The Net Use

The following is a trace of the new behavior of Windows NT 4.0 that allows a client to connect up to a Windows NT-based server via the HOST name rather than the NetBIOS computer name. This is a trace of the following command:

Net Use * \\scottsuPDC.scottsu.com\c$

Query the DNS for the Host name scottsuPDC.scotts.com


1  4.248 SCOTTSU-7  SCOTTSU_NT40 DNS  0x6:Std Qry for SCOTTSUPDC.SCOTTSU.COM 

  IP: Source Address = 157.55.102.52
  IP: Destination Address = 157.55.100.204
UDP: Src Port: Unknown, (1057); Dst Port: DNS (53); Length = 48 (0x30)
  UDP: Source Port = 0x0421
  UDP: Destination Port = DNS
  UDP: Total length = 48 (0x30) bytes
  UDP: CheckSum = 0x8FEA
  UDP: Data: Number of data bytes remaining = 40 (0x0028)
 DNS: 0x6:Std Qry for SCOTTSUPDC.SCOTTSU.COM of type Host Addr on class INET addr.
  DNS: Query Identifier = 6 (0x6)
  DNS: DNS Flags = Query, OpCode—Std Qry, RD Bits Set, RCode—No error
   DNS: 0............... = Query
   DNS: .0000........... = Standard Query
   DNS: .....0.......... = Server not authority for domain
   DNS: ......0......... = Message complete
   DNS: .......1........ = Recursive query desired
   DNS: ........0....... = Recursive queries supported by server
   DNS: .........000.... = Reserved
   DNS: ............0000 = No error
  DNS: Question Entry Count = 1 (0x1)
  DNS: Answer Entry Count = 0 (0x0)
  DNS: Name Server Count = 0 (0x0)
  DNS: Additional Records Count = 0 (0x0)
  DNS: Question Section: SCOTTSUPDC.SCOTTSU.COM of type Host Addr on class INET addr.
   DNS: Question Name: SCOTTSUPDC.SCOTTSU.COM
   DNS: Question Type = Host Address
   DNS: Question Class = Internet address class

This is the response from the DNS server. The IP address for scottsuPDC.scottsu.com is at the end of the frame


2  4.255 SCOTTSU_NT40 SCOTTSU-7  DNS  0x6:Std Qry Resp. for SCOTTSUPDC.SCOTTSU.COM 

  IP: Source Address = 157.55.100.204
  IP: Destination Address = 157.55.102.52
UDP: Src Port: DNS, (53); Dst Port: Unknown (1057); Length = 64 (0x40)
  UDP: Source Port = DNS
  UDP: Destination Port = 0x0421
  UDP: Total length = 64 (0x40) bytes
  UDP: CheckSum = 0x4932
  UDP: Data: Number of data bytes remaining = 56 (0x0038)
 DNS: 0x6:Std Qry Resp. for SCOTTSUPDC.SCOTTSU.COM of type Host Addr on class INET addr.
  DNS: Query Identifier = 6 (0x6)
  DNS: DNS Flags = Response, OpCode—Std Qry, AA RD RA Bits Set, RCode—No error
   DNS: 1............... = Response
   DNS: .0000........... = Standard Query
   DNS: .....1.......... = Server authority for domain
   DNS: ......0......... = Message complete
   DNS: .......1........ = Recursive query desired
   DNS: ........1....... = No recursive queries
   DNS: .........000.... = Reserved
   DNS: ............0000 = No error
  DNS: Question Entry Count = 1 (0x1)
  DNS: Answer Entry Count = 1 (0x1)
  DNS: Name Server Count = 0 (0x0)
  DNS: Additional Records Count = 0 (0x0)
  DNS: Question Section: SCOTTSUPDC.SCOTTSU.COM of type Host Addr on class INET addr.
   DNS: Question Name: SCOTTSUPDC.SCOTTSU.COM
   DNS: Question Type = Host Address
   DNS: Question Class = Internet address class
  DNS: Answer section: SCOTTSUPDC.SCOTTSU.COM of type Host Addr on class INET addr.
   DNS: Resource Name: SCOTTSUPDC.SCOTTSU.COM
   DNS: Resource Type = Host Address
   DNS: Resource Class = Internet address class
   DNS: Time To Live = 0 (0x0)
   DNS: Resource Data Length = 4 (0x4)
   DNS: IP address = 157.55.100.204

