| smb.access.append | Append | Boolean | Can object's contents be appended to |
| smb.access.caching | Caching | Boolean | Caching mode? |
| smb.access.delete | Delete | Boolean | Can object be deleted |
| smb.access.delete_child | Delete Child | Boolean | Can object's subdirectories be deleted |
| smb.access.execute | Execute | Boolean | Can object be executed (if file) or traversed (if directory) |
| smb.access.generic_all | Generic All | Boolean | Is generic all allowed for this attribute |
| smb.access.generic_execute | Generic Execute | Boolean | Is generic execute allowed for this object? |
| smb.access.generic_read | Generic Read | Boolean | Is generic read allowed for this object? |
| smb.access.generic_write | Generic Write | Boolean | Is generic write allowed for this object? |
| smb.access.locality | Locality | Unsigned 16-bit integer | Locality of reference |
| smb.access.maximum_allowed | Maximum Allowed | Boolean | ? |
| smb.access.mode | Access Mode | Unsigned 16-bit integer | Access Mode |
| smb.access.read | Read | Boolean | Can object's contents be read |
| smb.access.read_attributes | Read Attributes | Boolean | Can object's attributes be read |
| smb.access.read_control | Read Control | Boolean | Are reads allowed of owner, group and ACL data of the SID? |
| smb.access.read_ea | Read EA | Boolean | Can object's extended attributes be read |
| smb.access.sharing | Sharing Mode | Unsigned 16-bit integer | Sharing Mode |
| smb.access.smb.date | Last Access Date | Unsigned 16-bit integer | Last Access Date, SMB_DATE format |
| smb.access.smb.time | Last Access Time | Unsigned 16-bit integer | Last Access Time, SMB_TIME format |
| smb.access.synchronize | Synchronize | Boolean | Windows NT: synchronize access |
| smb.access.system_security | System Security | Boolean | Access to a system ACL? |
| smb.access.time | Last Access | Date/Time stamp | Last Access Time |
| smb.access.write | Write | Boolean | Can object's contents be written |
| smb.access.write_attributes | Write Attributes | Boolean | Can object's attributes be written |
| smb.access.write_dac | Write DAC | Boolean | Is write allowed to the owner group or ACLs? |
| smb.access.write_ea | Write EA | Boolean | Can object's extended attributes be written |
| smb.access.write_owner | Write Owner | Boolean | Can owner write to the object? |
| smb.access.writethrough | Writethrough | Boolean | Writethrough mode? |
| smb.account | Account | String | Account, username |
| smb.ace.flags.container_inherit | Container Inherit | Boolean | Will subordinate containers inherit this ACE? |
| smb.ace.flags.failed_access | Audit Failed Accesses | Boolean | Should failed accesses be audited? |
| smb.ace.flags.inherit_only | Inherit Only | Boolean | Does this ACE apply to the current object? |
| smb.ace.flags.inherited_ace | Inherited ACE | Boolean | Was this ACE inherited from its parent object? |
| smb.ace.flags.non_propagate_inherit | Non-Propagate Inherit | Boolean | Will subordinate object propagate this ACE further? |
| smb.ace.flags.object_inherit | Object Inherit | Boolean | Will subordinate files inherit this ACE? |
| smb.ace.flags.successful_access | Audit Successful Accesses | Boolean | Should successful accesses be audited? |
| smb.ace.size | Size | Unsigned 16-bit integer | Size of this ACE |
| smb.ace.type | Type | Unsigned 8-bit integer | Type of ACE |
| smb.acl.num_aces | Num ACEs | Unsigned 32-bit integer | Number of ACE structures for this ACL |
| smb.acl.revision | Revision | Unsigned 16-bit integer | Version of NT ACL structure |
| smb.acl.size | Size | Unsigned 16-bit integer | Size of NT ACL structure |
| smb.actual_free_alloc_units | Actual Free Units | Unsigned 64-bit integer | Number of actual free allocation units |
| smb.alignment | Alignment | Unsigned 32-bit integer | What alignment do we require for buffers |
| smb.alloc.count | Allocation Block Count | Unsigned 32-bit integer | Allocation Block Count |
| smb.alloc.size | Allocation Block Count | Unsigned 32-bit integer | Allocation Block Size |
| smb.alloc_size | Allocation Size | Unsigned 32-bit integer | Number of bytes to reserve on create or truncate |
| smb.andxoffset | AndXOffset | Unsigned 16-bit integer | Offset to next command in this SMB packet |
| smb.ansi_password | ANSI Password | Byte array | ANSI Password |
| smb.ansi_pwlen | ANSI Password Length | Unsigned 16-bit integer | Length of ANSI password |
| smb.avail.units | Available Units | Unsigned 32-bit integer | Total number of available units on this filesystem |
| smb.backup.time | Backed-up | Date/Time stamp | Backup time |
| smb.bcc | Byte Count (BCC) | Unsigned 16-bit integer | Byte Count, count of data bytes |
| smb.blocksize | Block Size | Unsigned 16-bit integer | Block size (in bytes) at server |
| smb.bpu | Blocks Per Unit | Unsigned 16-bit integer | Blocks per unit at server |
| smb.buffer_format | Buffer Format | Unsigned 8-bit integer | Buffer Format, type of buffer |
| smb.caller_free_alloc_units | Caller Free Units | Unsigned 64-bit integer | Number of caller free allocation units |
| smb.cancel_to | Cancel to | Unsigned 32-bit integer | This packet is a cancellation of the packet in this frame |
| smb.change.time | Change | Date/Time stamp | Last Change Time |
