z..B
>  [010] 71 35 00 00                                       q5.. 
>[2005/02/17 12:16:10, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 02 00 00 00  00 00 00 00 5A D1 14 42  ........ ....Z..B
>  [010] 71 35 00 00                                       q5.. 
>[2005/02/17 12:16:10, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
>  Closed policy
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 reg_io_r_close 
>[2005/02/17 12:16:10, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_pol_hnd 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 data1: 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 data2: 00000000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 data3: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          000a data4: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000c data5: 00 00 00 00 00 00 00 00 
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0014 status: WERR_OK
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called winreg successfully
>[2005/02/17 12:16:10, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 28
>[2005/02/17 12:16:10, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7440 name: winreg len: 1024
>[2005/02/17 12:16:10, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: winreg: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24.
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0030
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000003
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000018
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:10, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:10, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..48]
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=57408
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2005/02/17 12:16:10, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 30 00 00 00 03 00 00  ........ .0......
>  [010] 00 18 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........
>  [020] 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........
>  [030] 00                                                . 
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,108)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,108) wrote 108
>[2005/02/17 12:16:10, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:10, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:10, 3] smbd/process.c:process_smb(1091)
>  Transaction 107 of length 45
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=57472
>  smt_wct=3
>  smb_vwv[ 0]=29760 (0x7440)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:10, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:10, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7440
>[2005/02/17 12:16:10, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name winreg pnum=7440 (pipes_open=1)
>[2005/02/17 12:16:10, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:7440
>[2005/02/17 12:16:10, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
>  close_policy_by_pipe: deleted handle list for pipe winreg
>[2005/02/17 12:16:10, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name winreg pnum=7440 (pipes_open=0)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:10, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=57472
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:10, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:17, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 220
>[2005/02/17 12:16:17, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0xdc
>[2005/02/17 12:16:17, 3] smbd/process.c:process_smb(1091)
>  Transaction 108 of length 224
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(474)
>  size=220
>  smb_com=0x73
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=0
>  smb_pid=65279
>  smb_uid=0
>  smb_mid=57536
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=  220 (0xDC)
>  smb_vwv[ 2]=16644 (0x4104)
>  smb_vwv[ 3]=   50 (0x32)
>  smb_vwv[ 4]=    1 (0x1)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=   89 (0x59)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=  212 (0xD4)
>  smb_vwv[11]=32768 (0x8000)
>  smb_bcc=161
>[2005/02/17 12:16:17, 10] lib/util.c:dump_data(1990)
>  [000] 60 57 06 06 2B 06 01 05  05 02 A0 4D 30 4B A0 0E  `W..+... ...M0K..
>  [010] 30 0C 06 0A 2B 06 01 04  01 82 37 02 02 0A A2 39  0...+... ..7....9
>  [020] 04 37 4E 54 4C 4D 53 53  50 00 01 00 00 00 97 B2  .7NTLMSS P.......
>  [030] 08 E2 08 00 08 00 2F 00  00 00 07 00 07 00 28 00  ....../. ......(.
>  [040] 00 00 05 00 93 08 00 00  00 0F 41 5A 55 52 49 54  ........ ..AZURIT
>  [050] 45 4D 54 4C 41 55 52 45  4C 57 00 69 00 6E 00 64  EMTLAURE LW.i.n.d
>  [060] 00 6F 00 77 00 73 00 20  00 32 00 30 00 30 00 30  .o.w.s.  .2.0.0.0
>  [070] 00 20 00 32 00 31 00 39  00 35 00 00 00 57 00 69  . .2.1.9 .5...W.i
>  [080] 00 6E 00 64 00 6F 00 77  00 73 00 20 00 32 00 30  .n.d.o.w .s. .2.0
>  [090] 00 30 00 30 00 20 00 35  00 2E 00 30 00 00 00 00  .0.0. .5 ...0....
>  [0A0] 00                                                . 
>[2005/02/17 12:16:17, 3] smbd/process.c:switch_message(886)
>  switch message SMBsesssetupX (pid 13681) conn 0x0