Then the client does an Adapter Status on the IP address to find what names that machine has registered


3  4.254 SCOTTSU-7  SCOTTSU_NT40 NBT  NS: Query req. for *<00...(15)> 

  IP: Source Address = 157.55.102.52
  IP: Destination Address = 157.55.100.204
UDP: Src Port: NETBIOS Name Service, (137); Dst Port: NETBIOS Name Service (137); Length = 58 (0x3A)
  UDP: Source Port = NETBIOS Name Service
  UDP: Destination Port = NETBIOS Name Service
  UDP: Total length = 58 (0x3A) bytes
  UDP: CheckSum = 0x3A63
  UDP: Data: Number of data bytes remaining = 50 (0x0032)
 NBT: NS: Query req. for *<00...(15)>
  NBT: Transaction ID = 32860 (0x805C)
  NBT: Flags Summary = 0x0000—Req.; Query; Success
   NBT: 0............... = Request
   NBT: .0000........... = Query
   NBT: .....0.......... = Non-authoritative Answer
   NBT: ......0......... = Datagram not truncated
   NBT: .......0........ = Recursion not desired
   NBT: ........0....... = Recursion not available
   NBT: .........0...... = Reserved
   NBT: ..........0..... = Reserved
   NBT: ...........0.... = Not a broadcast packet
   NBT: ............0000 = Success
  NBT: Question Count = 1 (0x1)
  NBT: Answer Count = 0 (0x0)
  NBT: Name Service Count = 0 (0x0)
  NBT: Additional Record Count = 0 (0x0)
  NBT: Question Name = *<00...(15)>
  NBT: Question Type = Node Status Request
  NBT: Question Class = Internet Class

This is the response to the Adapter Status. The machine has a number of NetBIOS names registered.


4  4.255 SCOTTSU_NT40 SCOTTSU-7  NBT  NS: Query (Node Status) resp. for *<00...(15)>, Success 

