4.6 Writing to a Remote File

The following diagram demonstrates the steps taken to open a remote file, write to it, and close it. Assume that this sequence starts on a connection where the session and tree connect have been established as described in previous sections, and messages have been exchanged such that the current MessageId is 30. Let us assume TreeId is set to 0x1 and SessionId is set to 0x40000000015 for all requests and responses listed below.

Writing to a remote file

Figure 11: Writing to a remote file

  1. The client sends an SMB2 CREATE Request for the file "test.dat".

     Smb2: C CREATE test.dat
     SMB2Header: 
     Size: 64 (0x40)
     CreditCharge: 0 (0x0)
     Status: STATUS_SUCCESS
     Command: CREATE
     Credits: 111 (0x6F)
     Flags: 0 (0x0)
     ServerToRedir: ...............................0 Client to Server
     AsyncCommand:  ..............................0.  Command is not asynchronous
     Related:       .............................0..  Packet is single message
     Signed:        ............................0...  Packet not signed
     Reserved: 0 (0x0)
     DFS:           0...............................  Command is not a DFS Operation
     NextCommand: 0 (0x0)
     MessageId: 10 (0xA)
     Reserved: 0 (0x0)
     TreeId: 1 (0x1)
     SessionId: 4398046511125 (0x40000000015)
     CCreate: 
     Size: 57 (0x39)
     SecurityFlags: 0 (0x0)
     RequestedOplockLevel: 9 (0x9)
     ImpersonationLevel: 2 (0x2)
     SmbCreateFlags: 0 (0x0)
     Reserved: 0 (0x0)
     DesiredAccess: 0x00130197
     read:        (...............................1) Read Data
     write:       (..............................1.) Write Data
     append:      (.............................1..) Append Data
     readEA:      (............................0...) No Read EA
     writeEA:     (...........................1....) Write EA
     FileExecute: (..........................0.....) No File Execute
     FileDeleted: (.........................0......) No File Delete
     FileRead:    (........................1.......) File Read Attributes
     FileWrite:   (.......................1........) File Write Attributes
     FileAttributes: 0x00000020
     ReadOnly:    (...............................0) Read/Write
     Hidden:      (..............................0.) Not Hidden
     System:      (.............................0..) Not System
     Reserverd3: 0 (0x0)
     Directory:   (...........................0....) File
     Archive:     (..........................1.....) Archive
     Device:      (.........................0......) Not Device
     Normal:      (........................0.......) Not Normal
     Temporary:   (.......................0........) Permanent
     Sparse:      (......................0.........) Not Sparse
     Reparse:     (.....................0..........) Not Reparse Point
     Compressed:  (....................0...........) Uncompressed
     Offline:     (...................0............) Content indexed
     NotIndexed:  (..................0.............) Permanent
     Encrypted:   (.................0..............) Unencrypted
     ShareAccess: No sharing
     CreateDisposition: Overwrite if
     CreateOptions: 0x0000004c
     dir:         (...............................0) Non-directory
     write:       (..............................0.) Non-write through
     sq:          (.............................1..) Data is written 
                                                        to the file sequentially
     buffer:      (............................1...) Do not do intermediate 
                                                        buffering
     alert:       (...........................0....) IO alerts bits not set
     nonalert:    (..........................0.....) IO non-alerts bit not set
     nondir:      (.........................1......) Operation is on non-directory
                                                        file
     connect:     (........................0.......) Tree connect bit not set
     oplock:      (.......................0......
            ..) Complete if oplocked bit is not
            set
     EA:          (......................0.........) No EA knowledge bit is not set
     filename:    (.....................0..........) 8.3 filenames bit is not set
     random:      (....................0...........) Random access bit is not set
     delete:      (...................0............) Delete on close bit is not set
     open:        (..................0.............) Open by filename
     backup:      (.................0..............) Open for backup bit not set
     NameOffset: 120 (0x78)
     NameLength: 16 (0x10)
     CreateContextsOffset: 0 (0x0)
     CreateContextsLength: 0 (0x0)
     Name: test.dat
      
