Server: OES11 SP2 - NSS / CIFS enabled
Workstation: Windows 10 - Novell Client 2 SP4 for Windows 10 (IR2) - Client for MS Removed

Was in the middle of monitoring with Wireshark and noticed a bunch of CIFS calls being made from my Windows 10 workstation. Was not sure why so many, So of course had to dig in a bit.

Client has no MS Client for networks, File sharing is uninstalled.

What I have observed is that any "Mapped" drives are using Port 524 (NCP) for file transfers, calls, etc...., however any UNC transfers are being made over 139 using CIFS.

I ran the same monitoring on a Windows 7 Pro x64 Same IR2 client - No MS Client and I see UNC and Drive mappings using 524.

Could this be related to the UNC Filter?

Anyone know of a bug on the Win10 Client UNC Filter?