  IP: Source Address = 157.55.100.204
  IP: Destination Address = 157.55.102.52
UDP: Src Port: NETBIOS Name Service, (137); Dst Port: NETBIOS Name Service (137); Length = 345 (0x159)
  UDP: Source Port = NETBIOS Name Service
  UDP: Destination Port = NETBIOS Name Service
  UDP: Total length = 345 (0x159) bytes
  UDP: CheckSum = 0xC551
  UDP: Data: Number of data bytes remaining = 337 (0x0151)
 NBT: NS: Query (Node Status) resp. for *<00...(15)>, Success
  NBT: Transaction ID = 32860 (0x805C)
  NBT: Flags Summary = 0x8400—Resp.; Query; Success
   NBT: 1............... = Response
   NBT: .0000........... = Query
   NBT: .....1.......... = Authoritative Answer
   NBT: ......0......... = Datagram not truncated
   NBT: .......0........ = Recursion not desired
   NBT: ........0....... = Recursion not available
   NBT: .........0...... = Reserved
   NBT: ..........0..... = Reserved
   NBT: ...........0.... = Not a broadcast packet
   NBT: ............0000 = Success
  NBT: Question Count = 0 (0x0)
  NBT: Answer Count = 1 (0x1)
  NBT: Name Service Count = 0 (0x0)
  NBT: Additional Record Count = 0 (0x0)
  NBT: Resource Record Name = *<00...(15)>
  NBT: Resource Record Type = Node Status Request
  NBT: Resource Record Class = Internet Class
  NBT: Time To Live = 0 (0x0)
  NBT: RDATA Length = 263 (0x107)
  NBT: Number of Names = 12 (0xC)
  NBT: ASCII Name = SCOTTSU_NT40 
  NBT: Resource Record Flags = 17408 (0x4400)
   NBT: ......0......... = Non-Permanent
   NBT: .....1.......... = Active Name
   NBT: ....0........... = Name is not in Conflict
   NBT: ...0............ = Not Deregistering
   NBT: .10............. = M Node
   NBT: 0............... = Unique NetBIOS Name
  NBT: ASCII Name = SCOTTSU_NT40 00
  NBT: Resource Record Flags = 17408 (0x4400)
   NBT: ......0......... = Non-Permanent
   NBT: .....1.......... = Active Name
   NBT: ....0........... = Name is not in Conflict
   NBT: ...0............ = Not Deregistering
   NBT: .10............. = M Node
   NBT: 0............... = Unique NetBIOS Name
  NBT: ASCII Name = SCOTTSU_NT40D 00
  NBT: Resource Record Flags = 50176 (0xC400)
   NBT: ......0......... = Non-Permanent
   NBT: .....1.......... = Active Name
   NBT: ....0........... = Name is not in Conflict
   NBT: ...0............ = Not Deregistering
   NBT: .10............. = M Node
   NBT: 1............... = Group NetBIOS Name
  NBT: ASCII Name = SCOTTSU_NT40D <1C>
  NBT: Resource Record Flags = 50176 (0xC400)
   NBT: ......0......... = Non-Permanent
   NBT: .....1.......... = Active Name
   NBT: ....0........... = Name is not in Conflict
   NBT: ...0............ = Not Deregistering
   NBT: .10............. = M Node
   NBT: 1............... = Group NetBIOS Name
  NBT: ASCII Name = SCOTTSU_NT40D <1B>
  NBT: Resource Record Flags = 17408 (0x4400)
   NBT: ......0......... = Non-Permanent
   NBT: .....1.......... = Active Name
   NBT: ....0........... = Name is not in Conflict
   NBT: ...0............ = Not Deregistering
   NBT: .10............. = M Node
   NBT: 0............... = Unique NetBIOS Name
  NBT: ASCII Name = SCOTTSU_NT40D <1E>
  NBT: Resource Record Flags = 50176 (0xC400)
   NBT: ......0......... = Non-Permanent
   NBT: .....1.......... = Active Name
   NBT: ....0........... = Name is not in Conflict
   NBT: ...0............ = Not Deregistering
   NBT: .10............. = M Node
   NBT: 1............... = Group NetBIOS Name
  NBT: ASCII Name = SCOTTSU_NT40 <03>
  NBT: Resource Record Flags = 17408 (0x4400)
   NBT: ......0......... = Non-Permanent
   NBT: .....1.......... = Active Name
   NBT: ....0........... = Name is not in Conflict
   NBT: ...0............ = Not Deregistering
   NBT: .10............. = M Node
   NBT: 0............... = Unique NetBIOS Name
  NBT: ASCII Name = SCOTTSU_NT40D <1D>
  NBT: Resource Record Flags = 17408 (0x4400)
   NBT: ......0......... = Non-Permanent
   NBT: .....1.......... = Active Name
   NBT: ....0........... = Name is not in Conflict
   NBT: ...0............ = Not Deregistering
   NBT: .10............. = M Node
   NBT: 0............... = Unique NetBIOS Name
  NBT: ASCII Name = <01><02>__MSBROWSE__<02><01>
  NBT: Resource Record Flags = 50176 (0xC400)
   NBT: ......0......... = Non-Permanent
   NBT: .....1.......... = Active Name
   NBT: ....0........... = Name is not in Conflict
   NBT: ...0............ = Not Deregistering
   NBT: .10............. = M Node
   NBT: 1............... = Group NetBIOS Name
  NBT: ASCII Name = INet~Services <1C>
  NBT: Resource Record Flags = 50176 (0xC400)
   NBT: ......0......... = Non-Permanent
   NBT: .....1.......... = Active Name
   NBT: ....0........... = Name is not in Conflict
   NBT: ...0............ = Not Deregistering
   NBT: .10............. = M Node
   NBT: 1............... = Group NetBIOS Name
  NBT: ASCII Name = IS~SCOTTSU_NT4000
  NBT: Resource Record Flags = 17408 (0x4400)
   NBT: ......0......... = Non-Permanent
   NBT: .....1.......... = Active Name
   NBT: ....0........... = Name is not in Conflict
   NBT: ...0............ = Not Deregistering
   NBT: .10............. = M Node
   NBT: 0............... = Unique NetBIOS Name
  NBT: ASCII Name = SCOTTSU_NT40żżżż
  NBT: Resource Record Flags = 50176 (0xC400)
   NBT: ......0......... = Non-Permanent
   NBT: .....1.......... = Active Name
   NBT: ....0........... = Name is not in Conflict
   NBT: ...0............ = Not Deregistering
   NBT: .10............. = M Node
   NBT: 1............... = Group NetBIOS Name
  NBT: Adapter Address = 00A02463AB22 
  NBT: Version Major = 0 (0x0)
  NBT: Version Minor = 0 (0x0)
  NBT: Duration = 0 (0x0)
  NBT: FRMRs Received = 0 (0x0)
  NBT: FRMRs Transmitted = 0 (0x0)
  NBT: IFrame Receive Errors = 0 (0x0)
  NBT: Transmit Aborts = 0 (0x0)
  NBT: Tranmitted = 0 (0x0)
  NBT: Received = 0 (0x0)
  NBT: IFrame Transmit Errors = 0 (0x0)
  NBT: No Receive Buffers = 0 (0x0)
  NBT: T1 Timeouts = 0 (0x0)
  NBT: Ti Timeouts = 0 (0x0)
  NBT: Free NCBS = 0 (0x0)
  NBT: NCBS = 0 (0x0)
  NBT: Max NCBS = 0 (0x0)
  NBT: No Transmit Buffers = 255 (0xFF)
  NBT: Max Datagram = 799 (0x31F)
  NBT: Pending Sessions = 32 (0x20)
  NBT: Max Sessions = 33008 (0x80F0)
  NBT: Packet Size = 20976 (0x51F0)