>[2005/02/17 12:16:17, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2005/02/17 12:16:17, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2005/02/17 12:16:17, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2005/02/17 12:16:17, 5] smbd/uid.c:change_to_root_user(296)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2005/02/17 12:16:17, 3] smbd/sesssetup.c:reply_sesssetup_and_X(655)
>  wct=12 flg2=0xc807
>[2005/02/17 12:16:17, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(535)
>  Doing spnego session setup
>[2005/02/17 12:16:17, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(566)
>  NativeOS=[Windows 2000 2195] NativeLanMan=[Windows 2000 5.0] PrimaryDomain=[]
>[2005/02/17 12:16:17, 3] smbd/sesssetup.c:reply_spnego_negotiate(444)
>  Got OID 1 3 6 1 4 1 311 2 2 10
>[2005/02/17 12:16:17, 3] smbd/sesssetup.c:reply_spnego_negotiate(447)
>  Got secblob of size 55
>[2005/02/17 12:16:17, 5] auth/auth.c:make_auth_context_subsystem(480)
>  Making default auth method list for standalone security=user, encrypt passwords = yes
>[2005/02/17 12:16:17, 5] auth/auth.c:load_auth_module(384)
>  load_auth_module: Attempting to find an auth method to match guest
>[2005/02/17 12:16:17, 5] auth/auth.c:load_auth_module(409)
>  load_auth_module: auth method guest has a valid init
>[2005/02/17 12:16:17, 5] auth/auth.c:load_auth_module(384)
>  load_auth_module: Attempting to find an auth method to match sam
>[2005/02/17 12:16:17, 5] auth/auth.c:load_auth_module(409)
>  load_auth_module: auth method sam has a valid init
>[2005/02/17 12:16:17, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(62)
>  Got NTLMSSP neg_flags=0xe208b297
>    NTLMSSP_NEGOTIATE_UNICODE
>    NTLMSSP_NEGOTIATE_OEM
>    NTLMSSP_REQUEST_TARGET
>    NTLMSSP_NEGOTIATE_SIGN
>    NTLMSSP_NEGOTIATE_LM_KEY
>    NTLMSSP_NEGOTIATE_NTLM
>    NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED
>    NTLMSSP_NEGOTIATE_WORKSTATION_SUPPLIED
>    NTLMSSP_NEGOTIATE_ALWAYS_SIGN
>    NTLMSSP_NEGOTIATE_NTLM2
>    NTLMSSP_NEGOTIATE_128
>    NTLMSSP_NEGOTIATE_KEY_EXCH
>[2005/02/17 12:16:17, 5] auth/auth.c:get_ntlm_challenge(95)
>  auth_get_challenge: module guest did not want to specify a challenge
>[2005/02/17 12:16:17, 5] auth/auth.c:get_ntlm_challenge(95)
>  auth_get_challenge: module sam did not want to specify a challenge
>[2005/02/17 12:16:17, 5] auth/auth.c:get_ntlm_challenge(135)
>  auth_context challenge created by random
>[2005/02/17 12:16:17, 5] auth/auth.c:get_ntlm_challenge(136)
>  challenge is: 
>[2005/02/17 12:16:17, 5] lib/util.c:dump_data(1990)
>  [000] 9E A9 37 3A A5 23 97 72                           ..7:.#.r 
>[2005/02/17 12:16:17, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,276)
>[2005/02/17 12:16:17, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,276) wrote 276
>[2005/02/17 12:16:17, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 242
>[2005/02/17 12:16:17, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0xf2
>[2005/02/17 12:16:17, 3] smbd/process.c:process_smb(1091)
>  Transaction 109 of length 246
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(474)
>  size=242
>  smb_com=0x73
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=0
>  smb_pid=65279
>  smb_uid=0
>  smb_mid=57600
>  smt_wct=12
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=  242 (0xF2)
>  smb_vwv[ 2]=16644 (0x4104)
>  smb_vwv[ 3]=   50 (0x32)
>  smb_vwv[ 4]=    1 (0x1)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=  111 (0x6F)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=  212 (0xD4)
>  smb_vwv[11]=32768 (0x8000)
>  smb_bcc=183
>[2005/02/17 12:16:17, 10] lib/util.c:dump_data(1990)
>  [000] A1 6D 30 6B A2 69 04 67  4E 54 4C 4D 53 53 50 00  .m0k.i.g NTLMSSP.
>  [010] 03 00 00 00 01 00 01 00  56 00 00 00 00 00 00 00  ........ V.......
>  [020] 57 00 00 00 00 00 00 00  48 00 00 00 00 00 00 00  W....... H.......
>  [030] 48 00 00 00 0E 00 0E 00  48 00 00 00 10 00 10 00  H....... H.......
>  [040] 57 00 00 00 15 8A 88 62  05 00 93 08 00 00 00 0F  W......b ........
>  [050] 41 00 5A 00 55 00 52 00  49 00 54 00 45 00 00 2C  A.Z.U.R. I.T.E..,
>  [060] 85 72 B2 18 8C EB 04 66  BD 90 1B 47 6E C0 F0 57  .r.....f ...Gn..W
>  [070] 00 69 00 6E 00 64 00 6F  00 77 00 73 00 20 00 32  .i.n.d.o .w.s. .2
>  [080] 00 30 00 30 00 30 00 20  00 32 00 31 00 39 00 35  .0.0.0.  .2.1.9.5
>  [090] 00 00 00 57 00 69 00 6E  00 64 00 6F 00 77 00 73  ...W.i.n .d.o.w.s
>  [0A0] 00 20 00 32 00 30 00 30  00 30 00 20 00 35 00 2E  . .2.0.0 .0. .5..
>  [0B0] 00 30 00 00 00 00 00                              .0..... 
>[2005/02/17 12:16:17, 3] smbd/process.c:switch_message(886)
>  switch message SMBsesssetupX (pid 13681) conn 0x0
>[2005/02/17 12:16:17, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2005/02/17 12:16:17, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2005/02/17 12:16:17, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2005/02/17 12:16:17, 5] smbd/uid.c:change_to_root_user(296)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2005/02/17 12:16:17, 3] smbd/sesssetup.c:reply_sesssetup_and_X(655)
>  wct=12 flg2=0xc807
>[2005/02/17 12:16:17, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(535)
>  Doing spnego session setup
>[2005/02/17 12:16:17, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(566)
>  NativeOS=[Windows 2000 2195] NativeLanMan=[Windows 2000 5.0] PrimaryDomain=[]