| smb.change_count | Change Count | Unsigned 16-bit integer | Number of changes to wait for |
| smb.cmd | SMB Command | Unsigned 8-bit integer | SMB Command |
| smb.compressed.chunk_shift | Chunk Shift | Unsigned 8-bit integer | Allocated size of the stream in number of bytes |
| smb.compressed.cluster_shift | Cluster Shift | Unsigned 8-bit integer | Allocated size of the stream in number of bytes |
| smb.compressed.file_size | Compressed Size | Unsigned 64-bit integer | Size of the compressed file |
| smb.compressed.format | Compression Format | Unsigned 16-bit integer | Compression algorithm used |
| smb.compressed.unit_shift | Unit Shift | Unsigned 8-bit integer | Size of the stream in number of bytes |
| smb.connect.flags.dtid | Disconnect TID | Boolean | Disconnect TID? |
| smb.connect.support.dfs | In Dfs | Boolean | Is this in a Dfs tree? |
| smb.connect.support.search | Search Bits | Boolean | Exclusive Search Bits supported? |
| smb.continuation_to | Continuation to | Unsigned 32-bit integer | This packet is a continuation to the packet in this frame |
| smb.copy.flags.dest_mode | Destination mode | Boolean | Is destination in ASCII? |
| smb.copy.flags.dir | Must be directory | Boolean | Must target be a directory? |
| smb.copy.flags.ea_action | EA action if EAs not supported on dest | Boolean | Fail copy if source file has EAs and dest doesn't support EAs? |
| smb.copy.flags.file | Must be file | Boolean | Must target be a file? |
| smb.copy.flags.source_mode | Source mode | Boolean | Is source in ASCII? |
| smb.copy.flags.tree_copy | Tree copy | Boolean | Is copy a tree copy? |
| smb.copy.flags.verify | Verify writes | Boolean | Verify all writes? |
| smb.count | Count | Unsigned 32-bit integer | Count number of items/bytes |
| smb.create.action | Create action | Unsigned 32-bit integer | Type of action taken |
| smb.create.disposition | Disposition | Unsigned 32-bit integer | Create disposition, what to do if the file does/does not exist |
| smb.create.file_id | Server unique file ID | Unsigned 32-bit integer | Server unique file ID |
| smb.create.smb.date | Create Date | Unsigned 16-bit integer | Create Date, SMB_DATE format |
| smb.create.smb.time | Create Time | Unsigned 16-bit integer | Create Time, SMB_TIME format |
| smb.create.time | Created | Date/Time stamp | Creation Time |
| smb.data_disp | Data Displacement | Unsigned 16-bit integer | Data Displacement |
| smb.data_len | Data Length | Unsigned 16-bit integer | Length of data |
| smb.data_offset | Data Offset | Unsigned 16-bit integer | Data Offset |
| smb.data_size | Data Size | Unsigned 32-bit integer | Data Size |
| smb.dc | Data Count | Unsigned 16-bit integer | Number of data bytes in this buffer |
| smb.dcm | Data Compaction Mode | Unsigned 16-bit integer | Data Compaction Mode |
| smb.delete_pending | Delete Pending | Unsigned 16-bit integer | Is this object about to be deleted? |
| smb.destination_name | Destination Name | String | Name of recipient of message |
| smb.device.floppy | Floppy | Boolean | Is this a floppy disk |
| smb.device.mounted | Mounted | Boolean | Is this a mounted device |
| smb.device.read_only | Read Only | Boolean | Is this a read-only device |
| smb.device.remote | Remote | Boolean | Is this a remote device |
| smb.device.removable | Removable | Boolean | Is this a removable device |
| smb.device.type | Device Type | Unsigned 32-bit integer | Type of device |
| smb.device.virtual | Virtual | Boolean | Is this a virtual device |
| smb.device.write_once | Write Once | Boolean | Is this a write-once device |
| smb.dfs.flags.fielding | Fielding | Boolean | The servers in referrals are capable of fielding |
| smb.dfs.flags.server_hold_storage | Hold Storage | Boolean | The servers in referrals should hold storage for the file |
| smb.dfs.num_referrals | Num Referrals | Unsigned 16-bit integer | Number of referrals in this pdu |
| smb.dfs.path_consumed | Path Consumed | Unsigned 16-bit integer | Number of RequestFilename bytes client |
| smb.dfs.referral.alt_path | Alt Path | String | Alternative(8.3) Path that matched pathconsumed |
| smb.dfs.referral.alt_path_offset | Alt Path Offset | Unsigned 16-bit integer | Offset of alternative(8.3) Path that matched pathconsumed |
| smb.dfs.referral.flags.strip | Strip | Boolean | Should we strip off pathconsumed characters before submitting? |
| smb.dfs.referral.node | Node | String | Name of entity to visit next |
| smb.dfs.referral.node_offset | Node Offset | Unsigned 16-bit integer | Offset of name of entity to visit next |
| smb.dfs.referral.path | Path | String | Dfs Path that matched pathconsumed |
| smb.dfs.referral.path_offset | Path Offset | Unsigned 16-bit integer | Offset of Dfs Path that matched pathconsumed |
| smb.dfs.referral.proximity | Proximity | Unsigned 16-bit integer | Hint describing proximity of this server to the client |
| smb.dfs.referral.server.type | Server Type | Unsigned 16-bit integer | Type of referral server |
| smb.dfs.referral.size | Size | Unsigned 16-bit integer | Size of referral element |
| smb.dfs.referral.ttl | TTL | Unsigned 16-bit integer | Number of seconds the client can cache this referral |
| smb.dfs.referral.version | Version | Unsigned 16-bit integer | Version of referral element |
