locked
Different EndOfFile information for same file RRS feed

  • Question

  • Below is the CREATE and QUERY_INFO response for the same file. Please notice 'End of File':

    SMB2 (Server Message Block Protocol version 2)
        SMB2 Header
        Create Response (0x05)
            StructureSize: 0x0059
            Oplock: No oplock (0x00)
            Response Flags: 0x00
            Create Action: The file existed and was opened (1)
            Create: Jun 17, 2020 12:24:45.888363000 PDT
            Last Access: Jun 17, 2020 12:24:45.888363000 PDT
            Last Write: Jun 17, 2020 12:24:45.888363000 PDT
            Last Change: Jun 17, 2020 12:24:45.888363000 PDT
            Allocation Size: 64
            End Of File: 19
            File Attributes: 0x00000080
            Reserved: 00000000
            GUID handle File: nfs\ssdir1\0755_dir1_ssfile
                File Id: b1c9dfaa-75fd-64b8-0100-000000000000
                [Frame handle opened: 16]
            Blob Offset: 0x00000000
            Blob Length: 0
            ExtraInfo: NO DATA
    SMB2 (Server Message Block Protocol version 2)
        SMB2 Header
        GetInfo Response (0x10)
            [Class: FILE_INFO (0x01)]
            [InfoLevel: SMB2_FILE_STANDARD_INFO (0x05)]
            StructureSize: 0x0009
            Blob Offset: 0x00000048
            Blob Length: 24
            SMB2_FILE_STANDARD_INFO
                Allocation Size: 64
                End Of File: 0
                Link Count: 1
                Delete Pending: Normal, no pending delete (0)
                Is Directory: This is NOT a directory (0)

    Above, we can see that End of File information is different in the response of SMB2 CREATE and for SMB2 QUERY INFO response. Is this valid? If so, what is the difference between the two end of file values. The specification does not seem to shed much light on this matter.

    Please Google search for CREATE Response and FILE_STANDARD_INFORMATION (which is part of  QUERY INFO Response) to see what spec says about end of file. Here is the excerpt:

    From CREATE response:

    EndofFile (8 bytes): The size, in bytes, of the file.

    From FILE_STANDARD_INFORMATION (part of QUERY INFO response):

    EndOfFile (8 bytes):  A 64-bit signed integer that contains the absolute end-of-file position as a byte offset from the start of the file. EndOfFile specifies the offset to the byte immediately following the last valid byte in the file. Because this value is zero-based, it actually refers to the first free byte in the file. That is, it is the offset from the beginning of the file at which new bytes appended to the file will be written. The value of this field MUST be greater than or equal to 0.



    Sunday, June 21, 2020 10:07 AM

All replies

  • Hi Amandeep:

    I have alerted the open specifications team regarding your inquiry. A member of the team will be in touch soon.


    Regards, Obaid Farooqi

    Sunday, June 21, 2020 6:14 PM
  • Hi Amandeep:

    Can you please send an email to my attention to dochelp at microsoft dot com?


    Regards, Obaid Farooqi

    Sunday, June 21, 2020 11:55 PM
  • Done. Also attached the PCAP which I cannot attach here.
    Monday, June 22, 2020 4:47 PM
  • Forum update:

    This issue was unresolved as customer moved on and became un responsive.


    Regards, Obaid Farooqi

    Monday, December 7, 2020 7:32 AM