    
  2. The server responds with an SMB2 CREATE Response with the FileId of the opened file.

     Smb2: R CREATE FID=
     SMBIdentifier: SMB
     SMB2Header: 
     Size: 64 (0x40)
     CreditCharge: 0 (0x0)
     Status: STATUS_SUCCESS
     Command: CREATE
     Credits: 1 (0x1)
     Flags: 1 (0x1)
     ServerToRedir: ...............................1 Server to Client
     AsyncCommand:  ..............................0.  Command not asynchronous
     Related:       .............................0..  Packet is single message
     Signed:        ............................0...  Packet not signed
     Reserved: 0 (0x0)
     DFS:           0...............................  Command not DFS Operation
     NextCommand: 0 (0x0)
     MessageId: 10 (0xA)
     Reserved: 0 (0x0)
     TreeId: 1 (0x1)
     SessionId: 4398046511125 (0x40000000015)
     RCreate: 
     Size: 89 (0x59)
     OplockLevel: 9 (0x9)
     Reserved1: 9 (0x9)
     CreateAction: 2 (0x2)
     CreationTime: 127972994486543232 (0x1C6A6C2AD36A380)
     LastAccessTime: 127972994486543232 (0x1C6A6C2AD36A380)
     LastWriteTime: 127972994486543232 (0x1C6A6C2AD36A380)
     ChangeTime: 127972994486543232 (0x1C6A6C2AD36A380)
     AllocationSize: 765952 (0xBB000)
     EndOfFile: 0 (0x0)
     FileAttributes: 0x00000020
     ReadOnly:   (...............................0) Read/Write
     Hidden:     (..............................0.) Not Hidden
     System:     (.............................0..) Not System
     Reserverd3: 0 (0x0)
     Directory:  (...........................0....) File
     Archive:    (..........................1.....) Archive
     Device:     (.........................0......) Not Device
     Normal:     (........................0.......) Not Normal
     Temporary:  (.......................0........) Permanent
     Sparse:     (......................0.........) Not Sparse
     Reparse:    (.....................0..........) Not Reparse Point
     Compressed: (....................0...........) Uncompressed
     Offline:    (...................0............) Content indexed
     NotIndexed: (..................0.............) Permanent
     Encrypted:  (.................0..............) Unencrypted
     Reserved2: 0 (0x0)
     Fid: 
     Persistent: 25 (0x19)
     Volatile: -4294967291 
              (0xFFFFFFFF00000005)
     CreateContextsOffset: 0 (0x0)
     CreateContextsLength: 0 (0x0)
      
    
  3. The client sends an SMB2 SET_INFO Request to set FileEndOfFileInformation (specified in [MS-FSCC] section 2.4.13) to 0x2f000.

     Smb2: C SET INFORMATION
     SMB2Header: 
     Size: 64 (0x40)
     CreditCharge: 0 (0x0)
     Status: STATUS_SUCCESS
     Command: SET INFORMATION
     Credits: 111 (0x6F)
     Flags: 0 (0x0)
     ServerToRedir: ...............................0 Client to Server
     AsyncCommand:  ..............................0.  Command not asynchronous
     Related:       .............................0..  Packet is single message
     Signed:        ............................0...  Packet not signed
     Reserved: 0 (0x0)
     DFS:           0...............................  Command not DFS Operation
     NextCommand: 0 (0x0)
     MessageId: 11 (0xB)
     Reserved: 0 (0x0)
     TreeId: 1 (0x1)
     SessionId: 4398046511125 (0x40000000015)
     CSetInfo: 
     Size: 33 (0x21)
     InfoType: 1 (0x1)
     FileInformationClass: 
              FileEndOfFileInformation
     BufferLength: 8 (0x8)
     BufferOffset: 96 (0x60)
     Reserved: 0 (0x0)
     AdditionalInformation: 0 (0x0)
     Fid: 
     Persistent: 25 (0x19)
     Volatile: -4294967291 
              (0xFFFFFFFF00000005)
     Buffer: (8 bytes) 0x000000000002f000
      