Now the client is going to do the TCP 3 way handshake.


5  4.257 SCOTTSU-7  SCOTTSU_NT40 TCP  ....S., len: 4, seq: 2817881, ack:   0, win: 8192 

  IP: Source Address = 157.55.102.52
  IP: Destination Address = 157.55.100.204
TCP: ....S., len: 4, seq: 2817881, ack:   0, win: 8192, src: 1056 dst: 139 (NBT Session) 


6  4.257 SCOTTSU_NT40 SCOTTSU-7  TCP  .A..S., len: 4, seq: 5416017, ack: 2817882, win: 8760, src SCOTTSU_NT40 SCOTTSU-7  IP

  IP: Source Address = 157.55.100.204
  IP: Destination Address = 157.55.102.52
TCP: .A..S., len: 4, seq: 5416017, ack: 2817882, win: 8760, src: 139 (NBT Session) dst: 1056 


7  4.258 SCOTTSU-7  SCOTTSU_NT40 TCP  .A...., len: 0, seq: 2817882, ack: 5416018, win: 8760 

  IP: Source Address = 157.55.102.52
  IP: Destination Address = 157.55.100.204
TCP: .A...., len: 0, seq: 2817882, ack: 5416018, win: 8760, src: 1056 dst: 139 (NBT Session) 

Now the client will send a NetBT Session Request to the NetBIOS server name (not the HOST name).