| smb.dialect.index | Selected Index | Unsigned 16-bit integer | Index of selected dialect |
| smb.dialect.name | Name | String | Name of dialect |
| smb.dir.count | Root Directory Count | Unsigned 32-bit integer | Directory Count |
| smb.dir_name | Directory | String | SMB Directory Name |
| smb.ea.error_offset | EA Error offset | Unsigned 32-bit integer | Offset into EA list if EA error |
| smb.ea.length | EA Length | Unsigned 32-bit integer | Total EA length for opened file |
| smb.ea_size | EA Size | Unsigned 32-bit integer | Size of file's EA information |
| smb.echo.count | Echo Count | Unsigned 16-bit integer | Number of times to echo data back |
| smb.echo.data | Echo Data | Byte array | Data for SMB Echo Request/Response |
| smb.echo.seq_num | Echo Seq Num | Unsigned 16-bit integer | Sequence number for this echo response |
| smb.encryption_key | Encryption Key | Byte array | Challenge/Response Encryption Key (for LM2.1 dialect) |
| smb.encryption_key_length | Key Length | Unsigned 16-bit integer | Encryption key length (must be 0 if not LM2.1 dialect) |
| smb.end_of_file | End Of File | Unsigned 64-bit integer | Offset to the first free byte in the file |
| smb.end_of_search | End Of Search | Unsigned 16-bit integer | Was last entry returned? |
| smb.error_class | Error Class | Unsigned 8-bit integer | DOS Error Class |
| smb.error_code | Error Code | Unsigned 16-bit integer | DOS Error Code |
| smb.ext_attr | Extended Attributes | Byte array | Extended Attributes |
| smb.ff2_loi | Level of Interest | Unsigned 16-bit integer | Level of interest for FIND_FIRST2 command |
| smb.fid | FID | Unsigned 16-bit integer | FID: File ID |
| smb.file | File Name | String | File Name |
| smb.file.count | Root File Count | Unsigned 32-bit integer | File Count |
| smb.file_attribute.archive | Archive | Boolean | ARCHIVE file attribute |
| smb.file_attribute.backup_semantics | Backup | Boolean | Does this object need/support backup semantics |
| smb.file_attribute.compressed | Compressed | Boolean | Is this file compressed? |
| smb.file_attribute.delete_on_close | Delete on Close | Boolean | Should this object be deleted on close? |
| smb.file_attribute.device | Device | Boolean | Is this file a device? |
| smb.file_attribute.directory | Directory | Boolean | DIRECTORY file attribute |
| smb.file_attribute.encrypted | Encrypted | Boolean | Is this file encrypted? |
| smb.file_attribute.hidden | Hidden | Boolean | HIDDEN file attribute |
| smb.file_attribute.no_buffering | No Buffering | Boolean | May the server buffer this object? |
| smb.file_attribute.normal | Normal | Boolean | Is this a normal file? |
| smb.file_attribute.not_content_indexed | Content Indexed | Boolean | May this file be indexed by the content indexing service |
| smb.file_attribute.offline | Offline | Boolean | Is this file offline? |
| smb.file_attribute.posix_semantics | Posix | Boolean | Does this object need/support POSIX semantics? |
| smb.file_attribute.random_access | Random Access | Boolean | Optimize for random access |
| smb.file_attribute.read_only | Read Only | Boolean | READ ONLY file attribute |
| smb.file_attribute.reparse | Reparse Point | Boolean | Does this file have an associated reparse point? |
| smb.file_attribute.sequential_scan | Sequential Scan | Boolean | Optimize for sequential scan |
| smb.file_attribute.sparse | Sparse | Boolean | Is this a sparse file? |
| smb.file_attribute.system | System | Boolean | SYSTEM file attribute |
| smb.file_attribute.temporary | Temporary | Boolean | Is this a temporary file? |
| smb.file_attribute.volume | Volume ID | Boolean | VOLUME file attribute |
| smb.file_attribute.write_through | Write Through | Boolean | Does this object need write through? |
| smb.file_data | File Data | Byte array | Data read/written to the file |
| smb.file_index | File Index | Unsigned 32-bit integer | File index |
| smb.file_name_len | File Name Len | Unsigned 32-bit integer | Length of File Name |
| smb.file_size | File Size | Unsigned 32-bit integer | File Size |
| smb.file_type | File Type | Unsigned 16-bit integer | Type of file |
| smb.files_moved | Files Moved | Unsigned 16-bit integer | Number of files moved |
| smb.find_first2.flags.backup | Backup Intent | Boolean | Find with backup intent |
| smb.find_first2.flags.close | Close | Boolean | Close search after this request |
| smb.find_first2.flags.continue | Continue | Boolean | Continue search from previous ending place |
| smb.find_first2.flags.eos | Close on EOS | Boolean | Close search if end of search reached |
| smb.find_first2.flags.resume | Resume | Boolean | Return resume keys for each entry found |
| smb.flags.canon | Canonicalized Pathnames | Boolean | Are pathnames canonicalized? |
| smb.flags.caseless | Case Sensitivity | Boolean | Are pathnames caseless or casesensitive? |
| smb.flags.lock | Lock and Read | Boolean | Are Lock&Read and Write&Unlock operations supported? |
| smb.flags.notify | Notify | Boolean | Notify on open or all? |
| smb.flags.oplock | Oplocks | Boolean | Is an oplock requested/granted? |
| smb.flags.receive_buffer | Receive Buffer Posted | Boolean | Have receive buffers been reported? |
| smb.flags.response | Request/Response | Boolean | Is this a request or a response? |
