SMB Packets

[AJT1]

Just been using Network Monitor and have noticed a massive amount of SMB packets between our server and one of our hosts, does anybody have any idea what these SMB packets are I've got as far as reading what an SMB packet is on Wikipedia, but unfortunately there isn't much information on how many there should be bouncing around the network.

[PiqueABoo]

SMB traffic is mostly file sharing. The number of packets depends on lots of things, how many drives are mapped, whether you have Explorer open, whether you're reading/writing/searching files etc.

[AJT1]

The strange thing is there was nobody logged onto the machine as it was after school and didn't have high readings from any of the other 140 machines on the network.

Thanks for your reply

[PiqueABoo]

If this is MS Network Monitor 3.1, look at the descriptions for SMB packets.

 

Some of it might be a bit opaque, but the descriptions are the SMB commands/responses and you should be able to see the directory and file names involved. Look at the ones with "C; Nt Create Andx" and "C; Transact2".

[Guest blacksheep]

windows hosts to seem to be overly "chatty", lots of broadcasts and the like just look at the switch lights when people are not using the machines! Not exactly efficient..

[srochford]

There will always be loads of SMB traffic even if you think no-one is logged on there are still "things" happening (eg - you might be running a virus update or similar process; if you have any software which audits the machines then this could be running and so on).

 

Open task manager on a machine go to the processes tab and click View | Select columns and tick the I/O Read Bytes and I/O Write Bytes boxes. OK out and watch the processes as they read and write files. Some of these are local; others are network.

 

if you want even more info then download procmon - that will show you all the file activity that's going on and you can easily see just how busy an "idle" machine really is.

[sahmeepee]

You can also get more information about active windows shares on your server from Computer Management (start > run... > compmgmt.msc)