[MS-SMB2]: Overview (2024)

The Server Message Block (SMB) Protocol Versions 2 and 3,hereafter referred to as "SMB 2 Protocol", is an extension of theoriginal Server Message Block (SMB) Protocol (as specified in [MS-SMB]and [MS-CIFS]).Both protocols are used by clients to request file and print services from aserver system over the network. Both are stateful protocols in which clientsestablish a connection to a server, establish an authenticated context onthat connection, andthen issue a variety of requests to access files, printers, and named pipes forinterprocess communication.

The SMB 2 Protocol is a major revision of the existing SMBProtocol, as specified in [MS-SMB]. The packet formats are completely differentfrom those of the SMB Protocol; however, many of the underlying concepts arecarried over. The underlying transports that are used to initiate and acceptconnections are either Direct TCP as specified in section 2.1 or NetBIOS over TCPtransports as specified in [RFC1001] and [RFC1002].

To retain compatibility with existing clients and servers,the existing SMB Protocol can be used to negotiate the use of the SMB 2Protocol, as described in section 1.7. However, the twoprotocols will never be intermixed on a specified connection after one isselected during negotiation.

Like its predecessor, which was the original SMB Protocol(as specified in [MS-SMB]), the SMB 2 Protocol supports the following features:

• Establishing one or more authenticated contexts for different security principals on aconnection.

• Connecting to multiple shared resources on the target server on aconnection.

• Opening, reading, modifying, or closing multiple files or namedpipes on the target server.

• Using the opportunistic locking of files to allow clients tocache data for better performance.

• Querying and applying attributes to files or volumes on thetarget server.

• Canceling outstanding operations.

  See Also

  SMB Most Important Features | Visuality SystemsSuper Mario Bros. 2Packet Carving with SMB and SMB2 | Chris SandersSMB security enhancements

• Passing through IO control code operations to the underlyingobject store on the server machine.

• Validating the integrity of requests and responses.

• Support for sharescoping and server aliases to allow a single server to appear as multipledistinct servers, as described in [MS-SRVS]section 1.3.

The SMB 2 Protocol provides several enhancements in additionto the preceding features:

• Allowing an opento a file to be reestablished after a client connection becomes temporarilydisconnected.

• Allowing the server to balance the number of simultaneousoperations that a client can have outstanding at any time.

• Providing scalability in terms of the number of shares, users,and simultaneously open files.

• Supporting symbolic links.

• Using a stronger algorithm to validate the integrity of requestsand responses.

The SMB 2.1 dialect introduces the following enhancements:

• Allowing a client to indicate support for multiple SMB 2 dialectsin a multi-protocol negotiate request.

• Allowing a client to obtain and preserve client caching stateacross multiple opens from the same client.

  See Also

  SMB2 - Wireshark Wiki

• Allowing a client to mark individual write operations onunbuffered handles to be treated as write-through.

• Allowing a client to retrieve hashes of a file for use in branchcache retrieval, as specified in [MS-PCCRC]section 2.3.

The SMB 3.0 dialect introduces the following enhancements:

• Allowing a client to retrieve hashes for a particular region of afile for use in branch cache retrieval, as specified in [MS-PCCRC] section 2.4.

• Allowing a client to obtain lease on a directory.

• Supporting the encryption of traffic between client and server ona per-share basis.

• Supporting the use of Remote Direct Memory Access (RDMA)transports, when the appropriate hardware and network are available.

• Supporting enhanced failover between client and server, includingoptional handle persistence.

• Allowing an application to failover on a new client and open afile that was previously opened using an application instance identifier.

• Allowing a client to bind a session to multipleconnections to the server. A request can be sent through any channel associated to thesession, and the corresponding response is sent through the same channel asused by the request. The following diagram shows an example of two sessionsusing multiple channels to the server.

Figure 1: Two sessions using multiple channels

The SMB 3.0.2 dialect introduces the following enhancements:

• Allowing a client to detect asymmetric shares through tree connect response, sothat client can optimize its connections to the server, in order to improveavailability and performance when accessing such shares.

• Allowing a client to request unbuffered read, write operations.

• Allowing a client to request remote invalidation while performingI/O using RDMA transport.

The SMB 3.1.1 dialect introduces the following enhancements:

• Supporting the negotiation of encryption and integrityalgorithms.

• Enhanced protection of negotiation and session establishment.

• Reconnecting with a specified dialect.

• Supporting the compression of messages between client and server.

• Supporting the encryption of RDMA payloads through negotiation ofRDMA transforms.

• Supporting QUIC as a transport.

• Supporting mutual authentication and client access control overQUIC.