| smb.flags2.dfs | Dfs | Boolean | Can pathnames be resolved using Dfs? |
| smb.flags2.ea | Extended Attributes | Boolean | Are extended attributes supported? |
| smb.flags2.esn | Extended Security Negotiation | Boolean | Is extended security negotiation supported? |
| smb.flags2.long_names_allowed | Long Names Allowed | Boolean | Are long file names allowed in the response? |
| smb.flags2.long_names_used | Long Names Used | Boolean | Are pathnames in this request long file names? |
| smb.flags2.nt_error | Error Code Type | Boolean | Are error codes NT or DOS format? |
| smb.flags2.roe | Execute-only Reads | Boolean | Will reads be allowed for execute-only files? |
| smb.flags2.sec_sig | Security Signatures | Boolean | Are security signatures supported? |
| smb.flags2.string | Unicode Strings | Boolean | Are strings ASCII or Unicode? |
| smb.fn_loi | Level of Interest | Unsigned 16-bit integer | Level of interest for FIND_NOTIFY command |
| smb.forwarded_name | Forwarded Name | String | Recipient name being forwarded |
| smb.free_alloc_units | Free Units | Unsigned 64-bit integer | Number of free allocation units |
| smb.free_block.count | Free Block Count | Unsigned 32-bit integer | Free Block Count |
| smb.free_units | Free Units | Unsigned 16-bit integer | Number of free units at server |
| smb.fs_attr.cpn | Case Preserving | Boolean | Will this FS Preserve Name Case? |
| smb.fs_attr.css | Case Sensitive Search | Boolean | Does this FS support Case Sensitive Search? |
| smb.fs_attr.dim | Mounted | Boolean | Is this FS a Mounted Device? |
| smb.fs_attr.fc | Compression | Boolean | Does this FS support File Compression? |
| smb.fs_attr.pacls | Persistent ACLs | Boolean | Does this FS support Persistent ACLs? |
| smb.fs_attr.vic | Compressed | Boolean | Is this FS Compressed? |
| smb.fs_attr.vq | Volume Quotas | Boolean | Does this FS support Volume Quotas? |
| smb.fs_bytes_per_sector | Bytes per Sector | Unsigned 32-bit integer | Bytes per sector |
| smb.fs_id | FS Id | Unsigned 32-bit integer | File System ID (NT Server always returns 0) |
| smb.fs_max_name_len | Max name length | Unsigned 32-bit integer | Maximum length of each file name component in number of bytes |
| smb.fs_name | FS Name | String | Name of filesystem |
| smb.fs_name.len | Label Length | Unsigned 32-bit integer | Length of filesystem name in bytes |
| smb.fs_sector_per_unit | Sectors/Unit | Unsigned 32-bit integer | Sectors per allocation unit |
| smb.fs_units | Total Units | Unsigned 32-bit integer | Total number of units on this filesystem |
| smb.impersonation.level | Impersonation | Unsigned 32-bit integer | Impersonation level |
| smb.index_number | Index Number | Unsigned 64-bit integer | File system unique identifier |
| smb.ipc_state.endpoint | Endpoint | Unsigned 16-bit integer | Which end of the pipe this is |
| smb.ipc_state.icount | Icount | Unsigned 16-bit integer | Count to control pipe instancing |
| smb.ipc_state.nonblocking | Nonblocking | Boolean | Is I/O to this pipe nonblocking? |
| smb.ipc_state.pipe_type | Pipe Type | Unsigned 16-bit integer | What type of pipe this is |
| smb.ipc_state.read_mode | Read Mode | Unsigned 16-bit integer | How this pipe should be read |
| smb.is_directory | Is Directory | Unsigned 8-bit integer | Is this object a directory? |
| smb.last_name_offset | Last Name Offset | Unsigned 16-bit integer | If non-0 this is the offset into the datablock for the file name of the last entry |
| smb.last_write.smb.date | Last Write Date | Unsigned 16-bit integer | Last Write Date, SMB_DATE format |
| smb.last_write.smb.time | Last Write Time | Unsigned 16-bit integer | Last Write Time, SMB_TIME format |
| smb.last_write.time | Last Write | Date/Time stamp | Time this file was last written to |
| smb.link_count | Link Count | Unsigned 32-bit integer | Number of hard links to the file |
| smb.list_len | ListLength | Unsigned 32-bit integer | Length of the remaining data |
| smb.lock.length | Length | Unsigned 64-bit integer | Length of lock/unlock region |
| smb.lock.offset | Offset | Unsigned 64-bit integer | Offset in the file of lock/unlock region |
| smb.lock.type.cancel | Cancel | Boolean | Cancel outstanding lock requests? |
| smb.lock.type.change | Change | Boolean | Change type of lock? |
| smb.lock.type.large | Large Files | Boolean | Large file locking requested? |
| smb.lock.type.oplock_release | Oplock Break | Boolean | Is this a notification of, or a response to, an oplock break? |
| smb.lock.type.shared | Shared | Boolean | Shared or exclusive lock requested? |
| smb.locking.num_locks | Number of Locks | Unsigned 16-bit integer | Number of lock requests in this request |
| smb.locking.num_unlocks | Number of Unlocks | Unsigned 16-bit integer | Number of unlock requests in this request |
| smb.locking.oplock.level | Oplock Level | Unsigned 8-bit integer | Level of existing oplock at client (if any) |
| smb.loi | Level of Interest | Unsigned 16-bit integer | Level of interest for TRANSACTION[2] commands |
| smb.mac.access_control | Mac Access Control | Boolean | Are Mac Access Control Supported |
| smb.mac.desktop_db_calls | Desktop DB Calls | Boolean | Are Macintosh Desktop DB Calls Supported? |
| smb.mac.finderinfo | Finder Info | Byte array | Finder Info |
