Reading ECPs

NTFSD
1

For posterity, I’d like to report back reading ECPs from a mini filter and
ask a question.

On my Windows 7 computer, FltGetEcpListFromCallbackData successfully returns
an ECP_LIST when a request comes in from the network (and perhaps locally
too - haven’t checked closely enough).

To get the SRV_OPEN_ECP_CONTEXT ECP though, you have to set (just like Alex
said way back):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\Parameters

[DWORD] EnableECP = 1

And, this seems to take effect immediately - no need to restart the server
which was a nice surprise.

Now the question: Is there any kind of performance hit when enabling this?
Any reason not to enable it?

Thanks

Doug

2

The perf hit is minimal, especially considering that for SMB 2.x traffic the Win7 SRV already attaches an oplock key ECP to nearly every open.

Note that in Windows 8/Server 2012 SMB 2.x/3.0 traffic gets that ECP by default. You still have to set the reg key to get the ECP on legacy SMB traffic. However, you’ll only see legacy SMB traffic when dealing with clients/servers older than Vista/Server 2008.

Christian [MSFT]
This posting is provided “AS IS” with no warranties, and confers no rights.

3

Thanks for the feedback Christian.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@microsoft.com
Sent: Thursday, October 11, 2012 3:58 PM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] Reading ECPs

The perf hit is minimal, especially considering that for SMB 2.x traffic the
Win7 SRV already attaches an oplock key ECP to nearly every open.

Note that in Windows 8/Server 2012 SMB 2.x/3.0 traffic gets that ECP by
default. You still have to set the reg key to get the ECP on legacy SMB
traffic. However, you’ll only see legacy SMB traffic when dealing with
clients/servers older than Vista/Server 2008.

Christian [MSFT]
This posting is provided “AS IS” with no warranties, and confers no rights.

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

4

Which still does represent something like 50% of the systems out there…

Tony
OSR