 | 1 | initial version |
File shares accessed by SMB, SMB2 or SMB3 can be replicated over multiple servers. The underlying shares are arranged in a name space. The Microsoft documentation on DFS discusses this topic in detail.
When accessing a share, the client tries to find out, if the share is available through DFS. This query is made using the Ioctl Request, that you have recorded. If the share is indeed part of a DFS name space the response includes all servers, that host the share. The client will then pick one of the servers and access the files as desired.
At least on Server 2008, the server will responds with STATUS_NOT_FOUND if the share is not DFS enabled. On other SMB2/3 implementations you might observe a response with an empty array in the out data section.
The short snippet from your trace file would only be troublesome if your share is DFS enabled.
Good luck
Eddi
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
