Server Message Block

Server Message Block
source
Name	Server Message Block
Developer	IBM, Microsoft Corporation, Andrew Tridgell
Introduced	1980s
Latest release	SMB 3.1.1
Os	Microsoft Windows, Linux, macOS
Website	Microsoft Protocol Documentation

Server Message Block Server Message Block is a network file sharing protocol widely used for providing shared access to files, printers, serial ports, and communications between nodes on a network. It originated in the 1980s and has been extended through multiple versions and implementations in major computing environments such as Microsoft Corporation, IBM, and the Samba project. SMB underpins file services in many enterprise and consumer products from vendors including NetApp, EMC, Dell, and Hewlett-Packard.

Overview

SMB enables applications on systems like Microsoft Windows, macOS, Linux, FreeBSD, and network-attached storage from Synology and QNAP to read and write files and request services from server programs across a network. It operates as an application-layer network protocol often transported via NetBIOS over TCP/IP, TCP/IP ports 139 and 445, and can interact with directory services such as Active Directory and LDAP. SMB sessions involve negotiation, authentication, and message framing, and are often implemented alongside protocols and technologies like Kerberos, NTLM, TLS, and IPsec.

History and Development

The protocol traces roots to work by IBM and researchers in the 1980s; later, Microsoft Corporation incorporated SMB into MS-DOS, Windows NT, and subsequent operating systems. The Samba project, started by Andrew Tridgell, provided an open-source implementation that enabled interoperability between Unix-like systems and Windows NT domains. Major milestones include the transition from early SMB/CIFS dialects used in Windows for Workgroups and Windows 95 to the performance and security-focused SMB2 introduced with Windows Vista and Windows Server 2008, and subsequent SMB3 revisions introduced with Windows 8 and Windows Server 2012 that added encryption and clustering features influenced by storage vendors like NetApp and EMC.

Protocol Architecture and Operation

SMB defines a client–server architecture with operations for file and printer services, message signing, and session management. It is commonly encapsulated over transport protocols standardized by IETF working groups and routed across TCP/IP networks. Authentication mechanisms include challenges and tokens compatible with Kerberos and NTLM, and integration points link to identity systems such as Active Directory and LDAP. SMB dialect negotiation selects capabilities such as opportunistic locking, large MTU support, and durable handles for high-availability clusters used by Windows Server 2012 R2 and storage arrays from Dell EMC and NetApp.

Features and Extensions

Later SMB versions introduced features tailored to modern datacenters and virtualization: end-to-end encryption (AES-based), persistent handles for failover with Hyper-V, multichannel network capabilities enabling multiple TCP connections and RDMA through RoCE and iWARP, directory leasing, and remote direct access enhancements for Microsoft Azure integration. SMB also supports advanced file operations like leasing, oplocks, change notification, and cluster share witness features used by VMware ESXi, Citrix Systems, and Oracle Corporation storage solutions. Extensions developed by implementers such as Samba, FreeBSD, and Apple Inc. adapt these features for cross-platform interoperability.

Security and Vulnerabilities

SMB has been the vector for notable security incidents and research by institutions including CERT Coordination Center, NIST, and independent security firms like Kaspersky Lab and Symantec. High-profile exploits leveraged vulnerabilities in SMB implementations to propagate malware across networks, with incidents affecting organizations like NHS and corporations globally. Mitigations involve protocol hardening by Microsoft Corporation (security patches), adoption of Kerberos authentication, mandatory message signing, SMB encryption, network segmentation strategies employed by enterprises like Cisco and Juniper Networks, and intrusion detection from vendors such as Palo Alto Networks and Fortinet. Security research continues to assess SMB features such as relay attacks, man-in-the-middle vectors, and implementation bugs in projects like Samba and SChannel stacks.

Implementations and Use Cases

Implementations exist across a broad ecosystem: Microsoft Windows native servers and clients, Samba on Linux and FreeBSD, Apple Inc.'s SMB client on macOS, and embedded stacks in network appliances by Synology, QNAP, Netgear, and enterprise storage from NetApp and Dell EMC. Use cases include file sharing in corporate environments using Active Directory domains, home media streaming with Plex or Kodi, backup targets for Veeam Software and Commvault, and SMB-based clustering for Microsoft Hyper-V and VMware vSphere. Third-party tools and libraries by organizations like Red Hat and Canonical facilitate integration, while cloud providers such as Microsoft Azure and Amazon Web Services offer SMB-compatible file services.

Category:Network protocols