It seems that file I/O calls on drives mapped by a Novell's Netware 32-bit Client cannot be intercepted by a Win95 VxD via the IFS hook. The Microsoft NetWare Client redirector can be hooked in this way (as this is the intended architecture for IFS/FSD layering). Apparently, Novell did not follow the WOSA layered File System spec and somehow bypassed the normal IFS file system chain. I took a quick look at the INT 21h protect mode calls that are the VWIN32 front end to the IFS manager and did not see any calls to the NetWare mapped drives going through that interface either.
Does anyone know how Novell implemented their NetWare Client and, more specifically, how to monitor file operations (Open, read, write, etc.) on remote NetWare drives?