8  4.259 SCOTTSU-7  SCOTTSU_NT40 NBT  SS: Session Request, Dest: SCOTTSU_NT40 

  IP: Source Address = 157.55.102.52
  IP: Destination Address = 157.55.100.204
TCP: .AP..., len: 72, seq: 2817882, ack: 5416018, win: 8760, src: 1056 dst: 139 (NBT Session) 
  TCP: Source Port = 0x0420
  TCP: Destination Port = NETBIOS Session Service
  TCP: Sequence Number = 2817882 (0x2AFF5A)
  TCP: Acknowledgement Number = 5416018 (0x52A452)
  TCP: Data Offset = 20 (0x14)
  TCP: Reserved = 0 (0x0000)
  TCP: Flags = 0x18 : .AP...
   TCP: ..0..... = No urgent data
   TCP: ...1.... = Acknowledgement field significant
   TCP: ....1... = Push function
   TCP: .....0.. = No Reset
   TCP: ......0. = No Synchronize
   TCP: .......0 = No Fin
  TCP: Window = 8760 (0x2238)
  TCP: CheckSum = 0x722C
  TCP: Urgent Pointer = 0 (0x0)
  TCP: Data: Number of data bytes remaining = 72 (0x0048)
 NBT: SS: Session Request, Dest: SCOTTSU_NT40 , Source: SCOTTSU-7  <00>, Len: 68
  NBT: Packet Type = Session Request
  NBT: Packet Flags = 0 (0x0)
   NBT: .......0 = Add 0 to Length
  NBT: Packet Length = 68 (0x44)
  NBT: Called Name = SCOTTSU_NT40 
  NBT: Calling Name = SCOTTSU-7  <00>

This is a positive session response from the server.


9  4.259 SCOTTSU_NT40 SCOTTSU-7  NBT  SS: Positive Session Response, Len: 0 

  IP: Source Address = 157.55.100.204
  IP: Destination Address = 157.55.102.52
TCP: .AP..., len: 4, seq: 5416018, ack: 2817954, win: 8688, src: 139 (NBT Session) dst: 1056 
  TCP: Source Port = NETBIOS Session Service
  TCP: Destination Port = 0x0420
  TCP: Sequence Number = 5416018 (0x52A452)
  TCP: Acknowledgement Number = 2817954 (0x2AFFA2)
  TCP: Data Offset = 20 (0x14)
  TCP: Reserved = 0 (0x0000)
  TCP: Flags = 0x18 : .AP...
   TCP: ..0..... = No urgent data
   TCP: ...1.... = Acknowledgement field significant
   TCP: ....1... = Push function
   TCP: .....0.. = No Reset
   TCP: ......0. = No Synchronize
   TCP: .......0 = No Fin
  TCP: Window = 8688 (0x21F0)
  TCP: CheckSum = 0x5D4C
  TCP: Urgent Pointer = 0 (0x0)
  TCP: Data: Number of data bytes remaining = 4 (0x0004)
 NBT: SS: Positive Session Response, Len: 0
  NBT: Packet Type = Positive Session Response
  NBT: Packet Flags = 0 (0x0)
   NBT: .......0 = Add 0 to Length
  NBT: Packet Length = 0 (0x0)

Now we will begin to set up a session between the redirector and the server (application layer). This starts out with a negotiate frame.


10  4.262 SCOTTSU-7  SCOTTSU_NT40 SMB  C negotiate, Dialect = NT LM 0.12 


11  4.276 SCOTTSU_NT40 SCOTTSU-7  SMB  R negotiate, Dialect # = 7 

Now we are going to set up the session between the redirector and the server. This frame also has a Tree Connect attached to it. Note that the server name in the Tree Connect is the HOST name. The redirector doesn't actually use this name. It only knows about the NetBIOS computer name.