>[2005/02/17 12:16:17, 3] libsmb/ntlmssp.c:ntlmssp_server_auth(615)
>  Got user=[] domain=[] workstation=[AZURITE] len1=1 len2=0
>[2005/02/17 12:16:17, 6] param/loadparm.c:lp_file_list_changed(2698)
>  lp_file_list_changed()
>  file /etc/ulcmit/samba/carp/smb.conf.q-train -> /etc/ulcmit/samba/carp/smb.conf.q-train  last mod_time: Wed May  1 08:38:33 2002
>  
>  file /etc/ulcmit/samba/carp/smb.conf.oracleimp -> /etc/ulcmit/samba/carp/smb.conf.oracleimp  last mod_time: Thu May  2 15:57:49 2002
>  
>  file /etc/ulcmit/samba/carp/auto-config/user-%U -> /etc/ulcmit/samba/carp/auto-config/user-gaa  last mod_time: Thu Feb 17 10:22:09 2005
>  
>  file /etc/ulcmit/samba/carp/smb.conf.shares -> /etc/ulcmit/samba/carp/smb.conf.shares  last mod_time: Thu Feb 17 10:14:42 2005
>  
>  file /etc/ulcmit/samba/carp/smb.conf.ip-%I -> /etc/ulcmit/samba/carp/smb.conf.ip-172.25.32.13  last mod_time: Thu Feb 17 12:12:56 2005
>  
>  file /etc/ulcmit/samba/carp/smb.conf -> /etc/ulcmit/samba/carp/smb.conf  last mod_time: Thu Feb 17 12:13:35 2005
>  
>[2005/02/17 12:16:17, 5] auth/auth_util.c:make_user_info_map(225)
>  make_user_info_map: Mapping user []\[] from workstation [AZURITE]
>[2005/02/17 12:16:17, 5] auth/auth_util.c:make_user_info(133)
>  attempting to make a user_info for  ()
>[2005/02/17 12:16:17, 5] auth/auth_util.c:make_user_info(143)
>  making strings for 's user_info struct
>[2005/02/17 12:16:17, 5] auth/auth_util.c:make_user_info(185)
>  making blobs for 's user_info struct
>[2005/02/17 12:16:17, 10] auth/auth_util.c:make_user_info(201)
>  made an encrypted user_info for  ()
>[2005/02/17 12:16:17, 3] auth/auth.c:check_ntlm_password(219)
>  check_ntlm_password:  Checking password for unmapped user []\[]@[AZURITE] with the new password interface
>[2005/02/17 12:16:17, 3] auth/auth.c:check_ntlm_password(222)
>  check_ntlm_password:  mapped user is: [CARP]\[]@[AZURITE]
>[2005/02/17 12:16:17, 10] auth/auth.c:check_ntlm_password(231)
>  check_ntlm_password: auth_context challenge created by random
>[2005/02/17 12:16:17, 10] auth/auth.c:check_ntlm_password(233)
>  challenge is: 
>[2005/02/17 12:16:17, 5] lib/util.c:dump_data(1990)
>  [000] 9E A9 37 3A A5 23 97 72                           ..7:.#.r 
>[2005/02/17 12:16:17, 10] lib/account_pol.c:account_policy_get(210)
>  account_policy_get: password history:0
>[2005/02/17 12:16:17, 10] passdb/pdb_get_set.c:pdb_set_username(617)
>  pdb_set_username: setting username ftp, was 
>[2005/02/17 12:16:17, 10] passdb/pdb_get_set.c:pdb_set_domain(644)
>  pdb_set_domain: setting domain CARP, was 
>[2005/02/17 12:16:17, 10] passdb/pdb_get_set.c:pdb_set_nt_username(671)
>  pdb_set_nt_username: setting nt username , was 
>[2005/02/17 12:16:17, 10] passdb/pdb_get_set.c:pdb_set_fullname(698)
>  pdb_set_full_name: setting full name ftp, was 
>[2005/02/17 12:16:17, 4] lib/substitute.c:automount_server(335)
>  Home server: carp
>[2005/02/17 12:16:17, 10] passdb/pdb_get_set.c:pdb_set_homedir(806)
>  pdb_set_homedir: setting home dir \\carp\ftp, was 
>[2005/02/17 12:16:17, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(779)
>  pdb_set_dir_drive: setting dir drive , was NULL
>[2005/02/17 12:16:17, 10] passdb/pdb_get_set.c:pdb_set_logon_script(725)
>  pdb_set_logon_script: setting logon script , was 
>[2005/02/17 12:16:17, 4] lib/substitute.c:automount_server(335)
>  Home server: carp
>[2005/02/17 12:16:17, 10] passdb/pdb_get_set.c:pdb_set_profile_path(752)
>  pdb_set_profile_path: setting profile path \\carp\ftp\profile, was 
>[2005/02/17 12:16:17, 10] passdb/pdb_get_set.c:pdb_set_workstations(885)
>  pdb_set_workstations: setting workstations , was 
>[2005/02/17 12:16:17, 10] lib/account_pol.c:account_policy_get(210)
>  account_policy_get: password history:0
>[2005/02/17 12:16:17, 10] passdb/pdb_get_set.c:pdb_set_user_sid(544)
>  pdb_set_user_sid: setting user sid S-1-5-21-3834718897-2476707436-3842496652-501
>[2005/02/17 12:16:17, 10] passdb/pdb_compat.c:pdb_set_user_sid_from_rid(73)
>  pdb_set_user_sid_from_rid:
>  	setting user sid S-1-5-21-3834718897-2476707436-3842496652-501 from rid 501
>[2005/02/17 12:16:17, 10] passdb/pdb_get_set.c:pdb_set_group_sid(580)
>  pdb_set_group_sid: setting group sid S-1-5-21-3834718897-2476707436-3842496652-514
>[2005/02/17 12:16:17, 10] passdb/pdb_compat.c:pdb_set_group_sid_from_rid(100)
>  pdb_set_group_sid_from_rid:
>  	setting group sid S-1-5-21-3834718897-2476707436-3842496652-514 from rid 514
>[2005/02/17 12:16:17, 3] auth/auth.c:check_ntlm_password(268)
>  check_ntlm_password: guest authentication for user [] succeeded
>[2005/02/17 12:16:17, 5] auth/auth.c:check_ntlm_password(305)
>  check_ntlm_password:  guest authentication for user [] -> [] -> [ftp] succeeded
>[2005/02/17 12:16:17, 5] auth/auth_util.c:free_user_info(1348)
>  attempting to free (and zero) a user_info structure
>[2005/02/17 12:16:17, 10] auth/auth_util.c:free_user_info(1351)
>  structure was created for 
>[2005/02/17 12:16:17, 10] auth/auth_ntlmssp.c:auth_ntlmssp_check_password(117)
>  Got NT session key of length 16
>[2005/02/17 12:16:17, 10] auth/auth_ntlmssp.c:auth_ntlmssp_check_password(123)
>  Got LM session key of length 16
>[2005/02/17 12:16:17, 10] libsmb/ntlmssp.c:ntlmssp_server_auth(705)
>  ntlmssp_server_auth: Using unmodified nt session key.
