4.5 Domain-Based DFS Root Referral Packet Trace

The following figure shows the network packet trace of a domain-based DFS root referral request. The REQ_DFS_GET_REFERRAL structure is at offset 0x7E in the hexadecimal dump shown. MaxReferralLevel field is at offset 0x7E (=3) and RequestFileName is at offset 0x80 (=\dfsn-dev\testroot1).

Figure 19: REQ_DFS_GET_REFERRAL packet trace

The following figure shows the network packet dump of a domain-based DFS root referral response. The referral response consists of the DFS referral header, RESP_GET_DFS_REFERRAL at offset 0x72 in the hexadecimal dump. The PathConsumed field is at offset 0x72 (=0x26) and the NumberOfReferrals field is at offset 0x74 (=2). The first referral entry, of type DFS_REFERRAL_V3, starts at 0x7A and the second referral entry, also of type DFS_REFERRAL_V3, starts at offset 0x9C. The referral header and the first referral entry have been marked in the hexadecimal dump for identification purposes. The hexadecimal dump shows that the two referral entries immediately follow one another and all the strings referenced in the referral entries are at the end of all the referral entries, starting at offset 0xBE in the hexadecimal dump.

The NetworkAddressOffset field of the first referral entry, containing the offset of the DFS root target from the start of the referral entry, is at offset 0x8A. It contains 0x94. The first referral entry is at offset 0x7A. Hence, the DFS root target that corresponds to the first referral entry is at offset 0x7A+0x94=0x10E. The null-terminated Unicode string at offset 0x10E in the hexadecimal dump is \cfs-41x-2c03\testroot1, one of the DFS root targets of the domain-based DFS namespace \\dfsn-dev\testroot1.

Figure 20: RESP_GET_DFS_REFERRAL packet trace