| smb.mac.get_set_comments | Get Set Comments | Boolean | Are Mac Get Set Comments supported? |
| smb.mac.streams_support | Mac Streams | Boolean | Are Mac Extensions and streams supported? |
| smb.mac.support.flags | Mac Support Flags | Unsigned 32-bit integer | Mac Support Flags |
| smb.mac.uids | Macintosh Unique IDs | Boolean | Are Unique IDs supported |
| smb.machine_name | Machine Name | String | Name of target machine |
| smb.max_buf | Max Buffer | Unsigned 16-bit integer | Max client buffer size |
| smb.max_bufsize | Max Buffer Size | Unsigned 32-bit integer | Maximum transmit buffer size |
| smb.max_mpx_count | Max Mpx Count | Unsigned 16-bit integer | Maximum pending multiplexed requests |
| smb.max_raw | Max Raw Buffer | Unsigned 32-bit integer | Maximum raw buffer size |
| smb.max_referral_level | Max Referral Level | Unsigned 16-bit integer | Latest referral version number understood |
| smb.max_vcs | Max VCs | Unsigned 16-bit integer | Maximum VCs between client and server |
| smb.maxcount | Max Count | Unsigned 16-bit integer | Maximum Count |
| smb.mdc | Max Data Count | Unsigned 32-bit integer | Maximum number of data bytes to return |
| smb.message | Message | String | Message text |
| smb.message.len | Message Len | Unsigned 16-bit integer | Length of message |
| smb.mgid | Message Group ID | Unsigned 16-bit integer | Message group ID for multi-block messages |
| smb.mid | Multiplex ID | Unsigned 16-bit integer | Multiplex ID |
| smb.mincount | Min Count | Unsigned 16-bit integer | Minimum Count |
| smb.modify.time | Modified | Date/Time stamp | Modification Time |
| smb.monitor_handle | Monitor Handle | Unsigned 16-bit integer | Handle for Find Notify operations |
| smb.move.flags.dir | Must be directory | Boolean | Must target be a directory? |
| smb.move.flags.file | Must be file | Boolean | Must target be a file? |
| smb.move.flags.verify | Verify writes | Boolean | Verify all writes? |
| smb.mpc | Max Parameter Count | Unsigned 32-bit integer | Maximum number of parameter bytes to return |
| smb.msc | Max Setup Count | Unsigned 8-bit integer | Maximum number of setup words to return |
| smb.native_fs | Native File System | String | Native File System |
| smb.native_lanman | Native LAN Manager | String | Which LANMAN protocol we are running |
| smb.native_os | Native OS | String | Which OS we are running |
| smb.next_entry_offset | Next Entry Offset | Unsigned 32-bit integer | Offset to next entry |
| smb.nt.create.batch_oplock | Batch Oplock | Boolean | Is a batch oplock requested? |
| smb.nt.create.dir | Create Directory | Boolean | Must target of open be a directory? |
| smb.nt.create.oplock | Exclusive Oplock | Boolean | Is an oplock requested |
| smb.nt.create_options.delete_on_close | Delete On Close | Boolean | Should the file be deleted when closed? |
| smb.nt.create_options.directory | Directory | Boolean | Should file being opened/created be a directory? |
| smb.nt.create_options.eight_dot_three_only | 8.3 Only | Boolean | Does the client understand only 8.3 filenames? |
| smb.nt.create_options.no_ea_knowledge | No EA Knowledge | Boolean | Does the client not understand extended attributes? |
| smb.nt.create_options.non_directory | Non-Directory | Boolean | Should file being opened/created be a non-directory? |
| smb.nt.create_options.random_access | Random Access | Boolean | Will the client be accessing the file randomly? |
| smb.nt.create_options.sequential_only | Sequential Only | Boolean | Will accees to thsis file only be sequential? |
| smb.nt.create_options.sync_io_alert | Sync I/O Alert | Boolean | All operations are performed synchronous |
| smb.nt.create_options.sync_io_nonalert | Sync I/O Nonalert | Boolean | All operations are synchronous and may block |
| smb.nt.create_options.write_through | Write Through | Boolean | Should writes to the file write buffered data out before completing? |
| smb.nt.function | Function | Unsigned 16-bit integer | Function for NT Transaction |
| smb.nt.ioctl.data | IOCTL Data | Byte array | Data for the IOCTL call |
| smb.nt.ioctl.flags.root_handle | Root Handle | Boolean | Apply to this share or root Dfs share |
| smb.nt.ioctl.function | Function | Unsigned 32-bit integer | NT IOCTL function code |
| smb.nt.ioctl.isfsctl | IsFSctl | Unsigned 8-bit integer | Is this a device IOCTL (FALSE) or FS Control (TRUE) |
| smb.nt.notify.action | Action | Unsigned 32-bit integer | Which action caused this notify response |
| smb.nt.notify.attributes | Attribute Change | Boolean | Notify on changes to attributes |
| smb.nt.notify.creation | Created Change | Boolean | Notify on changes to creation time |
| smb.nt.notify.dir_name | Directory Name Change | Boolean | Notify on changes to directory name |
| smb.nt.notify.ea | EA Change | Boolean | Notify on changes to Extended Attributes |
| smb.nt.notify.file_name | File Name Change | Boolean | Notify on changes to file name |
| smb.nt.notify.last_access | Last Access Change | Boolean | Notify on changes to last access |
| smb.nt.notify.last_write | Last Write Change | Boolean | Notify on changes to last write |
| smb.nt.notify.security | Security Change | Boolean | Notify on changes to security settings |
| smb.nt.notify.size | Size Change | Boolean | Notify on changes to size |
