Share via

2.2.7.4.1 Request

  • Article

The NT_TRANSACT_NOTIFY_CHANGE request and response formats are special cases of SMB_COM_NT_TRANSACT (section 2.2.4.62) SMB. Only the NT_TRANSACT_NOTIFY_CHANGE request specifics are described here.

 Setup
   {
   ULONG   CompletionFilter;
   USHORT  FID;
   BOOLEAN WatchTree;
   UCHAR   Reserved;
   }
 

SMB_Parameters:

WordCount (1 byte): This field MUST be 0x17.

Words (46 bytes): Array of USHORT.

MaxSetupCount (1 byte): This field MUST be 0x00.

MaxDataCount (4 bytes): This field MUST be 0x00000000.

Function (2 bytes): This field MUST be NT_TRANSACT_NOTIFY_CHANGE (0x0004).

SetupCount (1 byte): This field MUST be 04, indicating that 4 words (8 bytes) are used for Setup information.


0


1


2


3


4


5


6


7


8


9

1
0


1


2


3


4


5


6


7


8


9

2
0


1


2


3


4


5


6


7


8


9

3
0


1

Setup

...

Setup (8 bytes):


0


1


2


3


4


5


6


7


8


9

1
0


1


2


3


4


5


6


7


8


9

2
0


1


2


3


4


5


6


7


8


9

3
0


1

CompletionFilter

FID

WatchTree

Reserved

CompletionFilter (4 bytes): A 32-bit field of flags that specify the types of operations to monitor.

Name

Value

FILE_NOTIFY_CHANGE_FILE_NAME

0x00000001

FILE_NOTIFY_CHANGE_DIR_NAME

0x00000002

FILE_NOTIFY_CHANGE_NAME

0x00000003

FILE_NOTIFY_CHANGE_ATTRIBUTES

0x00000004

FILE_NOTIFY_CHANGE_SIZE

0x00000008

FILE_NOTIFY_CHANGE_LAST_WRITE

0x00000010

FILE_NOTIFY_CHANGE_LAST_ACCESS

0x00000020

FILE_NOTIFY_CHANGE_CREATION

0x00000040

FILE_NOTIFY_CHANGE_EA

0x00000080

FILE_NOTIFY_CHANGE_SECURITY

0x00000100

FILE_NOTIFY_CHANGE_STREAM_NAME

0x00000200

FILE_NOTIFY_CHANGE_STREAM_SIZE

0x00000400

FILE_NOTIFY_CHANGE_STREAM_WRITE

0x00000800

FID (2 bytes): The FID of the directory to monitor.

WatchTree (1 byte): If all subdirectories are to be watched, then this field MUST be set to TRUE; otherwise, it MUST be set to FALSE.

Reserved (1 byte): Reserved. This value MUST be 0x00.

NT_Trans_Parameters

The client does not provide any NT_Trans_Parameters in the request.

NT_Trans_Data

The client does not provide any NT_Trans_Data in the request.