0x00000200, 0x00020200, 0x08020000, 0x08020008, 0x00020208, 0x08000208, 0x00020200, 0x00020000, 0x08000208, 0x00000008,
            0x08020208, 0x00000200, 0x08000000, 0x08020200, 0x08000000, 0x00020008, 0x00000208, 0x00020000, 0x08020200, 0x08000200,

     * SMB2 File Action constants
     */
    private static final int FILE_ACTION_ADDED = 0x00000001;
    private static final int FILE_ACTION_REMOVED = 0x00000002;
    private static final int FILE_ACTION_MODIFIED = 0x00000003;
    private static final int FILE_ACTION_RENAMED_OLD_NAME = 0x00000004;
    private static final int FILE_ACTION_RENAMED_NEW_NAME = 0x00000005;

    /**
     * SMB2 File Notify Change constants
     */

        <match value="0x00000006" type="little32" offset="12"/>
      </match>
      <match value="0xFEEDFACF" type="string" offset="0">
        <match value="0x00000006" type="big32" offset="12"/>
      </match>
      <match value="0xCFFAEDFE" type="string" offset="0">
        <match value="0x00000006" type="little32" offset="12"/>
      </match>
    </magic>
  </mime-type>

    public static final int SMB2_FLAGS_SERVER_TO_REDIR = 0x00000001;
    /**
     * Flag indicating this is an asynchronous command.
     */
    public static final int SMB2_FLAGS_ASYNC_COMMAND = 0x00000002;
    /**
     * Flag indicating this operation is related to the previous operation in a compound request.
     */
    public static final int SMB2_FLAGS_RELATED_OPERATIONS = 0x00000004;
    /**
     * Flag indicating the message is signed.

    private byte[] contextHandle;

    // Registration flags
    /** No special registration flags */
    public static final int WITNESS_REGISTER_NONE = 0x00000000;
    /** Register for IP address change notifications */
    public static final int WITNESS_REGISTER_IP_NOTIFICATION = 0x00000001;

    // Registration state
    private volatile WitnessRegistrationState state;
    private volatile long lastHeartbeat;

        @DisplayName("Should preserve other flags when setting signed flag")
        void testSignPreservesOtherFlags() {
            // Set initial flags with some existing flags
            int initialFlags = 0x00000001 | 0x00000002 | 0x00000004;
            SMBUtil.writeInt4(initialFlags, data, 16);

            digest.sign(data, 0, data.length, request, response);

            int flags = SMBUtil.readInt4(data, 16);

    /** The requested operation is not implemented */
    int NT_STATUS_NOT_IMPLEMENTED = 0xC0000002;
    /** The specified information class is invalid */
    int NT_STATUS_INVALID_INFO_CLASS = 0xC0000003;
    /** Invalid access to memory location */
    int NT_STATUS_ACCESS_VIOLATION = 0xC0000005;
    /** The handle is invalid */
    int NT_STATUS_INVALID_HANDLE = 0xC0000008;
    /** The parameter is incorrect */

    assertThat(countFrames(logs, "FINE: >> 0x00000000     8 PING          "))
      .isEqualTo(1)
    assertThat(countFrames(logs, "FINE: << 0x00000000     8 PING          "))
      .isEqualTo(1)
    assertThat(countFrames(logs, "FINE: >> 0x00000000     8 PING          ACK"))
      .isEqualTo(1)
    assertThat(countFrames(logs, "FINE: << 0x00000000     8 PING          ACK"))
      .isEqualTo(1)
  }

        Encdec.enc_uint32le(0x00000101, blob, 0); // Header
        Encdec.enc_uint32le(0x00000000, blob, 4); // Reserved
        Encdec.enc_uint64le(nanos1601, blob, 8);
        System.arraycopy(clientChallenge, 0, blob, 16, 8);
        Encdec.enc_uint32le(0x00000000, blob, 24); // Unknown
        System.arraycopy(avPairs, 0, blob, 28, avPairsLength);
        Encdec.enc_uint32le(0x00000000, blob, 28 + avPairsLength);

        final byte[] temp = new byte[28 + avPairsLength + 4];

        Encdec.enc_uint32le(0x00000101, temp, 0); // Header
        Encdec.enc_uint32le(0x00000000, temp, 4); // Reserved
        Encdec.enc_uint64le(nanos1601, temp, 8);
        System.arraycopy(clientChallenge, 0, temp, 16, 8);
        Encdec.enc_uint32le(0x00000000, temp, 24); // Unknown
        if (avPairs != null) {