Adrian Pfisterer noticed that some clients send a Parameter Descriptor containing WrLehDO instead of WrLehDz. As it turns out, this is not unusual--it's just undocumented.

The capital 'O' indicates a NULL pointer, and the lower case 'z' indicates a nul-terminated string. The NULL pointer is used when the sender does not include the Enumeration Domain field (for whatever reason). If the Enumeration Domain is not included, the Browse Server should return the list of servers from its own default workgroup.

It appears, from sniffer traces, that there is no actual field in the packet that contains the NULL pointer. The letter 'O' simply indicates the absence of the field.

For more information on RAP and RAP format strings, see:

• cifsrap2.txt
• Paul Leach's Remote Net API format strings... message (Sept. 27, 1996)
• The SNIA CIFS Technical Reference
• IPC Mechanisms for SMB (Open Group publication #195)
• Protocols for X/Open PC Interworking: SMB, Version 2 (Open Group publication #209)