Handling a DFS Referral Information Request

When the server receives a request with an SMB2 header with a Command value equal to SMB2 IOCTL, and a CtlCode of FSCTL_DFS_GET_REFERRALS or FSCTL_DFS_GET_REFERRALS_EX, message handling proceeds as follows:

If IsDfsCapable is set to FALSE, the server MUST return STATUS_FS_DRIVER_REQUIRED to the client.

The server MUST invoke the event as specified in [MS-DFSC] section and pass the following:

  • The IP address of the client.

  • The buffer containing the DFS referral request packet.

  • IsExtendedReferral: Set to TRUE when CtlCode is FSCTL_DFS_GET_REFERRALS_EX.

  • The maximum size of the response data buffer that will be accepted by the client, as indicated by MaxOutputResponse field in the request.

If DFS returns a failure, the server MUST fail the request with the error code received from DFS. If the error returned from DFS is STATUS_BUFFER_OVERFLOW, the server SHOULD<320> copy the data returned by DFS into a normal FSCTL_GET_DFS_REFERRALS response and return STATUS_BUFFER_OVERFLOW to the client as noted in sections and

If DFS returns success and a response buffer containing the referrals, the server MUST then construct an SMB2 IOCTL response following the syntax specified in section 2.2.32, with the following values:

  • CtlCode MUST be set to the CtrlCode in the request.


  • InputOffset SHOULD be set to the offset, in bytes, from the beginning of the SMB2 header to the Buffer[] field of the response.

  • InputCount SHOULD be set to zero.

  • OutputOffset MUST be set to InputOffset + InputCount, rounded up to a multiple of 8.

  • OutputCount MUST be set to the number of bytes received from DFS.

  • Flags MUST be set to zero.

  • The server MUST copy the buffer that was received from DFS into the Buffer field at the OutputOffset computed above.

The response MUST be sent to the client.