>[2005/02/17 12:16:17, 3] libsmb/ntlmssp_sign.c:ntlmssp_sign_init(319)
>  NTLMSSP Sign/Seal - Initialising with flags:
>[2005/02/17 12:16:17, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(62)
>  Got NTLMSSP neg_flags=0x60088215
>    NTLMSSP_NEGOTIATE_UNICODE
>    NTLMSSP_REQUEST_TARGET
>    NTLMSSP_NEGOTIATE_SIGN
>    NTLMSSP_NEGOTIATE_NTLM
>    NTLMSSP_NEGOTIATE_ALWAYS_SIGN
>    NTLMSSP_NEGOTIATE_NTLM2
>    NTLMSSP_NEGOTIATE_128
>    NTLMSSP_NEGOTIATE_KEY_EXCH
>[2005/02/17 12:16:17, 10] smbd/password.c:register_vuid(158)
>  register_vuid: allocated vuid = 101
>[2005/02/17 12:16:17, 10] lib/util_pw.c:getpwnam_alloc(84)
>  Got ftp from pwnam_cache
>[2005/02/17 12:16:17, 10] smbd/password.c:register_vuid(220)
>  register_vuid: (14,5) ftp  CARP guest=1
>[2005/02/17 12:16:17, 3] smbd/password.c:register_vuid(222)
>  User name: ftp	Real name: ftp
>[2005/02/17 12:16:17, 3] smbd/password.c:register_vuid(241)
>  UNIX uid 14 is UNIX user ftp, and will be vuid 101
>[2005/02/17 12:16:17, 6] param/loadparm.c:lp_file_list_changed(2698)
>  lp_file_list_changed()
>  file /etc/ulcmit/samba/carp/smb.conf.q-train -> /etc/ulcmit/samba/carp/smb.conf.q-train  last mod_time: Wed May  1 08:38:33 2002
>  
>  file /etc/ulcmit/samba/carp/smb.conf.oracleimp -> /etc/ulcmit/samba/carp/smb.conf.oracleimp  last mod_time: Thu May  2 15:57:49 2002
>  
>  file /etc/ulcmit/samba/carp/auto-config/user-%U -> /etc/ulcmit/samba/carp/auto-config/user-  last mod_time: Thu Feb 17 10:22:09 2005
>  
>  file /etc/ulcmit/samba/carp/smb.conf.shares -> /etc/ulcmit/samba/carp/smb.conf.shares  last mod_time: Thu Feb 17 10:14:42 2005
>  
>  file /etc/ulcmit/samba/carp/smb.conf.ip-%I -> /etc/ulcmit/samba/carp/smb.conf.ip-172.25.32.13  last mod_time: Thu Feb 17 12:12:56 2005
>  
>  file /etc/ulcmit/samba/carp/smb.conf -> /etc/ulcmit/samba/carp/smb.conf  last mod_time: Thu Feb 17 12:13:35 2005
>  
>[2005/02/17 12:16:17, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,108)
>[2005/02/17 12:16:17, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,108) wrote 108
>[2005/02/17 12:16:17, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 74
>[2005/02/17 12:16:17, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x4a
>[2005/02/17 12:16:17, 3] smbd/process.c:process_smb(1091)
>  Transaction 110 of length 78
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(474)
>  size=74
>  smb_com=0x75
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=0
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=57664
>  smt_wct=4
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=   74 (0x4A)
>  smb_vwv[ 2]=    8 (0x8)
>  smb_vwv[ 3]=    1 (0x1)
>  smb_bcc=31
>[2005/02/17 12:16:17, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 5C 00 43 00 41  00 52 00 50 00 5C 00 49  .\.\.C.A .R.P.\.I
>  [010] 00 50 00 43 00 24 00 00  00 3F 3F 3F 3F 3F 00     .P.C.$.. .?????.
>[2005/02/17 12:16:17, 3] smbd/process.c:switch_message(886)
>  switch message SMBtconX (pid 13681) conn 0x0
>[2005/02/17 12:16:17, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2005/02/17 12:16:17, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2005/02/17 12:16:17, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2005/02/17 12:16:17, 5] smbd/uid.c:change_to_root_user(296)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2005/02/17 12:16:17, 4] smbd/reply.c:reply_tcon_and_X(407)
>  Client requested device type [?????] for share [IPC$]
>[2005/02/17 12:16:17, 5] smbd/service.c:make_connection(810)
>  making a connection to 'normal' service ipc$
>[2005/02/17 12:16:17, 5] lib/username.c:Get_Pwnam(293)
>  Finding user ftp
>[2005/02/17 12:16:17, 5] lib/username.c:Get_Pwnam_internals(223)
>  Trying _Get_Pwnam(), username as lowercase is ftp
>[2005/02/17 12:16:17, 10] lib/util_pw.c:getpwnam_alloc(84)
>  Got ftp from pwnam_cache
>[2005/02/17 12:16:17, 5] lib/username.c:Get_Pwnam_internals(251)
>  Get_Pwnam_internals did find user [ftp]!
>[2005/02/17 12:16:17, 3] smbd/service.c:make_connection_snum(469)
>  Connect path is '/tmp' for service [IPC$]
>[2005/02/17 12:16:17, 4] rpc_server/srv_srvsvc_nt.c:get_share_security(217)
>  get_share_security: using default secdesc for IPC$
>[2005/02/17 12:16:17, 10] lib/util_seaccess.c:se_map_generic(176)
>  se_map_generic(): mapped mask 0x10000000 to 0x001f01ff
>[2005/02/17 12:16:17, 10] lib/util_seaccess.c:se_access_check(234)
>  se_access_check: requested access 0x00000002, for NT token with 6 entries and first sid S-1-5-21-3834718897-2476707436-3842496652-501.
>[2005/02/17 12:16:17, 3] lib/util_seaccess.c:se_access_check(251)
>[2005/02/17 12:16:17, 3] lib/util_seaccess.c:se_access_check(252)
>  se_access_check: user sid is S-1-5-21-3834718897-2476707436-3842496652-501
>  se_access_check: also S-1-5-21-3834718897-2476707436-3842496652-514
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-32-546
>  se_access_check: also S-1-5-21-3834718897-2476707436-3842496652-1011
>  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2
>[2005/02/17 12:16:17, 5] lib/util_seaccess.c:se_access_check(309)
>  se_access_check: access (2) granted.