    
  4. The server sends an SMB2 SET_INFO Response with success.

     Smb2: R SET INFORMATION
     SMB2Header: 
     Size: 64 (0x40)
     CreditCharge: 0 (0x0)
     Status: STATUS_SUCCESS
     Command: SET INFORMATION
     Credits: 1 (0x1)
     Flags: 1 (0x1)
     ServerToRedir: ...............................1 Server to Client
     AsyncCommand:  ..............................0.  Command not asynchronous
     Related:       .............................0..  Packet is single message
     Signed:        ............................0...  Packet not signed
     Reserved: 0 (0x0)
     DFS:           0...............................  Command not DFS Operation
     NextCommand: 0 (0x0)
     MessageId: 11 (0xB)
     Reserved: 0 (0x0)
     TreeId: 1 (0x1)
     SessionId: 4398046511125 (0x40000000015)
     RSetInfo: 
     Size: 2 (0x2)
      
    
  5. The client sends an SMB2 WRITE Request to write the first 0x10000 bytes.

     Smb2: C WRITE 0x10000 bytes at 
              offset 0 (0x0)
     SMB2Header: 
     Size: 64 (0x40)
     CreditCharge: 0 (0x0)
     Status: STATUS_SUCCESS
     Command: WRITE
     Credits: 111 (0x6F)
     Flags: 0 (0x0)
     ServerToRedir: ...............................0 Client to Server
     AsyncCommand:  ..............................0.  Command not asynchronous
     Related:       .............................0..  Packet is single message
     Signed:        ............................0...  Packet not signed
     Reserved: 0 (0x0)
     DFS:           0...............................  Command not DFS Operation
     NextCommand: 0 (0x0)
     MessageId: 12 (0xC)
     Reserved: 0 (0x0)
     TreeId: 1 (0x1)
     SessionId: 4398046511125 (0x40000000015)
     CWrite: 
     Size: 49 (0x31)
     DataOffset: 112 (0x70)
     DataLength: 65536 (0x10000)
     Offset: 0 (0x0)
     Fid: 
     Persistent: 25 (0x19)
     Volatile: -4294967291 
              (0xFFFFFFFF00000005)
     Channel: 0 (0x0)
     RemainingBytes: 0 (0x0)
     WriteChannelInfoOffset: 0 (0x0)
     WriteChannelInfoLength: 0 (0x0)
     Flags: 0 (0x0)
      
    
  6. The server responds with an SMB2 WRITE Response indicating 0x10000 bytes were written.

     Smb2: R WRITE 0x10000 bytes 
              written
     SMB2Header: 
     Size: 64 (0x40)
     CreditCharge: 0 (0x0)
     Status: STATUS_SUCCESS
     Command: WRITE
     Credits: 1 (0x1)
     Flags: 1 (0x1)
     ServerToRedir: ...............................1 Server to Client
     AsyncCommand:  ..............................0.  Command not asynchronous
     Related:       .............................0..  Packet is single message
     Signed:        ............................0...  Packet not signed
     Reserved: 0 (0x0)
     DFS:           0...............................  Command not DFS Operation
     NextCommand: 0 (0x0)
     MessageId: 12 (0xC)
     Reserved: 0 (0x0)
     TreeId: 1 (0x1)
     SessionId: 4398046511125 (0x40000000015)
     RWrite: 
     Size: 17 (0x11)
     Reserved: 0 (0x0)
     DataLength: 65536 (0x10000)
     Remaining: 0 (0x0)
     WriteChannelInfoOffset: 0 (0x0)
     WriteChannelInfoLength: 0 (0x0)
      
