What is the meaning of referent_id in a SMB2/DCERPC SRVSVC NetSessEnum request?

319 Views Asked by At

I'm trying to dissect a NetSessEnum request over SMB2 (srvsvc opnum 12) According to Wireshark, a field called Referent_ID seems to have a value of 0x00020000. I can't find proper documentation regarding this field. I'd like to know, if only 0x00020000 is a valid value for this operation or not. Will appreciate pointer to proper documentation on this.

1

There are 1 best solutions below

3
On BEST ANSWER

This field is a serialization mark and it may have any value. For instance in our rpc implementation we are using running numbers. This field means a reference and the referenced value comes later according to the serialization rules. The value is meaningless.