12  4.275 SCOTTSU-7  SCOTTSU_NT40 SMB  C session setup & X, and C tree connect

  IP: Source Address = 157.55.102.52
  IP: Destination Address = 157.55.100.204
TCP: .AP..., len: 314, seq: 2818128, ack: 5416131, win: 8647, src: 1056 dst: 139 (NBT Session) 
  TCP: Source Port = 0x0420
  TCP: Destination Port = NETBIOS Session Service
  TCP: Sequence Number = 2818128 (0x2B0050)
  TCP: Acknowledgement Number = 5416131 (0x52A4C3)
  TCP: Data Offset = 20 (0x14)
  TCP: Reserved = 0 (0x0000)
  TCP: Flags = 0x18 : .AP...
   TCP: ..0..... = No urgent data
   TCP: ...1.... = Acknowledgement field significant
   TCP: ....1... = Push function
   TCP: .....0.. = No Reset
   TCP: ......0. = No Synchronize
   TCP: .......0 = No Fin
  TCP: Window = 8647 (0x21C7)
  TCP: CheckSum = 0x5638
  TCP: Urgent Pointer = 0 (0x0)
  TCP: Data: Number of data bytes remaining = 314 (0x013A)
 NBT: SS: Session Message, Len: 310
  NBT: Packet Type = Session Message
  NBT: Packet Flags = 0 (0x0)
   NBT: .......0 = Add 0 to Length
  NBT: Packet Length = 310 (0x136)
  NBT: SS Data: Number of data bytes remaining = 310 (0x0136)
 SMB: C session setup & X, Username = Administrator, and C tree connect & X, Share = \\SCOTTSUPDC.SCOTTSU.COM\IPC$
  SMB: SMB Status = Error Success
   SMB: Error class = No Error
   SMB: Error code = No Error
  SMB: Header: PID = 0xCAFE TID = 0x0000 MID = 0x0000 UID = 0x0000
   SMB: Tree ID  (TID) = 0 (0x0)
   SMB: Process ID (PID) = 51966 (0xCAFE)
   SMB: User ID  (UID) = 0 (0x0)
   SMB: Multiplex ID (MID) = 0 (0x0)
   SMB: Flags Summary = 24 (0x18)
    SMB: .......0 = Lock & Read and Write & Unlock not supported
    SMB: ......0. = Send No Ack not supported
    SMB: ....1... = Using caseless pathnames
    SMB: ...1.... = Canonicalized pathnames
    SMB: ..0..... = No Opportunistic lock
    SMB: .0...... = No Change Notify
    SMB: 0....... = Client command
   SMB: flags2 Summary = 32771 (0x8003)
    SMB: ...............1 = Understands long filenames
    SMB: ..............1. = Understands extended attributes
    SMB: ..0............. = No paging of IO
    SMB: .0.............. = Using SMB status codes
    SMB: 1............... = Using UNICODE strings
  SMB: Command = C session setup & X
   SMB: Word count = 13
   SMB: Word parameters
   SMB: Next offset = 0x00E8
   SMB: Max Buffer Size = 4356
   SMB: Max MPX requests = 50
   SMB: VC number = 0
   SMB: Session Key = 0
   SMB: Password length = 24 (0x18)
   SMB: Unicode Password length = 24 (0x18)
   SMB: Capabilities = 212 (0xD4)
    SMB: ...............................0 = No Raw Reads and Writes.
    SMB: ..............................0. = No support for multiplexed commands.
    SMB: .............................1.. = Supports UNICODE strings.
    SMB: ............................0... = Does not support large files.
    SMB: ...........................1.... = Supports the NT SMB extensions.
    SMB: ..........................0..... = RPC remote API's not supported.
    SMB: .........................1...... = Recognizes NT Status codes.
    SMB: ........................1....... = Supports level II oplocks.
    SMB: .......................0........ = Does not support Lock and Read.
   SMB: Byte count = 171
   SMB: Byte parameters
   SMB: Account name = Administrator
   SMB: Domain name = SCOTTSU_NT40D
   SMB: Native OS = Windows NT 1307
   SMB: Native Lanman = Windows NT 4.0
  SMB: Command = C tree connect & X
   SMB: Word count = 4
   SMB: Word parameters
   SMB: Next offset = 0x0000
   SMB: Disconnect flag = 0x0000
   SMB: Password length = 1 (0x1)
   SMB: Byte count = 67
   SMB: Byte parameters
   SMB: Password = 
   SMB: Path name = \\SCOTTSUPDC.SCOTTSU.COM\IPC$