    
  7. The client sends an SMB2 WRITE Request to write the next 0x10000 bytes.

     Smb2: C WRITE 0x10000 bytes at 
              offset 65536 (0x10000)
     SMB2Header: 
     Size: 64 (0x40)
     CreditCharge: 0 (0x0)
     Status: STATUS_SUCCESS
     Command: WRITE
     Credits: 111 (0x6F)
     Flags: 0 (0x0)
     ServerToRedir: ...............................0 Client to Server
     AsyncCommand:  ..............................0.  Command not asynchronous
     Related:       .............................0..  Packet is single message
     Signed:        ............................0...  Packet not signed
     Reserved: 0 (0x0)
     DFS:           0...............................  Command not DFS Operation
     NextCommand: 0 (0x0)
     MessageId: 13 (0xD)
     Reserved: 0 (0x0)
     TreeId: 1 (0x1)
     SessionId: 4398046511125 (0x40000000015)
     CWrite: 
     Size: 49 (0x31)
     DataOffset: 112 (0x70)
     DataLength: 65536 (0x10000)
     Offset: 65536 (0x10000)
     Fid: 
     Persistent: 25 (0x19)
     Volatile: -4294967291 
              (0xFFFFFFFF00000005)
     Channel: 0 (0x0)
     RemainingBytes: 0 (0x0)
     WriteChannelInfoOffset: 0 (0x0)
     WriteChannelInfoLength: 0 (0x0)
     Flags: 0 (0x0)
      
    
  8. The server responds with an SMB2 WRITE Response indicating 0x10000 bytes were written.

     Smb2: R WRITE 0x10000 bytes 
              written
     SMB2Header: 
     Size: 64 (0x40)
     CreditCharge: 0 (0x0)
     Status: STATUS_SUCCESS
     Command: WRITE
     Credits: 1 (0x1)
     Flags: 1 (0x1)
     ServerToRedir: ...............................1 Server to Client
     AsyncCommand:  ..............................0.  Command not asynchronous
     Related:       .............................0..  Packet is single message
     Signed:        ............................0...  Packet not signed
     Reserved: 0 (0x0)
     DFS:           0...............................  Command not DFS Operation
     NextCommand: 0 (0x0)
     MessageId: 13 (0xD)
     Reserved: 0 (0x0)
     TreeId: 1 (0x1)
     SessionId: 4398046511125 (0x40000000015)
     RWrite: 
     Size: 17 (0x11)
     Reserved: 0 (0x0)
     DataLength: 65536 (0x10000)
     Remaining: 0 (0x0)
     WriteChannelInfoOffset: 0 (0x0)
     WriteChannelInfoLength: 0 (0x0)
      
    
  9. The client sends an SMB2 WRITE Request to write the final 0xf000 bytes.

     Smb2: C WRITE 0xF000 bytes at 
              offset 131072 (0x20000)
     SMB2Header: 
     Size: 64 (0x40)
     CreditCharge: 0 (0x0)
     Status: STATUS_SUCCESS
     Command: WRITE
     Credits: 111 (0x6F)
     Flags: 0 (0x0)
     ServerToRedir: ...............................0 Client to Server
     AsyncCommand:  ..............................0.  Command not asynchronous
     Related:       .............................0..  Packet is single message
     Signed:        ............................0...  Packet is not signed
     Reserved: 0 (0x0)
     DFS:           0...............................  Command not DFS Operation
     NextCommand: 0 (0x0)
     MessageId: 14 (0xE)
     Reserved: 0 (0x0)
     TreeId: 1 (0x1)
     SessionId: 4398046511125 (0x40000000015)
     CWrite: 
     Size: 49 (0x31)
     DataOffset: 112 (0x70)
     DataLength: 61440 (0xF000)
     Offset: 131072 (0x20000)
     Fid: 
     Persistent: 25 (0x19)
     Volatile: -4294967291 
              (0xFFFFFFFF00000005)
     Channel: 0 (0x0)
     RemainingBytes: 0 (0x0)
     WriteChannelInfoOffset: 0 (0x0)
     WriteChannelInfoLength: 0 (0x0)
     Flags: 0 (0x0)
      