| smb.nt.notify.stream_name | Stream Name Change | Boolean | Notify on changes to stream name? |
| smb.nt.notify.stream_size | Stream Size Change | Boolean | Notify on changes of stream size |
| smb.nt.notify.stream_write | Stream Write | Boolean | Notify on stream write? |
| smb.nt.notify.watch_tree | Watch Tree | Unsigned 8-bit integer | Should Notify watch subdirectories also? |
| smb.nt_qsd.dacl | DACL | Boolean | Is DACL security informaton being queried? |
| smb.nt_qsd.group | Group | Boolean | Is group security informaton being queried? |
| smb.nt_qsd.owner | Owner | Boolean | Is owner security informaton being queried? |
| smb.nt_qsd.sacl | SACL | Boolean | Is SACL security informaton being queried? |
| smb.nt_status | NT Status | Unsigned 32-bit integer | NT Status code |
| smb.ntr_clu | Cluster count | Unsigned 32-bit integer | Number of clusters |
| smb.ntr_loi | Level of Interest | Unsigned 16-bit integer | NT Rename level |
| smb.offset | Offset | Unsigned 32-bit integer | Offset in file |
| smb.offset_high | High Offset | Unsigned 32-bit integer | High 32 Bits Of File Offset |
| smb.open.action.lock | Exclusive Open | Boolean | Is this file opened by another user? |
| smb.open.action.open | Open Action | Unsigned 16-bit integer | Open Action, how the file was opened |
| smb.open.flags.add_info | Additional Info | Boolean | Additional Information Requested? |
| smb.open.flags.batch_oplock | Batch Oplock | Boolean | Batch Oplock Requested? |
| smb.open.flags.ealen | Total EA Len | Boolean | Total EA Len Requested? |
| smb.open.flags.ex_oplock | Exclusive Oplock | Boolean | Exclusive Oplock Requested? |
| smb.open.function.create | Create | Boolean | Create file if it doesn't exist? |
| smb.open.function.open | Open | Unsigned 16-bit integer | Action to be taken on open if file exists |
| smb.oplock.level | Oplock level | Unsigned 8-bit integer | Level of oplock granted |
| smb.originator_name | Originator Name | String | Name of sender of message |
| smb.padding | Padding | Byte array | Padding or unknown data |
| smb.password | Password | Byte array | Password |
| smb.path | Path | String | Path. Server name and share name |
| smb.pc | Parameter Count | Unsigned 16-bit integer | Number of parameter bytes in this buffer |
| smb.pd | Parameter Displacement | Unsigned 16-bit integer | Displacement of these parameter bytes |
| smb.pid | Process ID | Unsigned 16-bit integer | Process ID |
| smb.po | Parameter Offset | Unsigned 16-bit integer | Offset (from header start) to parameters |
| smb.primary_domain | Primary Domain | String | The server's primary domain |
| smb.print.identifier | Identifier | String | Identifier string for this print job |
| smb.print.mode | Mode | Unsigned 16-bit integer | Text or Graphics mode |
| smb.print.queued.date | Queued | Date/Time stamp | Date when this entry was queued |
| smb.print.queued.smb.date | Queued Date | Unsigned 16-bit integer | Date when this print job was queued, SMB_DATE format |
| smb.print.queued.smb.time | Queued Time | Unsigned 16-bit integer | Time when this print job was queued, SMB_TIME format |
| smb.print.restart_index | Restart Index | Unsigned 16-bit integer | Index of entry after last returned |
| smb.print.setup.len | Setup Len | Unsigned 16-bit integer | Length of printer setup data |
| smb.print.spool.file_number | Spool File Number | Unsigned 16-bit integer | Spool File Number, assigned by the spooler |
| smb.print.spool.file_size | Spool File Size | Unsigned 32-bit integer | Number of bytes in spool file |
| smb.print.spool.name | Name | Byte array | Name of client that submitted this job |
| smb.print.start_index | Start Index | Unsigned 16-bit integer | First queue entry to return |
| smb.print.status | Status | Unsigned 8-bit integer | Status of this entry |
| smb.pwlen | Password Length | Unsigned 16-bit integer | Length of password |
| smb.qfi_loi | Level of Interest | Unsigned 16-bit integer | Level of interest for QUERY_FS_INFORMATION2 command |
| smb.quota.flags.deny_disk | Deny Disk | Boolean | Is the default quota limit enforced? |
| smb.quota.flags.enabled | Enabled | Boolean | Is quotas enabled of this FS? |
| smb.quota.flags.log_limit | Log Limit | Boolean | Should the server log an event when the limit is exceeded? |
| smb.quota.flags.log_warning | Log Warning | Boolean | Should the server log an event when the warning level is exceeded? |
| smb.quota.hard.default | (Hard) Quota Limit | Unsigned 64-bit integer | Hard Quota limit |
| smb.quota.soft.default | (Soft) Quota Treshold | Unsigned 64-bit integer | Soft Quota treshold |
| smb.quota.used | Quota Used | Unsigned 64-bit integer | How much Quota is used by this user |
| smb.quota.user.offset | Next Offset | Unsigned 32-bit integer | Relative offset to next user quota structure |
| smb.remaining | Remaining | Unsigned 32-bit integer | Remaining number of bytes |
| smb.request.mask | Request Mask | Unsigned 32-bit integer | Connectionless mode mask |
| smb.reserved | Reserved | Byte array | Reserved bytes, must be zero |
| smb.response.mask | Response Mask | Unsigned 32-bit integer | Connectionless mode mask |
| smb.response_in | Response in | Unsigned 32-bit integer | The response to this packet is in this packet |