>[2005/02/17 12:16:17, 3] smbd/vfs.c:vfs_init_default(206)
>  Initialising default vfs hooks
>[2005/02/17 12:16:17, 5] smbd/connection.c:claim_connection(170)
>  claiming IPC$ 0
>[2005/02/17 12:16:17, 10] smbd/uid.c:is_share_read_only_for_user(99)
>  is_share_read_only_for_user: share IPC$ is read-only for unix user ftp
>[2005/02/17 12:16:17, 4] rpc_server/srv_srvsvc_nt.c:get_share_security(217)
>  get_share_security: using default secdesc for IPC$
>[2005/02/17 12:16:17, 10] lib/util_seaccess.c:se_map_generic(176)
>  se_map_generic(): mapped mask 0x10000000 to 0x001f01ff
>[2005/02/17 12:16:17, 10] lib/util_seaccess.c:se_access_check(234)
>  se_access_check: requested access 0x00000001, for NT token with 6 entries and first sid S-1-5-21-3834718897-2476707436-3842496652-501.
>[2005/02/17 12:16:17, 3] lib/util_seaccess.c:se_access_check(251)
>[2005/02/17 12:16:17, 3] lib/util_seaccess.c:se_access_check(252)
>  se_access_check: user sid is S-1-5-21-3834718897-2476707436-3842496652-501
>  se_access_check: also S-1-5-21-3834718897-2476707436-3842496652-514
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-32-546
>  se_access_check: also S-1-5-21-3834718897-2476707436-3842496652-1011
>  se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 1
>[2005/02/17 12:16:17, 5] lib/util_seaccess.c:se_access_check(309)
>  se_access_check: access (1) granted.
>[2005/02/17 12:16:17, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (14, 5) - sec_ctx_stack_ndx = 0
>[2005/02/17 12:16:17, 5] auth/auth_util.c:debug_nt_user_token(491)
>  NT user token of user S-1-5-21-3834718897-2476707436-3842496652-501
>  contains 6 SIDs
>  SID[  0]: S-1-5-21-3834718897-2476707436-3842496652-501
>  SID[  1]: S-1-5-21-3834718897-2476707436-3842496652-514
>  SID[  2]: S-1-1-0
>  SID[  3]: S-1-5-2
>  SID[  4]: S-1-5-32-546
>  SID[  5]: S-1-5-21-3834718897-2476707436-3842496652-1011
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2005/02/17 12:16:17, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 14
>  Primary group is 5 and contains 1 supplementary groups
>  Group[  0]: 5
>[2005/02/17 12:16:17, 5] smbd/uid.c:change_to_user(281)
>  change_to_user uid=(0,14) gid=(0,5)
>[2005/02/17 12:16:17, 3] smbd/service.c:make_connection_snum(645)
>  azurite (172.25.32.13) connect to service IPC$ initially as user ftp (uid=14, gid=5) (pid 13681)
>[2005/02/17 12:16:17, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2005/02/17 12:16:17, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2005/02/17 12:16:17, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2005/02/17 12:16:17, 5] smbd/uid.c:change_to_root_user(296)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2005/02/17 12:16:17, 3] smbd/reply.c:reply_tcon_and_X(455)
>  tconX service=IPC$ 
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(474)
>  size=48
>  smb_com=0x75
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=2
>  smb_pid=65279
>  smb_uid=101
>  smb_mid=57664
>  smt_wct=3
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    1 (0x1)
>  smb_bcc=7
>[2005/02/17 12:16:17, 10] lib/util.c:dump_data(1990)
>  [000] 49 50 43 00 00 00 00                              IPC.... 
>[2005/02/17 12:16:17, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,52)
>[2005/02/17 12:16:17, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,52) wrote 52
>[2005/02/17 12:16:17, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:17, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:17, 3] smbd/process.c:process_smb(1091)
>  Transaction 111 of length 104
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=57728
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2005/02/17 12:16:17, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 73 00 72 00 76  00 73 00 76 00 63 00 00  .\.s.r.v .s.v.c..
>  [010] 00                                                . 
>[2005/02/17 12:16:17, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:17, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (402, 101) - sec_ctx_stack_ndx = 0
>[2005/02/17 12:16:17, 5] auth/auth_util.c:debug_nt_user_token(491)
>  NT user token of user S-1-5-21-104134243-2275341451-782570472-1804
>  contains 10 SIDs
>  SID[  0]: S-1-5-21-104134243-2275341451-782570472-1804
>  SID[  1]: S-1-5-21-104134243-2275341451-782570472-3205
>  SID[  2]: S-1-1-0
>  SID[  3]: S-1-5-2
>  SID[  4]: S-1-5-11
>  SID[  5]: S-1-5-21-3834718897-2476707436-3842496652-1203
>  SID[  6]: S-1-5-21-3834718897-2476707436-3842496652-1021
>  SID[  7]: S-1-5-21-3834718897-2476707436-3842496652-1227
>  SID[  8]: S-1-5-21-3834718897-2476707436-3842496652-3205
>  SID[  9]: S-1-5-21-3834718897-2476707436-3842496652-3277
>  SE_PRIV  0x0 0x0 0x0 0x0
>[2005/02/17 12:16:17, 5] auth/auth_util.c:debug_unix_user_token(507)
>  UNIX token of user 402
>  Primary group is 101 and contains 5 supplementary groups
>  Group[  0]: 101
>  Group[  1]: 10
>  Group[  2]: 113
>  Group[  3]: 1102
>  Group[  4]: 1138
>[2005/02/17 12:16:17, 5] smbd/uid.c:change_to_user(281)
>  change_to_user uid=(0,402) gid=(0,101)
>[2005/02/17 12:16:17, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:17, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \srvsvc.
>[2005/02/17 12:16:17, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe srvsvc opening.
