{"id":1252,"date":"2011-04-13T17:26:36","date_gmt":"2011-04-13T16:26:36","guid":{"rendered":"http:\/\/mccltd.net\/blog\/?p=1252"},"modified":"2011-04-13T17:26:36","modified_gmt":"2011-04-13T16:26:36","slug":"using-wireshark-to-examine-smb-signing-requirements","status":"publish","type":"post","link":"http:\/\/darenmatthews.com\/blog\/?p=1252","title":{"rendered":"Using Wireshark to examine SMB Signing Requirements"},"content":{"rendered":"<p>When a client connects to a server using SMB it sends a &#8220;Negotiate  Protocol Request&#8221;.\u00a0 In response to this, the server replies with a  &#8220;Negotiate Protocol Response&#8221;.\u00a0 This response reveals whether SMB  signing is enabled and whether it is required at the client, the server,  or both.<!--more--><\/p>\n<p>The &#8220;Security Mode&#8221; in the response will be one of: 3, 7 or 15 which  correspond with the Hexadecimal equivalent of the 4 bits UCHAR:<\/p>\n<p>bit 0: 0 = share<br \/>\nbit 0: 1 = user<br \/>\nbit 1: 1 = encrypt passwords<br \/>\nbit 2: 1 = Security Signatures (SMB sequence numbers) enabled<br \/>\nbit 3: 1 = Security Signatures (SMB sequence numbers) required<\/p>\n<ul>\n<li>If SMB signing is disabled at the server, the value is 3.<\/li>\n<li>If SMB signing is enabled and not required at the server, the value is 7.<\/li>\n<li>If SMB signing is enabled and required at the server, the value is 15.<\/li>\n<\/ul>\n<p>If SMB Signing is enabled and required at both the client and  the server, or if SMB signing is disabled at both the client and the  server, the connection is successful;<\/p>\n<p>If SMB signing is enabled  and required at the client and  disabled at the server, the connection to the TCP session is gracefully  closed after the Dialect Negotiation, and the client receives the  Windows error message &#8220;System error 1240 has occurred. The account is  not authorized to log in from this station.&#8221;<\/p>\n<p>Screenshot of Security Mode:<\/p>\n<p><a href=\"http:\/\/darenmatthews.com\/blog\/wp-content\/uploads\/2011\/04\/SMB-dialect.png\"><img loading=\"lazy\" class=\"aligncenter size-full wp-image-1253\" title=\"SMB-dialect\" src=\"http:\/\/darenmatthews.com\/blog\/wp-content\/uploads\/2011\/04\/SMB-dialect.png\" alt=\"SMB-dialect\" width=\"830\" height=\"437\" srcset=\"http:\/\/darenmatthews.com\/blog\/wp-content\/uploads\/2011\/04\/SMB-dialect.png 830w, http:\/\/darenmatthews.com\/blog\/wp-content\/uploads\/2011\/04\/SMB-dialect-300x157.png 300w\" sizes=\"(max-width: 830px) 100vw, 830px\" \/><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>When a client connects to a server using SMB it sends a &#8220;Negotiate Protocol Request&#8221;.\u00a0 In response to this, the server replies with a &#8220;Negotiate Protocol Response&#8221;.\u00a0 This response reveals whether SMB signing is enabled and whether it is required at the client, the server, or both.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[53],"tags":[49,37],"_links":{"self":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1252"}],"collection":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1252"}],"version-history":[{"count":1,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1252\/revisions"}],"predecessor-version":[{"id":1254,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1252\/revisions\/1254"}],"wp:attachment":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1252"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1252"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1252"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}