2.2.3.1 SMB Header Extensions

  • Article

All client requests MUST begin with a fixed-size SMB header, as specified in [MS-CIFS] section 2.2.3.1. All server responses, with the exception of the SMB_COM_READ_RAW response message, as specified in [MS-CIFS] section 2.2.4.22.2, MUST begin with the same fixed-size SMB header.

 SMB_Header
   {
   UCHAR  Protocol[4];
   UCHAR  Command;
   SMB_ERROR Status;
   UCHAR  Flags;
   USHORT Flags2;
   USHORT PIDHigh;
   UCHAR  SecurityFeatures[8];
   USHORT Reserved;
   USHORT TID;
   USHORT PIDLow;
   USHORT UID;
   USHORT MID;
   }

The following SMB header fields contain extensions:


0


1


2


3


4


5


6


7


8


9

1
0


1


2


3


4


5


6


7


8


9

2
0


1


2


3


4


5


6


7


8


9

3
0


1

Protocol

Command

Status

...

Flags

Flags2

PIDHigh

SecurityFeatures

...

...

Reserved

TID

PIDLow

UID

MID

Flags2 (2 bytes): The Flags2 field contains individual bit flags that, depending on the negotiated SMB dialect, indicate various client and server capabilities. This field is defined as specified in [MS-CIFS] section 2.2.3.1. There are several new Flags2 values in the SMB header that are not in [MS-CIFS], but are part of these extensions. Unused bit fields SHOULD be set to zero by the sender when sending an SMB message and SHOULD<21> be ignored when received by the receiver. This field is constructed using the values listed in section 2.2.3.1 of [MS-CIFS], as well as the following additional values:

Name &  bitmask

Meaning

SMB_FLAGS2_COMPRESSED

0x0008

If set by the client, the client is requesting compressed data for an SMB_COM_READ_ANDX request. If cleared by the server, the server is notifying the client that the data was written uncompressed. This bit field SHOULD only be set to one when NT LAN Manager or later is negotiated for the SMB dialect.

SMB_FLAGS2_SMB_SECURITY_SIGNATURE_REQUIRED

0x0010

This flag SHOULD<22> be set by the client on the first SMB_COM_SESSION_SETUP_ANDX request (section 2.2.4.6.1) sent to a server that supports extended security if the client requires all further communication with this server to be signed. If the server does not support signing, it MUST disconnect the client by closing the underlying transport connection. Clients and servers MUST ignore this value for other requests and responses. If the client receives a non-signed response from the server, it MUST disconnect the underlying transport connection. This bit field SHOULD only be set to one when NT LAN Manager or later is negotiated for the SMB dialect, the client supports extended security, and the client is configured to require security signatures.

SMB_FLAGS2_IS_LONG_NAME

0x0040

If set, the path contained in the message contains long names; otherwise, the paths are restricted to 8.3 names. This bit field SHOULD only be set to one when NT LAN Manager or later is negotiated for the SMB dialect. If client sets this bit in the request, the server SHOULD<23> also set this bit in the response.

SMB_FLAGS2_REPARSE_PATH

0x0400

If set, the path in the request MUST contain an @GMT token (that is, a Previous Version token), as specified in section 2.2.1.1.1.

SMB_FLAGS2_EXTENDED_SECURITY

0x0800

Indicates that the client or server supports SPNEGO authentication, as specified in section 3.2.5.2 for client behavior and section 3.3.5.2 for server behavior. This bit field SHOULD be set to one only when NT LAN Manager or later is negotiated for the SMB dialect and the client or server supports extended security.

PIDHigh (2 bytes): This field MUST give the 2 high bytes of the process identifier (PID) if the Client.Supports32BitPIDs, as specified in section 3.2.1.1, is TRUE. Otherwise, it MUST be set to zero.