>[2005/02/17 12:16:17, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested srvsvc (pipes_open=0)
>[2005/02/17 12:16:17, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested srvsvc
>[2005/02/17 12:16:17, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe srvsvc
>[2005/02/17 12:16:17, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc
>[2005/02/17 12:16:17, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe srvsvc (pipes_open=0)
>[2005/02/17 12:16:17, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe srvsvc with handle 7441 (pipes_open=1)
>[2005/02/17 12:16:17, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name srvsvc pnum=7441
>[2005/02/17 12:16:17, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \srvsvc
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(474)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=57728
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=16640 (0x4100)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2005/02/17 12:16:17, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,107)
>[2005/02/17 12:16:17, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,107) wrote 107
>[2005/02/17 12:16:17, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 156
>[2005/02/17 12:16:17, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x9c
>[2005/02/17 12:16:17, 3] smbd/process.c:process_smb(1091)
>  Transaction 112 of length 160
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(474)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=57792
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29761 (0x7441)
>  smb_bcc=89
>[2005/02/17 12:16:17, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 65  .\.P.I.P .E.\...e
>  [010] 00 05 00 0B 03 10 00 00  00 48 00 00 00 01 00 00  ........ .H......
>  [020] 00 B8 10 B8 10 00 00 00  00 01 00 00 00 00 00 01  ........ ........
>  [030] 00 C8 4F 32 4B 70 16 D3  01 12 78 5A 47 BF 6E E1  ..O2Kp.. ..xZG.n.
>  [040] 88 03 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
>  [050] 00 2B 10 48 60 02 00 00  00                       .+.H`... .
>[2005/02/17 12:16:17, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:17, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:17, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2005/02/17 12:16:17, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:17, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:17, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:17, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7441
>[2005/02/17 12:16:17, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=7441 (pipes_open=1)
>[2005/02/17 12:16:17, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 7441)
>[2005/02/17 12:16:17, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2e5878 max_trans_reply: 1024
>[2005/02/17 12:16:17, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7441 name: srvsvc open: Yes len: 72
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0b
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0048
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:17, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 11, flags = 3
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 56
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 56, incoming data = 56
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 11
>[2005/02/17 12:16:17, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(876)
>  api_pipe_bind_req: decode request. 876
>[2005/02/17 12:16:17, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(887)
>  api_pipe_bind_req: \PIPE\srvsvc -> \PIPE\ntsvcs
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_rb 
>[2005/02/17 12:16:17, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 00000000
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0008 num_elements: 00000001
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000c context_id  : 0000
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      000e num_syntaxes: 01
>[2005/02/17 12:16:17, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00000f smb_io_rpc_iface 
>[2005/02/17 12:16:17, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000010 smb_io_uuid uuid
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 data   : 4b324fc8
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0014 data   : 1670
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0016 data   : 01d3
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0018 data   : 12 78 
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              001a data   : 5a 47 bf 6e e1 88 
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 version: 00000003
>[2005/02/17 12:16:17, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000024 smb_io_rpc_iface 
>[2005/02/17 12:16:17, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000024 smb_io_uuid uuid
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0024 data   : 8a885d04
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0028 data   : 1ceb
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              002a data   : 11c9
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002c data   : 9f e8 
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002e data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0034 version: 00000002
>[2005/02/17 12:16:17, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1017)
>  api_pipe_bind_req: make response. 1017
>[2005/02/17 12:16:17, 3] rpc_server/srv_pipe.c:check_bind_req(762)
>  check_bind_req for \PIPE\srvsvc
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_ba 
>[2005/02/17 12:16:17, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 smb_io_rpc_hdr_bba 
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0000 max_tsize: 10b8
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0002 max_rsize: 10b8
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 assoc_gid: 000053f0
>[2005/02/17 12:16:17, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000008 smb_io_rpc_addr_str 
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          0008 len: 000d
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>          000a str: \PIPE\ntsvcs.
>[2005/02/17 12:16:17, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000017 smb_io_rpc_results 
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>          0018 num_results: 01
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001c result     : 0000
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>          001e reason     : 0000
>[2005/02/17 12:16:17, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000020 smb_io_rpc_iface 
>[2005/02/17 12:16:17, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000020 smb_io_uuid uuid
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0020 data   : 8a885d04
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0024 data   : 1ceb
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>              0026 data   : 11c9
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              0028 data   : 9f e8 
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8s(729)
>              002a data   : 08 00 2b 10 48 60 
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0030 version: 00000002
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 0c
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0044
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 56
>[2005/02/17 12:16:17, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7441 name: srvsvc len: 1024
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(968)
>  read_from_pipe: srvsvc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes.
>[2005/02/17 12:16:17, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(474)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=57792
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2005/02/17 12:16:17, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0D 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6E 74 73 76 63 73 00  00 01 00 00 00 00 00 00  \ntsvcs. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2005/02/17 12:16:17, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,128)
>[2005/02/17 12:16:17, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,128) wrote 128
>[2005/02/17 12:16:17, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 172
>[2005/02/17 12:16:17, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0xac
>[2005/02/17 12:16:17, 3] smbd/process.c:process_smb(1091)
>  Transaction 113 of length 176
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(474)
>  size=172
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=57856
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   88 (0x58)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   88 (0x58)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29761 (0x7441)
>  smb_bcc=105
>[2005/02/17 12:16:17, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 65  .\.P.I.P .E.\...e
>  [010] 00 05 00 00 03 10 00 00  00 58 00 00 00 01 00 00  ........ .X......
>  [020] 00 40 00 00 00 00 00 10  00 B0 DF CF 09 07 00 00  .@...... ........
>  [030] 00 00 00 00 00 07 00 00  00 5C 00 5C 00 63 00 61  ........ .\.\.c.a
>  [040] 00 72 00 70 00 00 00 00  00 07 00 00 00 00 00 00  .r.p.... ........
>  [050] 00 07 00 00 00 69 00 74  00 2D 00 67 00 72 00 70  .....i.t .-.g.r.p
>  [060] 00 00 00 00 00 01 00 00  00                       ........ .
