{"id":17780,"date":"2014-02-07T11:31:38","date_gmt":"2014-02-07T16:31:38","guid":{"rendered":"https:\/\/nuxx.net\/blog\/?p=17780"},"modified":"2014-02-11T12:40:59","modified_gmt":"2014-02-11T17:40:59","slug":"microsoft-network-monitor-filter-for-hidden-attribute","status":"publish","type":"post","link":"https:\/\/nuxx.net\/blog\/2014\/02\/07\/microsoft-network-monitor-filter-for-hidden-attribute\/","title":{"rendered":"Microsoft Network Monitor Filter for Hidden Attribute"},"content":{"rendered":"

<\/a><\/p>\n

Today I had to troubleshoot how some files\/folders on a share are ending up hidden, so this took some digging into SMB<\/a> and display filters in Microsoft Network Monitor<\/a>. Since this wasn’t particularly easy to find I wanted to share it here. This is the filter for displaying when a file or folder is having its hidden attribute set (check box via Properties<\/em> in Explorer<\/em> or via attrib +h<\/span>) over SMB:<\/p>\n

SMB.CTransaction2.FileBasicDataBlock.Attributes.Hidden == 0x1<\/span><\/p>\n

This can be combined with a search through the Description<\/em> to find specific file or folder names. For example:<\/p>\n

SMB.CTransaction2.FileBasicDataBlock.Attributes.Hidden == 0x1<\/span>
\nAND<\/span>
\nContains(Property.Description, “handle.exe”)<\/span><\/p>\n

For SMB2 the filter string is as follows:<\/p>\n

SMB2.CSetInfo.FileInfo.FileBasicInformation.FileAttributes.FSSCFileAttribute.Hidden == 0x1<\/span><\/p>\n

Unfortunately, with SMB2 the file\/path info will not be included in the frame shown by the aforementioned filter. This can be identified by looking up the session ID (SMB2.SMB2Header.SessionId == NNNN<\/span>) \u00a0and filtering on that, looking at either the CREATE<\/span> or CLOSE<\/span> operations near the beginning and end of each session. So, I also capture the CREATE<\/span> operations for the path I’m looking for, then manually correlate them (with a bit of filtering) after observing the issue. This results in the SMB2 portion of the filter looking something like this once combined with the related SMB filter:<\/p>\n

( SMB.CTransaction2.FileBasicDataBlock.Attributes == 0x1<\/span>
\n\u00a0 AND<\/span>
\n\u00a0 Contains(Property.Description, “file_of_interest.txt”)<\/span>
\n)<\/span>
\nOR<\/span>
\nSMB2.CSetInfo.FileInfo.FileBasicInformation.FileAttributes.FSCCFileAttribute.Hidden == 0x1<\/span>
\nOR<\/span>
\n( SMB2.SMB2Header.Command == 0x5<\/span>
\n\u00a0 AND<\/span>
\n\u00a0 Contains(SMB2.CCreate.Name, “file_of_interest.txt”)<\/span>
\n)<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Today I had to troubleshoot how some files\/folders on a share are ending up hidden, so this took some digging into SMB and display filters…<\/p>\n

Continue readingMicrosoft Network Monitor Filter for Hidden Attribute<\/span><\/a><\/div>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[],"class_list":["post-17780","post","type-post","status-publish","format-standard","hentry","category-computers","entry"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts\/17780","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/comments?post=17780"}],"version-history":[{"count":8,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts\/17780\/revisions"}],"predecessor-version":[{"id":17796,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts\/17780\/revisions\/17796"}],"wp:attachment":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/media?parent=17780"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/categories?post=17780"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/tags?post=17780"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}