CIFS Packet Formats
The format of a CIFS client request or server response packet depends on the CIFS command code in the packet header that is common to all CIFS packets.
If the command code is an SMB request (for example SMB_COM_FIND_CLOSE2), the data portion follows immediately on the packet header, the first data portion field, WordCount, being the same field as WordCount in the packet header SMB_Header.
If the command code is a transaction request (for example NT_TRANSACT_NOTIFY_CHANGE or SMB_COM_TRANSACTION2), the transaction request or response may span multiple packets if it is larger than the available buffer size. Each packet includes the CIFS packet header, a transaction subheader, and a data portion.