>[2005/02/17 12:16:17, 3] smbd/process.c:switch_message(886)
>  switch message SMBtrans (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:17, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:17, 3] smbd/ipc.c:reply_trans(539)
>  trans <\PIPE\> data=88 params=0 setup=2
>[2005/02/17 12:16:17, 5] smbd/ipc.c:reply_trans(560)
>  calling named_pipe
>[2005/02/17 12:16:17, 3] smbd/ipc.c:named_pipe(334)
>  named pipe command on <> name
>[2005/02/17 12:16:17, 5] smbd/ipc.c:api_fd_reply(265)
>  api_fd_reply
>[2005/02/17 12:16:17, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7441
>[2005/02/17 12:16:17, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=7441 (pipes_open=1)
>[2005/02/17 12:16:17, 3] smbd/ipc.c:api_fd_reply(294)
>  Got API command 0x26 on pipe "srvsvc" (pnum 7441)
>[2005/02/17 12:16:17, 10] smbd/ipc.c:api_fd_reply(299)
>  api_fd_reply: p:2e5878 max_trans_reply: 1024
>[2005/02/17 12:16:17, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(852)
>  write_to_pipe: 7441 name: srvsvc open: Yes len: 88
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 88
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 88
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(399)
>  fill_rpc_header: data_to_copy = 88, len_needed_to_complete_hdr = 16, receive_len = 0
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 16
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 72
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr 
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 00
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 0058
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:17, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(486)
>  unmarshall_rpc_header: using little-endian RPC
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(515)
>  unmarshall_rpc_header: type = 0, flags = 3
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 0
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(874)
>  write_to_pipe: data_left = 72
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(777)
>  process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 72, incoming data = 72
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(720)
>  process_complete_pdu: processing packet type 0
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr_req req
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 alloc_hint: 00000040
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0004 context_id: 0000
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0006 opnum     : 0010
>[2005/02/17 12:16:17, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 0
>[2005/02/17 12:16:17, 5] rpc_server/srv_pipe.c:api_pipe_request(1497)
>  Requested \PIPE\srvsvc
>[2005/02/17 12:16:17, 4] rpc_server/srv_pipe.c:api_rpcTNP(1531)
>  api_rpcTNP: srvsvc op 0x10 - api_rpcTNP: rpc command: SRV_NET_SHARE_GET_INFO
>[2005/02/17 12:16:17, 6] rpc_server/srv_pipe.c:api_rpcTNP(1557)
>  api_rpc_cmds[7].fn == e11a0
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 srv_io_q_net_share_get_info 
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0000 ptr_srv_name: 09cfdfb0
>[2005/02/17 12:16:17, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000004 smb_io_unistr2 
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 uni_max_len: 00000007
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0008 offset     : 00000000
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          000c uni_str_len: 00000007
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          0010 buffer     : \.\.c.a.r.p...
>[2005/02/17 12:16:17, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      00001e smb_io_unistr2 
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0020 uni_max_len: 00000007
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0024 offset     : 00000000
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0028 uni_str_len: 00000007
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>          002c buffer     : i.t.-.g.r.p...
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      003c info_level: 00000001
>[2005/02/17 12:16:17, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_share_get_info(1405)
>  _srv_net_share_get_info: 1405
>[2005/02/17 12:16:17, 5] rpc_server/srv_srvsvc_nt.c:init_srv_r_net_share_get_info(752)
>  init_srv_r_net_share_get_info: 752
>[2005/02/17 12:16:17, 5] rpc_parse/parse_srv.c:init_srv_share_info1(142)
>  init_srv_share_info1: it-grp        0 /corp/it/group -- Group Only Share
>[2005/02/17 12:16:17, 5] rpc_parse/parse_srv.c:init_srv_share_info1_str(101)
>  init_srv_share_info1_str
>[2005/02/17 12:16:17, 5] rpc_server/srv_srvsvc_nt.c:_srv_net_share_get_info(1411)
>  _srv_net_share_get_info: 1411
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 srv_io_r_net_share_get_info 
>[2005/02/17 12:16:17, 6] rpc_parse/parse_prs.c:prs_debug(82)
>      000000 srv_io_srv_share_info info  
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0000 switch_value : 00000001
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>          0004 ptr_share_ctr: 00000001
>[2005/02/17 12:16:17, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000008 srv_io_share_info1 
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0008 ptr_netname: 00000001
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              000c type       : 00000000
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>              0010 ptr_remark : 00000001
>[2005/02/17 12:16:17, 7] rpc_parse/parse_prs.c:prs_debug(82)
>          000014 srv_io_share_info1_str 
>[2005/02/17 12:16:17, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000014 smb_io_unistr2 
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0014 uni_max_len: 00000007
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0018 offset     : 00000000
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  001c uni_str_len: 00000007
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  0020 buffer     : i.t.-.g.r.p...
>[2005/02/17 12:16:17, 8] rpc_parse/parse_prs.c:prs_debug(82)
>              000030 smb_io_unistr2 
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0030 uni_max_len: 00000023
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0034 offset     : 00000000
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>                  0038 uni_str_len: 00000023
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:dbg_rw_punival(814)
>                  003c buffer     : /.c.o.r.p./.i.t./.g.r.o.u.p. .-.-. .G.r.o.u.p. .O.n.l.y. .S.h.a.r.e...
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_werror(702)
>      0084 status: WERR_OK
>[2005/02/17 12:16:17, 5] rpc_server/srv_pipe.c:api_rpcTNP(1578)
>  api_rpcTNP: called srvsvc successfully
>[2005/02/17 12:16:17, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542)
>  free_pipe_context: destroying talloc pool of size 112
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(878)
>  write_to_pipe: data_used = 72
>[2005/02/17 12:16:17, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(909)
>  read_from_pipe: 7441 name: srvsvc len: 1024
>[2005/02/17 12:16:17, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(982)
>  read_from_pipe: srvsvc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 136.
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000000 smb_io_rpc_hdr hdr
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0000 major     : 05
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0001 minor     : 00
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0002 pkt_type  : 02
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0003 flags     : 03
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0004 pack_type0: 10
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0005 pack_type1: 00
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0006 pack_type2: 00
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0007 pack_type3: 00
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0008 frag_len  : 00a0
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      000a auth_len  : 0000
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      000c call_id   : 00000001
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_debug(82)
>  000010 smb_io_rpc_hdr_resp resp
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint32(642)
>      0010 alloc_hint: 00000088
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint16(613)
>      0014 context_id: 0000
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0016 cancel_ct : 00
>[2005/02/17 12:16:17, 5] rpc_parse/parse_prs.c:prs_uint8(584)
>      0017 reserved  : 00
>[2005/02/17 12:16:17, 5] smbd/ipc.c:copy_trans_params_and_data(60)
>  copy_trans_params_and_data: params[0..0] data[0..160]
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(474)
>  size=216
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=57856
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  160 (0xA0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  160 (0xA0)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=161
>[2005/02/17 12:16:17, 10] lib/util.c:dump_data(1990)
>  [000] 00 05 00 02 03 10 00 00  00 A0 00 00 00 01 00 00  ........ ........