| smb.response_to | Response to | Unsigned 32-bit integer | This packet is a response to the packet in this frame |
| smb.resume | Resume Key | Unsigned 32-bit integer | Resume Key |
| smb.resume.client.cookie | Client Cookie | Byte array | Cookie, must not be modified by the server |
| smb.resume.find_id | Find ID | Unsigned 8-bit integer | Handle for Find operation |
| smb.resume.key_len | Resume Key Length | Unsigned 16-bit integer | Resume Key length |
| smb.resume.server.cookie | Server Cookie | Byte array | Cookie, must not be modified by the client |
| smb.rfid | Root FID | Unsigned 32-bit integer | Open is relative to this FID (if nonzero) |
| smb.rm.read | Read Raw | Boolean | Is Read Raw supported? |
| smb.rm.write | Write Raw | Boolean | Is Write Raw supported? |
| smb.root.dir.count | Root Directory Count | Unsigned 32-bit integer | Root Directory Count |
| smb.root.file.count | Root File Count | Unsigned 32-bit integer | Root File Count |
| smb.sc | Setup Count | Unsigned 8-bit integer | Number of setup words in this buffer |
| smb.sd.length | SD Length | Unsigned 32-bit integer | Total length of security descriptor |
| smb.search.attribute.archive | Archive | Boolean | ARCHIVE search attribute |
| smb.search.attribute.directory | Directory | Boolean | DIRECTORY search attribute |
| smb.search.attribute.hidden | Hidden | Boolean | HIDDEN search attribute |
| smb.search.attribute.read_only | Read Only | Boolean | READ ONLY search attribute |
| smb.search.attribute.system | System | Boolean | SYSTEM search attribute |
| smb.search.attribute.volume | Volume ID | Boolean | VOLUME ID search attribute |
| smb.search_count | Search Count | Unsigned 16-bit integer | Maximum number of search entries to return |
| smb.search_pattern | Search Pattern | String | Search Pattern |
| smb.sec_desc.revision | Revision | Unsigned 16-bit integer | Version of NT Security Descriptor structure |
| smb.sec_desc.type.dacl_auto_inherit_req | DACL Auto Inherit Required | Boolean | Does this SecDesc have DACL Auto Inherit Required set? |
| smb.sec_desc.type.dacl_auto_inherited | DACL Auto Inherited | Boolean | Is this DACL auto inherited |
| smb.sec_desc.type.dacl_defaulted | DACL Defaulted | Boolean | Does this SecDesc have DACL Defaulted? |
| smb.sec_desc.type.dacl_present | DACL Present | Boolean | Does this SecDesc have DACL present? |
| smb.sec_desc.type.dacl_protected | DACL Protected | Boolean | Is the DACL structure protected? |
| smb.sec_desc.type.group_defaulted | Group Defaulted | Boolean | Is Group Defaulted? |
| smb.sec_desc.type.owner_defaulted | Owner Defaulted | Boolean | Is Owner Defaulted set? |
| smb.sec_desc.type.sacl_auto_inherit_req | SACL Auto Inherit Required | Boolean | Does this SecDesc have SACL Auto Inherit Required set? |
| smb.sec_desc.type.sacl_auto_inherited | SACL Auto Inherited | Boolean | Is this SACL auto inherited |
| smb.sec_desc.type.sacl_defaulted | SACL Defaulted | Boolean | Does this SecDesc have SACL Defaulted? |
| smb.sec_desc.type.sacl_present | SACL Present | Boolean | Is the SACL present? |
| smb.sec_desc.type.sacl_protected | SACL Protected | Boolean | Is the SACL structure protected? |
| smb.sec_desc.type.self_relative | Self Relative | Boolean | Is this SecDesc self relative? |
| smb.sec_desc_len | NT Security Descriptor Length | Unsigned 32-bit integer | Security Descriptor Length |
| smb.security.flags.context_tracking | Context Tracking | Boolean | Is security tracking static or dynamic? |
| smb.security.flags.effective_only | Effective Only | Boolean | Are only enabled or all aspects uf the users SID available? |
| smb.security_blob | Security Blob | Byte array | Security blob |
| smb.security_blob_len | Security Blob Length | Unsigned 16-bit integer | Security blob length |
| smb.seek_mode | Seek Mode | Unsigned 16-bit integer | Seek Mode, what type of seek |
| smb.segment | SMB Segment | No value | SMB Segment |
| smb.segment.error | Defragmentation error | No value | Defragmentation error due to illegal fragments |
| smb.segment.multipletails | Multiple tail fragments found | Boolean | Several tails were found when defragmenting the packet |
| smb.segment.overlap | Fragment overlap | Boolean | Fragment overlaps with other fragments |
| smb.segment.overlap.conflict | Conflicting data in fragment overlap | Boolean | Overlapping fragments contained conflicting data |
| smb.segment.segments | SMB Segments | No value | SMB Segments |
| smb.segment.toolongfragment | Fragment too long | Boolean | Fragment contained data past end of packet |
| smb.server | Server | String | The name of the DC/server |
| smb.server_cap.bulk_transfer | Bulk Transfer | Boolean | Are Bulk Read and Bulk Write supported? |
| smb.server_cap.compressed_data | Compressed Data | Boolean | Is compressed data transfer supported? |
| smb.server_cap.dfs | Dfs | Boolean | Is Dfs supported? |
| smb.server_cap.extended_security | Extended Security | Boolean | Are Extended security exchanges supported? |
| smb.server_cap.infolevel_passthru | Infolevel Passthru | Boolean | Is NT information level request passthrough supported? |
| smb.server_cap.large_files | Large Files | Boolean | Are large files (>4GB) supported? |
| smb.server_cap.large_readx | Large ReadX | Boolean | Is Large Read andX supported? |
