Hi,
I want to run network capture on domain controllers to identify the clients connected to them using SMB1.0, I also want to minimize the file size of the capture.
so how to capture network traffic with a string like "Tree Connect Request" and "Tree Connect Response"
Regards, SP
Those strings don't appear in the packets; they come from Wireshark, which interprets the numerical value of the SMB request code.
But if all you want is to detect SMB1, and the auditing Graham Bloice mentions isn't possible, that's more than you need; you don't need to look for particular SMB messages, you just need to look for SMB1 messages of any type.
You could try looking for any TCP packets to or from port 139 or port 445 in which the first byte of the TCP payload is 0 (a NetBIOS-over-TCP "session message", or a regular SMB-over-TCP message) and bytes 5, 6, 7 and 8 are 0xff 0x5e 0x4d 0x42:
(tcp port 139 or 445) and tcp[((tcp[12:1] & 0xF0) >> 2):1] = 0x00 and tcp[((tcp[12:1] & 0xF0) >> 2) + 4:4] = 0xff534d42
(The filter fetches the data offset from the TCP header, multiplies it by 4, and adds it to the 20 and 24 in the TCP payload test, so that it works even with TCP segments that have TCP options.)
(This reminds me - I really need to add string comparison, byte-string comparison, and a direct way to access the UDP and TCP payload to the capture filter mechanism in libpcap....)
Thank you Guy for sharing the capture Filter, I have tested this in my LAB and gives me the result as expected, but need to check each captured packet to see which version of SMB it had negotiated, can I get that information in Info Column so that packet can be easily identify SMB version?
If the packet has 0xff 0x53 0x4d 0x42 in it, it's SMB1, and the capture filter will match it.
If the packet has 0xfe 0x53 0x4d 0x42 in it, it's SMB2 or SMB3, and the capture filter will not match it.
So the way to check which version of SMB is being used in a packet captured using that capture filter is "if it was captured, it's SMB1, otherwise it's SMB2/SMB3 or it's not SMB at all".
Can't you use the built-in SMB1 auditing to discover this, or are your DC's too old?
That article doesn't seem to directly address SMB1; did you want to link to a different article?
Here's a PowerShell script to audit for systems with SMB1 installed, although I don't know if that'll catch older systems where it wasn't a feature that needed to be installed (or non-Windows systems using SMB1 - several UN*Xes also have SMB client VFSes, including the one on which I'm typing this).
This posting about SMB1 says:
We provide SMB1 usage auditing in Windows 10, Windows Server 2016, and Windows Server 2012 R2/Windows 8.1 via an update, just to be sure. That way you can configure your Windows Servers to see if disabling SMB1 would break someone:
Set-SmbServerConfiguration –AuditSmb1Access $true
Then just examine the SMBServer\Audit event log on the systems. If you have older servers than WS2012 R2, now is good time to talk upgrade ...
Asked: 2019-12-12 11:52:54 +0000
Seen: 9,759 times
Last updated: Dec 13 '19
