What is the meaning of referent_id in a SMB2/DCERPC SRVSVC NetSessEnum request?

284 views Asked by At

I'm trying to dissect a NetSessEnum request over SMB2 (srvsvc opnum 12) According to Wireshark, a field called Referent_ID seems to have a value of 0x00020000. I can't find proper documentation regarding this field. I'd like to know, if only 0x00020000 is a valid value for this operation or not. Will appreciate pointer to proper documentation on this.

1

There are 1 answers

3
Mark Rabinovich On BEST ANSWER

This field is a serialization mark and it may have any value. For instance in our rpc implementation we are using running numbers. This field means a reference and the referenced value comes later according to the serialization rules. The value is meaningless.