| smb.server_cap.large_writex | Large WriteX | Boolean | Is Large Write andX supported? |
| smb.server_cap.level_2_oplocks | Level 2 Oplocks | Boolean | Are Level 2 oplocks supported? |
| smb.server_cap.lock_and_read | Lock and Read | Boolean | Is Lock and Read supported? |
| smb.server_cap.mpx_mode | MPX Mode | Boolean | Are Read Mpx and Write Mpx supported? |
| smb.server_cap.nt_find | NT Find | Boolean | Is NT Find supported? |
| smb.server_cap.nt_smbs | NT SMBs | Boolean | Are NT SMBs supported? |
| smb.server_cap.nt_status | NT Status Codes | Boolean | Are NT Status Codes supported? |
| smb.server_cap.raw_mode | Raw Mode | Boolean | Are Raw Read and Raw Write supported? |
| smb.server_cap.reserved | Reserved | Boolean | RESERVED |
| smb.server_cap.rpc_remote_apis | RPC Remote APIs | Boolean | Are RPC Remote APIs supported? |
| smb.server_cap.unicode | Unicode | Boolean | Are Unicode strings supported? |
| smb.server_cap.unix | UNIX | Boolean | Are UNIX extensions supported? |
| smb.server_date_time | Server Date and Time | Date/Time stamp | Current date and time at server |
| smb.server_date_time.smb_date | Server Date | Unsigned 16-bit integer | Current date at server, SMB_DATE format |
| smb.server_date_time.smb_time | Server Time | Unsigned 16-bit integer | Current time at server, SMB_TIME format |
| smb.server_fid | Server FID | Unsigned 32-bit integer | Server unique File ID |
| smb.server_guid | Server GUID | Byte array | Globally unique identifier for this server |
| smb.server_timezone | Time Zone | Signed 16-bit integer | Current timezone at server. |
| smb.service | Service | String | Service name |
| smb.session_key | Session Key | Unsigned 32-bit integer | Unique token identifying this session |
| smb.setup.action.guest | Guest | Boolean | Client logged in as GUEST? |
| smb.share.access.delete | Delete | Boolean | |
| smb.share.access.read | Read | Boolean | Can the object be shared for reading? |
| smb.share.access.write | Write | Boolean | Can the object be shared for write? |
| smb.short_file | Short File Name | String | Short (8.3) File Name |
| smb.short_file_name_len | Short File Name Len | Unsigned 32-bit integer | Length of Short (8.3) File Name |
| smb.sid | SID | Unsigned 16-bit integer | SID: Search ID, handle for find operations |
| smb.sid.num_auth | Num Auth | Unsigned 8-bit integer | Number of authorities for this SID |
| smb.sid.revision | Revision | Unsigned 8-bit integer | Version of SID structure |
| smb.sm.mode | Mode | Boolean | User or Share security mode? |
| smb.sm.password | Password | Boolean | Encrypted or plaintext passwords? |
| smb.sm.sig_required | Sig Req | Boolean | Are security signatures required? |
| smb.sm.signatures | Signatures | Boolean | Are security signatures enabled? |
| smb.storage_type | Storage Type | Unsigned 32-bit integer | Type of storage |
| smb.stream_name | Stream Name | String | Name of the stream |
| smb.stream_name_len | Stream Name Length | Unsigned 32-bit integer | Length of stream name |
| smb.stream_size | Stream Size | Unsigned 64-bit integer | Size of the stream in number of bytes |
| smb.system.time | System Time | Date/Time stamp | System Time |
| smb.tdc | Total Data Count | Unsigned 32-bit integer | Total number of data bytes |
| smb.tid | Tree ID | Unsigned 16-bit integer | Tree ID |
| smb.time | Time from request | Time duration | Time between Request and Response for SMB cmds |
| smb.timeout | Timeout | Unsigned 32-bit integer | Timeout in miliseconds |
| smb.total_data_len | Total Data Length | Unsigned 16-bit integer | Total length of data |
| smb.tpc | Total Parameter Count | Unsigned 32-bit integer | Total number of parameter bytes |
| smb.trans2.cmd | Subcommand | Unsigned 16-bit integer | Subcommand for TRANSACTION2 |
| smb.trans_name | Transaction Name | String | Name of transaction |
| smb.transaction.flags.dtid | Disconnect TID | Boolean | Disconnect TID? |
| smb.transaction.flags.owt | One Way Transaction | Boolean | One Way Transaction (no response)? |
| smb.uid | User ID | Unsigned 16-bit integer | User ID |
| smb.unicode_password | Unicode Password | Byte array | Unicode Password |
| smb.unicode_pwlen | Unicode Password Length | Unsigned 16-bit integer | Length of Unicode password |
| smb.units | Total Units | Unsigned 16-bit integer | Total number of units at server |
| smb.unknown | Unknown Data | Byte array | Unknown Data. Should be implemented by someone |
| smb.vc | VC Number | Unsigned 16-bit integer | VC Number |
| smb.volume.label | Label | String | Volume label |
| smb.volume.label.len | Label Length | Unsigned 32-bit integer | Length of volume label |
| smb.volume.serial | Volume Serial Number | Unsigned 32-bit integer | Volume serial number |
| smb.wct | Word Count (WCT) | Unsigned 8-bit integer | Word Count, count of parameter words |
| smb.write.mode.connectionless | Connectionless | Boolean | Connectionless mode requested? |
| smb.write.mode.message_start | Message Start | Boolean | Is this the start of a message? |
| smb.write.mode.raw | Write Raw | Boolean | Use WriteRawNamedPipe? |
| smb.write.mode.return_remaining | Return Remaining | Boolean | Return remaining data responses? |
| smb.write.mode.write_through | Write Through | Boolean | Write through mode requested? |