    
  10. The server responds with an SMB2 WRITE Response indicating 0xf000 bytes were written.

     Smb2: R WRITE 0xF000 bytes 
              written
     SMB2Header: 
     Size: 64 (0x40)
     CreditCharge: 0 (0x0)
     Status: STATUS_SUCCESS
     Command: WRITE
     Credits: 1 (0x1)
     Flags: 1 (0x1)
     ServerToRedir: ...............................1 Server to Client
     AsyncCommand:  ..............................0.  Command not asynchronous
     Related:       .............................0..  Packet is single message
     Signed:        ............................0...  Packet not signed
     Reserved: 0 (0x0)
     DFS:           0...............................  Command not DFS Operation
     NextCommand: 0 (0x0)
     MessageId: 14 (0xE)
     Reserved: 0 (0x0)
     TreeId: 1 (0x1)
     SessionId: 4398046511125 (0x40000000015)
     RWrite: 
     Size: 17 (0x11)
     Reserved: 0 (0x0)
     DataLength: 61440 (0xF000)
     Remaining: 0 (0x0)
     WriteChannelInfoOffset: 0 (0x0)
     WriteChannelInfoLength: 0 (0x0)
      
    
  11. The client sends an SMB2 CLOSE Request to close the opened file.

     Smb2: C CLOSE FID=
     SMB2Header: 
     Size: 64 (0x40)
     CreditCharge: 0 (0x0)
     Status: STATUS_SUCCESS
     Command: CLOSE
     Credits: 111 (0x6F)
     Flags: 0 (0x0)
     ServerToRedir: ...............................0 Client to Server
     AsyncCommand:  ..............................0.  Command not asynchronous
     Related:       .............................0..  Packet is single message
     Signed:        ............................0...  Packet not signed
     Reserved: 0 (0x0)
     DFS:           0...............................  Command not DFS Operation
     NextCommand: 0 (0x0)
     MessageId: 15 (0xF)
     Reserved: 0 (0x0)
     TreeId: 1 (0x1)
     SessionId: 4398046511125 (0x40000000015)
     CClose: 
     Size: 24 (0x18)
     Flags: 1 (0x1)
     Reserved: 0 (0x0)
     Fid: 
     Persistent: 25 (0x19)
     Volatile: -4294967291 
              (0xFFFFFFFF00000005)
      
    
  12. The server sends an SMB2 CLOSE Response indicating the close was successful.

     Smb2: R CLOSE
     SMBIdentifier: SMB
     SMB2Header: 
     Size: 64 (0x40)
     CreditCharge: 0 (0x0)
     Status: STATUS_SUCCESS
     Command: CLOSE
     Credits: 1 (0x1)
     Flags: 1 (0x1)
     ServerToRedir: ...............................1 Server to Client
     AsyncCommand:  ..............................0.  Command not asynchronous
     Related:       .............................0..  Packet is single message
     Signed:        ............................0...  Packet not signed
     Reserved: 0 (0x0)
     DFS:           0...............................  Command not DFS Operation
     NextCommand: 0 (0x0)
     MessageId: 15 (0xF)
     Reserved: 0 (0x0)
     TreeId: 1 (0x1)
     SessionId: 4398046511125 (0x40000000015)
     RClose: 
     Size: 60 (0x3C)
     Flags: 1 (0x1)
     Reserved: 0 (0x0)
     CreationTime: 127972994486543232 
              (0x1C6A6C2AD36A380)
     LastAccessTime: 127972994494343232 
              (0x1C6A6C2ADADA840)
     LastWriteTime: 127965940833141721 
              (0x1C6A0585EB543D9)
     ChangeTime: 127972993511484705 
              (0x1C6A6C273186D21)
     AllocationSize: 196608 (0x30000)
     EndOfFile: 192512 (0x2F000)
     FileAttributes: 0x00000020
     ReadOnly:   (...............................0) Read/Write
     Hidden:     (..............................0.) Not Hidden
     System:     (.............................0..) Not System
     Reserverd3: 0 (0x0)
     Directory:  (...........................0....) File
     Archive:    (..........................1.....) Archive
     Device:     (.........................0......) Not Device
     Normal:     (........................0.......) Not Normal
     Temporary:  (.......................0........) Permanent
     Sparse:     (......................0.........) Not Sparse
     Reparse:    (.....................0..........) Not Reparse Point
     Compressed: (....................0...........) Uncompressed
     Offline:    (...................0............) Content indexed
     NotIndexed: (..................0.............) Permanent
     Encrypted:  (.................0..............) Unencrypted
      
    
Show: