Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at:

SMB2 file creates bypassing filtering

Jason_T.Jason_T. Member Posts: 72

Hi All,

I'm trying to track down a bizarre (to me at least) issue here. I have a Server 2016 machine, call it \server, and a win 10 client machine, call it \client. On \client I am creating a file and writing to it using the path \server\c$\test\test.dat. I am running procmon on \server and it sees nothing other than a subsequent AV scan of test.dat by msmpeng.exe. No other create, write, or any other occurences of test.dat in any activity from any process.

Running wireshark on \server I see some SMB2 activity where there is a FSCTL_QUERY_NETWORK_INTERFACE_INFO followed by a create file request (on test.dat), followed by multiple FILE_INFO/SMB2_FILE_ALLOCATION_INFO requests.

I got here initially trying to figure out why my minifilter (running on \server) wasn't seeing any activity, whether UNC name based or drive-letter name based, for these files getting created on \server. It was as if they were appearing without ever having been created/written. Running procmon showed the same thing that my filter was seeing, perhaps not surprisingly. So my question is how are we supposed to handle filtering this method of file creation? And is this type of SMB2 file create documented somewhere as a new addition to recent Win server versions or has this been present all along and I somehow just never came across it?



  • Peter_Viscarola_(OSR)Peter_Viscarola_(OSR) Administrator Posts: 7,796

    You be better asking this in the NTFSD forum, where the cool file system kids hang out...

    I'll move it for you.


    Peter Viscarola

  • Jason_T.Jason_T. Member Posts: 72

    Thanks, Peter! I knew that, of course, but my actions would suggest otherwise :)

  • Jason_T.Jason_T. Member Posts: 72

    False alarm. Feel free to delete or leave behind so others can benefit from my snafu. Procmon was filtering out any system activity which is what the srv operations were coming in as. With that filter turned off I can see the local file activity on the C:\ pathnames as expected. Sorry for the noise!

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 15 Jun 2020 LIVE ONLINE
Writing WDF Drivers 22 June 2020 LIVE ONLINE
Internals & Software Drivers 28 Sept 2020 Dulles, VA