I want monitor the data pushed to destination server, the protocol used is smb2 which I want to observe what are the contents (for further analysis) this is being done in a test environement where the username pwd , hostname, etc is available with me
Have a look at the SMB2 protocol preferences. There's a table you can fill in with that information.
from where do I get the session key.. I got the session Id from trace.. however session key which is something hard to get
You need the session key, which is determined individually for each client and each share (or TreeConnect).
Recent SAMBA versions support a debug function to record the session key: https://wiki.samba.org/index.php/Wire... for a decent decryption
At this time, I am not aware of a similar function for Windows servers.
We are using windows client we we have(or where can we get) similar function for windws system
Asked: 2022-05-13 08:20:40 +0000
Seen: 542 times
Last updated: May 13 '22
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