13  4.289 SCOTTSU_NT40 SCOTTSU-7  TCP  ...R.., len: 0, seq: 4933305, ack: 2818128, win: 0 

14  4.289 SCOTTSU_NT40 SCOTTSU-7  TCP  ...R.., len: 0, seq: 3578897, ack: 2818128, win: 0 

15  4.297 SCOTTSU_NT40 SCOTTSU-7  SMB  R session setup & X, and R tree connect & X, Type = IPC 

16  4.479 SCOTTSU-7  SCOTTSU_NT40 TCP  .A...., len: 0, seq: 2818442, ack: 5416289, win: 8489 

17  4.637 SCOTTSU-7  SCOTTSU_NT40 SMB  C tree connect & X, Share = \\SCOTTSUPDC.SCOTTSU.COM\C$ 

  IP: Source Address = 157.55.102.52
  IP: Destination Address = 157.55.100.204
TCP: .AP..., len: 107, seq: 2818442, ack: 5416289, win: 8489, src: 1056 dst: 139 (NBT Session) 
  TCP: Source Port = 0x0420
  TCP: Destination Port = NETBIOS Session Service
  TCP: Sequence Number = 2818442 (0x2B018A)
  TCP: Acknowledgement Number = 5416289 (0x52A561)
  TCP: Data Offset = 20 (0x14)
  TCP: Reserved = 0 (0x0000)
  TCP: Flags = 0x18 : .AP...
   TCP: ..0..... = No urgent data
   TCP: ...1.... = Acknowledgement field significant
   TCP: ....1... = Push function
   TCP: .....0.. = No Reset
   TCP: ......0. = No Synchronize
   TCP: .......0 = No Fin
  TCP: Window = 8489 (0x2129)
  TCP: CheckSum = 0x99CE
  TCP: Urgent Pointer = 0 (0x0)
  TCP: Data: Number of data bytes remaining = 107 (0x006B)
 NBT: SS: Session Message, Len: 103
  NBT: Packet Type = Session Message
  NBT: Packet Flags = 0 (0x0)
   NBT: .......0 = Add 0 to Length
  NBT: Packet Length = 103 (0x67)
  NBT: SS Data: Number of data bytes remaining = 103 (0x0067)
 SMB: C tree connect & X, Share = \\SCOTTSUPDC.SCOTTSU.COM\C$
  SMB: SMB Status = Error Success
   SMB: Error class = No Error
   SMB: Error code = No Error
  SMB: Header: PID = 0xCAFE TID = 0x0000 MID = 0x0040 UID = 0x0801
   SMB: Tree ID  (TID) = 0 (0x0)
   SMB: Process ID (PID) = 51966 (0xCAFE)
   SMB: User ID  (UID) = 2049 (0x801)
   SMB: Multiplex ID (MID) = 64 (0x40)
   SMB: Flags Summary = 24 (0x18)
    SMB: .......0 = Lock & Read and Write & Unlock not supported
    SMB: ......0. = Send No Ack not supported
    SMB: ....1... = Using caseless pathnames
    SMB: ...1.... = Canonicalized pathnames
    SMB: ..0..... = No Opportunistic lock
    SMB: .0...... = No Change Notify
    SMB: 0....... = Client command
   SMB: flags2 Summary = 32771 (0x8003)
    SMB: ...............1 = Understands long filenames
    SMB: ..............1. = Understands extended attributes
    SMB: ..0............. = No paging of IO
    SMB: .0.............. = Using SMB status codes
    SMB: 1............... = Using UNICODE strings
  SMB: Command = C tree connect & X
   SMB: Word count = 4
   SMB: Word parameters
   SMB: Next offset = 0x0000
   SMB: Disconnect flag = 0x0000
   SMB: Password length = 1 (0x1)
   SMB: Byte count = 60
   SMB: Byte parameters
   SMB: Password = 
   SMB: Path name = \\SCOTTSUPDC.SCOTTSU.COM\C$

18  4.654 SCOTTSU_NT40 SCOTTSU-7  SMB  R tree connect & X, Type = A: