| Field name | Type | Description | Versions |
|---|---|---|---|
| smb2.acct | String | Account | 0.10.14 to 0.99.0 |
| smb2.allocation_size | Unsigned 64-bit integer | Allocation Size | 0.10.14 to 0.99.0 |
| smb2.auth_frame | Unsigned 32-bit integer | Authenticated in Frame | 0.10.14 to 0.99.0 |
| smb2.birth_object_id | Unknown | BirthObjectId | 0.10.14 to 0.99.0 |
| smb2.birth_volume_id | Unknown | BirthVolumeId | 0.10.14 to 0.99.0 |
| smb2.boot_time | Date/Time stamp | Boot Time | 0.10.14 to 0.99.0 |
| smb2.buffer_code.dynamic | Boolean | Dynamic Part | 0.10.14 to 0.99.0 |
| smb2.buffer_code.length | Unsigned 16-bit integer | Length | 0.10.14 to 0.99.0 |
| smb2.class | Unsigned 8-bit integer | Class | 0.10.14 to 0.99.0 |
| smb2.close.flags | Unsigned 16-bit integer | Close Flags | 0.10.14 to 0.99.0 |
| smb2.cmd | Unsigned 16-bit integer | Command | 0.10.14 to 0.99.0 |
| smb2.compression_format | Unsigned 16-bit integer | Compression Format | 0.10.14 to 0.99.0 |
| smb2.create.action | Unsigned 32-bit integer | Create Action | 0.10.14 to 0.99.0 |
| smb2.create.chain_data | None | Data | 0.10.14 to 0.99.0 |
| smb2.create.chain_offset | Unsigned 32-bit integer | Chain Offset | 0.10.14 to 0.99.0 |
| smb2.create.data_length | Unsigned 32-bit integer | Data Length | 0.10.14 to 0.99.0 |
| smb2.create.disposition | Unsigned 32-bit integer | Disposition | 0.10.14 to 0.99.0 |
| smb2.create.extrainfo | None | ExtraInfo | 0.10.14 to 0.99.0 |
| smb2.create.flags | Unsigned 16-bit integer | Create Flags | 0.10.14 to 0.99.0 |
| smb2.create.time | Date/Time stamp | Create | 0.10.14 to 0.99.0 |
| smb2.create_flags.grant_exclusive_oplock | Boolean | Grant Exclusive Oplock | 0.10.14 to 0.99.0 |
| smb2.create_flags.grant_oplock | Boolean | Grant Oplock | 0.10.14 to 0.99.0 |
| smb2.create_flags.request_exclusive_oplock | Boolean | Request Exclusive Oplock | 0.10.14 to 0.99.0 |
| smb2.create_flags.request_oplock | Boolean | Request Oplock | 0.10.14 to 0.99.0 |
| smb2.current_time | Date/Time stamp | Current Time | 0.10.14 to 0.99.0 |
| smb2.data_offset | Unsigned 16-bit integer | Data Offset | 0.10.14 to 0.99.0 |
| smb2.delete_pending | Unsigned 8-bit integer | Delete Pending | 0.10.14 to 0.99.0 |
| smb2.disposition.delete_on_close | Boolean | Delete on close | 0.10.14 to 0.99.0 |
| smb2.domain | String | Domain | 0.10.14 to 0.99.0 |
| smb2.domain_id | Unknown | DomainId | 0.10.14 to 0.99.0 |
| smb2.ea.data | String | EA Data | 0.10.14 to 0.99.0 |
| smb2.ea.data_len | Unsigned 8-bit integer | EA Data Length | 0.10.14 to 0.99.0 |
| smb2.ea.flags | Unsigned 8-bit integer | EA Flags | 0.10.14 to 0.99.0 |
| smb2.ea.name | String | EA Name | 0.10.14 to 0.99.0 |
| smb2.ea.name_len | Unsigned 8-bit integer | EA Name Length | 0.10.14 to 0.99.0 |
| smb2.ea_size | Unsigned 32-bit integer | EA Size | 0.10.14 to 0.99.0 |
| smb2.eof | Unsigned 64-bit integer | End Of File | 0.10.14 to 0.99.0 |
| smb2.fid | Unknown | File Id | 0.10.14 to 0.99.0 |
| smb2.file_id | Unsigned 64-bit integer | File Id | 0.10.14 to 0.99.0 |
| smb2.file_info.infolevel | Unsigned 8-bit integer | InfoLevel | 0.99.0 |
| smb2.FILE_OBJECTID_BUFFER | None | FILE_OBJECTID_BUFFER | 0.10.14 to 0.99.0 |
| smb2.filename | String | Filename | 0.10.14 to 0.99.0 |
| smb2.filename.len | Unsigned 16-bit integer | Filename Length | 0.10.14 to 0.99.0 |
| smb2.find.response_size | Unsigned 32-bit integer | Size of Find Data | 0.10.14 to 0.99.0 |
| smb2.flags.pid_valid | Boolean | PID Valid | 0.99.0 |
| smb2.flags.response | Boolean | Response | 0.10.14 to 0.99.0 |
| smb2.flags.signature | Boolean | Signing | 0.99.0 |
| smb2.fs_info.infolevel | Unsigned 8-bit integer | InfoLevel | 0.99.0 |
| smb2.header_len | Unsigned 16-bit integer | Header Length | 0.10.14 to 0.99.0 |
| smb2.host | String | Host | 0.10.14 to 0.99.0 |
| smb2.impersonation.level | Unsigned 32-bit integer | Impersonation | 0.10.14 to 0.99.0 |
| smb2.infolevel | Unsigned 8-bit integer | InfoLevel | 0.10.14 to 0.99.0 |
| smb2.ioctl.function | Unsigned 32-bit integer | Function | 0.10.14 to 0.99.0 |
| smb2.ioctl.function.access | Unsigned 32-bit integer | Access | 0.10.14 to 0.99.0 |
| smb2.ioctl.function.device | Unsigned 32-bit integer | Device | 0.10.14 to 0.99.0 |
| smb2.ioctl.function.function | Unsigned 32-bit integer | Function | 0.10.14 to 0.99.0 |
| smb2.ioctl.function.method | Unsigned 32-bit integer | Method | 0.10.14 to 0.99.0 |
| smb2.ioctl.in | None | In Data | 0.10.14 to 0.99.0 |
| smb2.ioctl.out | None | Out Data | 0.10.14 to 0.99.0 |
| smb2.ioctl.shadow_copy.count | Unsigned 32-bit integer | Count | 0.10.14 to 0.99.0 |
| smb2.ioctl.shadow_copy.label | String | Label | 0.10.14 to 0.99.0 |
| smb2.ioctl.shadow_copy.num_labels | Unsigned 32-bit integer | Num Labels | 0.10.14 to 0.99.0 |
| smb2.ioctl.shadow_copy.num_volumes | Unsigned 32-bit integer | Num Volumes | 0.10.14 to 0.99.0 |
| smb2.is_directory | Unsigned 8-bit integer | Is Directory | 0.10.14 to 0.99.0 |
| smb2.last_access.time | Date/Time stamp | Last Access | 0.10.14 to 0.99.0 |
| smb2.last_change.time | Date/Time stamp | Last Change | 0.10.14 to 0.99.0 |
| smb2.last_write.time | Date/Time stamp | Last Write | 0.10.14 to 0.99.0 |
| smb2.max_ioctl_out_size | Unsigned 32-bit integer | Max Ioctl Out Size | 0.10.14 to 0.99.0 |
| smb2.max_response_size | Unsigned 32-bit integer | Max Response Size | 0.10.14 to 0.99.0 |
| smb2.next_offset | Unsigned 32-bit integer | Next Offset | 0.10.14 to 0.99.0 |
| smb2.nlinks | Unsigned 32-bit integer | Number of Links | 0.10.14 to 0.99.0 |
| smb2.nt_status | Unsigned 32-bit integer | NT Status | 0.10.14 to 0.99.0 |
| smb2.object_id | Unknown | ObjectId | 0.10.14 to 0.99.0 |
| smb2.olb.length | Unsigned 32-bit integer | Length | 0.10.14 to 0.99.0 |
| smb2.olb.offset | Unsigned 32-bit integer | Offset | 0.10.14 to 0.99.0 |
| smb2.pid | Unsigned 32-bit integer | Process Id | 0.10.14 to 0.99.0 |
| smb2.read_data | Byte array | Read Data | 0.10.14 to 0.99.0 |
| smb2.read_length | Unsigned 32-bit integer | Read Length | 0.10.14 to 0.99.0 |
| smb2.read_offset | Unsigned 64-bit integer | Read Offset | 0.10.14 to 0.99.0 |
| smb2.required_size | Unsigned 32-bit integer | Required Buffer Size | 0.10.14 to 0.99.0 |
| smb2.response_buffer_offset | Unsigned 16-bit integer | Response Buffer Offset | 0.10.14 to 0.99.0 |
| smb2.response_in | Frame number | Response in | 0.10.14 to 0.99.0 |
| smb2.response_size | Unsigned 32-bit integer | Response Size | 0.10.14 to 0.99.0 |
| smb2.response_to | Frame number | Response to | 0.10.14 to 0.99.0 |
| smb2.search | String | Search Pattern | 0.10.14 to 0.99.0 |
| smb2.sec_info.infolevel | Unsigned 8-bit integer | InfoLevel | 0.99.0 |
| smb2.security_blob | Byte array | Security Blob | 0.10.14 to 0.99.0 |
| smb2.security_blob_len | Unsigned 16-bit integer | Security Blob Length | 0.10.14 to 0.99.0 |
| smb2.security_blob_offset | Unsigned 16-bit integer | Security Blob Offset | 0.10.14 to 0.99.0 |
| smb2.seq_num | Signed 64-bit integer | Command Sequence Number | 0.10.14 to 0.99.0 |
| smb2.server_guid | Unknown | Server Guid | 0.10.14 to 0.99.0 |
| smb2.setinfo_offset | Unsigned 16-bit integer | Setinfo Offset | 0.10.14 to 0.99.0 |
| smb2.setinfo_size | Unsigned 32-bit integer | Setinfo Size | 0.10.14 to 0.99.0 |
| smb2.share_type | Unsigned 16-bit integer | Share Type | 0.10.14 to 0.99.0 |
| smb2.signature | Byte array | Signature | 0.99.0 |
| smb2.smb2_file_access_info | None | SMB2_FILE_ACCESS_INFO | 0.10.14 to 0.99.0 |
| smb2.smb2_file_alignment_info | None | SMB2_FILE_ALIGNMENT_INFO | 0.10.14 to 0.99.0 |
| smb2.smb2_file_all_info | None | SMB2_FILE_ALL_INFO | 0.10.14 to 0.99.0 |
| smb2.smb2_file_allocation_info | None | SMB2_FILE_ALLOCATION_INFO | 0.10.14 to 0.99.0 |
| smb2.smb2_file_alternate_name_info | None | SMB2_FILE_ALTERNATE_NAME_INFO | 0.10.14 to 0.99.0 |
| smb2.smb2_file_attribute_tag_info | None | SMB2_FILE_ATTRIBUTE_TAG_INFO | 0.10.14 to 0.99.0 |
| smb2.smb2_file_basic_info | None | SMB2_FILE_BASIC_INFO | 0.10.14 to 0.99.0 |
| smb2.smb2_file_compression_info | None | SMB2_FILE_COMPRESSION_INFO | 0.10.14 to 0.99.0 |
| smb2.smb2_file_disposition_info | None | SMB2_FILE_DISPOSITION_INFO | 0.10.14 to 0.99.0 |
| smb2.smb2_file_ea_info | None | SMB2_FILE_EA_INFO | 0.10.14 to 0.99.0 |
| smb2.smb2_file_endoffile_info | None | SMB2_FILE_ENDOFFILE_INFO | 0.10.14 to 0.99.0 |
| smb2.smb2_file_info_0f | None | SMB2_FILE_INFO_0f | 0.10.14 to 0.99.0 |
| smb2.smb2_file_internal_info | None | SMB2_FILE_INTERNAL_INFO | 0.10.14 to 0.99.0 |
| smb2.smb2_file_mode_info | None | SMB2_FILE_MODE_INFO | 0.10.14 to 0.99.0 |
| smb2.smb2_file_network_open_info | None | SMB2_FILE_NETWORK_OPEN_INFO | 0.10.14 to 0.99.0 |
| smb2.smb2_file_pipe_info | None | SMB2_FILE_PIPE_INFO | 0.99.0 |
| smb2.smb2_file_position_info | None | SMB2_FILE_POSITION_INFO | 0.10.14 to 0.99.0 |
| smb2.smb2_file_rename_info | None | SMB2_FILE_RENAME_INFO | 0.10.14 to 0.99.0 |
| smb2.smb2_file_standard_info | None | SMB2_FILE_STANDARD_INFO | 0.10.14 to 0.99.0 |
| smb2.smb2_file_stream_info | None | SMB2_FILE_STREAM_INFO | 0.10.14 to 0.99.0 |
| smb2.smb2_fs_info_01 | None | SMB2_FS_INFO_01 | 0.10.14 to 0.99.0 |
| smb2.smb2_fs_info_03 | None | SMB2_FS_INFO_03 | 0.10.14 to 0.99.0 |
| smb2.smb2_fs_info_04 | None | SMB2_FS_INFO_04 | 0.10.14 to 0.99.0 |
| smb2.smb2_fs_info_05 | None | SMB2_FS_INFO_05 | 0.10.14 to 0.99.0 |
| smb2.smb2_fs_info_06 | None | SMB2_FS_INFO_06 | 0.10.14 to 0.99.0 |
| smb2.smb2_fs_info_07 | None | SMB2_FS_INFO_07 | 0.10.14 to 0.99.0 |
| smb2.smb2_fs_objectid_info | None | SMB2_FS_OBJECTID_INFO | 0.10.14 to 0.99.0 |
| smb2.smb2_sec_info_00 | None | SMB2_SEC_INFO_00 | 0.10.14 to 0.99.0 |
| smb2.tag | String | Tag | 0.10.14 to 0.99.0 |
| smb2.tcon_frame | Unsigned 32-bit integer | Connected in Frame | 0.99.0 |
| smb2.tid | Unsigned 32-bit integer | Tree Id | 0.10.14 to 0.99.0 |
| smb2.time | Time duration | Time from request | 0.10.14 to 0.99.0 |
| smb2.tree | String | Tree | 0.10.14 to 0.99.0 |
| smb2.uid | Unsigned 64-bit integer | User Id | 0.10.14 to 0.99.0 |
| smb2.unknown | Byte array | unknown | 0.10.14 to 0.99.0 |
| smb2.unknown.timestamp | Date/Time stamp | Timestamp | 0.10.14 to 0.99.0 |
| smb2.write_data | Byte array | Write Data | 0.10.14 to 0.99.0 |
| smb2.write_length | Unsigned 32-bit integer | Write Length | 0.10.14 to 0.99.0 |
| smb2.write_offset | Unsigned 64-bit integer | Write Offset | 0.10.14 to 0.99.0 |