2.2.7.4.1 Request

The NT_TRANSACT_NOTIFY_CHANGE request and response formats are special cases of SMB_COM_NT_TRANSACT (section 2.2.4.62) SMB. Only the NT_TRANSACT_NOTIFY_CHANGE request specifics are described here.

 Setup
   {
   ULONG   CompletionFilter;
   USHORT  FID;
   BOOLEAN WatchTree;
   UCHAR   Reserved;
   }
  

SMB_Parameters:

WordCount (1 byte): This field MUST be 0x17.

Words (46 bytes): Array of USHORT.

MaxSetupCount (1 byte): This field MUST be 0x00.

MaxDataCount (4 bytes): This field MUST be 0x00000000.

Function (2 bytes): This field MUST be NT_TRANSACT_NOTIFY_CHANGE (0x0004).

SetupCount (1 byte): This field MUST be 04, indicating that 4 words (8 bytes) are used for Setup information.

0	1	2	3	4	5	6	7	8	9	1 0	1	2	3	4	5	6	7	8	9	2 0	1	2	3	4	5	6	7	8	9	3 0	1
Setup
...

Setup (8 bytes):

0	1	2	3	4	5	6	7	8	9	1 0	1	2	3	4	5	6	7	8	9	2 0	1	2	3	4	5	6	7	8	9	3 0	1
CompletionFilter
FID																WatchTree								Reserved

CompletionFilter (4 bytes): A 32-bit field of flags that specify the types of operations to monitor.

Name	Value
FILE_NOTIFY_CHANGE_FILE_NAME	0x00000001
FILE_NOTIFY_CHANGE_DIR_NAME	0x00000002
FILE_NOTIFY_CHANGE_NAME	0x00000003
FILE_NOTIFY_CHANGE_ATTRIBUTES	0x00000004
FILE_NOTIFY_CHANGE_SIZE	0x00000008
FILE_NOTIFY_CHANGE_LAST_WRITE	0x00000010
FILE_NOTIFY_CHANGE_LAST_ACCESS	0x00000020
FILE_NOTIFY_CHANGE_CREATION	0x00000040
FILE_NOTIFY_CHANGE_EA	0x00000080
FILE_NOTIFY_CHANGE_SECURITY	0x00000100
FILE_NOTIFY_CHANGE_STREAM_NAME	0x00000200
FILE_NOTIFY_CHANGE_STREAM_SIZE	0x00000400
FILE_NOTIFY_CHANGE_STREAM_WRITE	0x00000800

FID (2 bytes): The FID of the directory to monitor.

WatchTree (1 byte): If all subdirectories are to be watched, then this field MUST be set to TRUE; otherwise, it MUST be set to FALSE.

Reserved (1 byte): Reserved. This value MUST be 0x00.

NT_Trans_Parameters

The client does not provide any NT_Trans_Parameters in the request.

NT_Trans_Data

The client does not provide any NT_Trans_Data in the request.