>  [010] 00 88 00 00 00 00 00 00  00 01 00 00 00 01 00 00  ........ ........
>  [020] 00 01 00 00 00 00 00 00  00 01 00 00 00 07 00 00  ........ ........
>  [030] 00 00 00 00 00 07 00 00  00 69 00 74 00 2D 00 67  ........ .i.t.-.g
>  [040] 00 72 00 70 00 00 00 00  00 23 00 00 00 00 00 00  .r.p.... .#......
>  [050] 00 23 00 00 00 2F 00 63  00 6F 00 72 00 70 00 2F  .#.../.c .o.r.p./
>  [060] 00 69 00 74 00 2F 00 67  00 72 00 6F 00 75 00 70  .i.t./.g .r.o.u.p
>  [070] 00 20 00 2D 00 2D 00 20  00 47 00 72 00 6F 00 75  . .-.-.  .G.r.o.u
>  [080] 00 70 00 20 00 4F 00 6E  00 6C 00 79 00 20 00 53  .p. .O.n .l.y. .S
>  [090] 00 68 00 61 00 72 00 65  00 00 00 00 00 00 00 00  .h.a.r.e ........
>  [0A0] 00                                                . 
>[2005/02/17 12:16:17, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,220)
>[2005/02/17 12:16:17, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,220) wrote 220
>[2005/02/17 12:16:17, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 41
>[2005/02/17 12:16:17, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x29
>[2005/02/17 12:16:17, 3] smbd/process.c:process_smb(1091)
>  Transaction 114 of length 45
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(474)
>  size=41
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=57920
>  smt_wct=3
>  smb_vwv[ 0]=29761 (0x7441)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2005/02/17 12:16:17, 3] smbd/process.c:switch_message(886)
>  switch message SMBclose (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:17, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:17, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1168)
>  search for pipe pnum=7441
>[2005/02/17 12:16:17, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1172)
>  pipe name srvsvc pnum=7441 (pipes_open=1)
>[2005/02/17 12:16:17, 5] smbd/pipes.c:reply_pipe_close(260)
>  reply_pipe_close: pnum:7441
>[2005/02/17 12:16:17, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235)
>  close_policy_by_pipe: deleted handle list for pipe srvsvc
>[2005/02/17 12:16:17, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name srvsvc pnum=7441 (pipes_open=0)
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(474)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=65279
>  smb_uid=100
>  smb_mid=57920
>  smt_wct=0
>  smb_bcc=0
>[2005/02/17 12:16:17, 6] lib/util_sock.c:write_socket(449)
>  write_socket(27,39)
>[2005/02/17 12:16:17, 6] lib/util_sock.c:write_socket(452)
>  write_socket(27,39) wrote 39
>[2005/02/17 12:16:17, 10] lib/util_sock.c:read_smb_length_return_keepalive(505)
>  got smb length of 100
>[2005/02/17 12:16:17, 6] smbd/process.c:process_smb(1090)
>  got message type 0x0 of len 0x64
>[2005/02/17 12:16:17, 3] smbd/process.c:process_smb(1091)
>  Transaction 115 of length 104
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(474)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=51207
>  smb_tid=1
>  smb_pid=1340
>  smb_uid=100
>  smb_mid=57984
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=57054 (0xDEDE)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 5632 (0x1600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=16384 (0x4000)
>  smb_vwv[20]=16384 (0x4000)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=  256 (0x100)
>  smb_bcc=17
>[2005/02/17 12:16:17, 10] lib/util.c:dump_data(1990)
>  [000] 00 5C 00 73 00 72 00 76  00 73 00 76 00 63 00 00  .\.s.r.v .s.v.c..
>  [010] 00                                                . 
>[2005/02/17 12:16:17, 3] smbd/process.c:switch_message(886)
>  switch message SMBntcreateX (pid 13681) conn 0x2e5138
>[2005/02/17 12:16:17, 4] smbd/uid.c:change_to_user(194)
>  change_to_user: Skipping user change - already user
>[2005/02/17 12:16:17, 10] smbd/nttrans.c:reply_ntcreate_and_X(607)
>  reply_ntcreateX: flags = 0x16, desired_access = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x400040 root_dir_fid = 0x0
>[2005/02/17 12:16:17, 4] smbd/nttrans.c:nt_open_pipe(497)
>  nt_open_pipe: Opening pipe \srvsvc.
>[2005/02/17 12:16:17, 3] smbd/nttrans.c:nt_open_pipe(514)
>  nt_open_pipe: Known pipe srvsvc opening.
>[2005/02/17 12:16:17, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested srvsvc (pipes_open=0)
>[2005/02/17 12:16:17, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(278)
>  Create pipe requested srvsvc
>[2005/02/17 12:16:17, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77)
>  init_pipe_handles: created handle list for pipe srvsvc
>[2005/02/17 12:16:17, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93)
>  init_pipe_handles: pipe_handles ref count = 1 for pipe srvsvc
>[2005/02/17 12:16:17, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(370)
>  Created internal pipe srvsvc (pipes_open=0)
>[2005/02/17 12:16:17, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(257)
>  Opened pipe srvsvc with handle 7442 (pipes_open=1)
>[2005/02/17 12:16:17, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263)
>  open pipes: name srvsvc pnum=7442
>[2005/02/17 12:16:17, 5] smbd/nttrans.c:do_ntcreate_pipe_open(562)
>  do_ntcreate_pipe_open: open pipe = \srvsvc
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(464)
>[2005/02/17 12:16:17, 5] lib/util.c:show_msg(474)
>
>***** Truncated to keep under 1000K *****

Actions: View

Attachments on bug 2354: 970 | 971