Language: English
- 2026-11-02 –, Room 3
- 2026-11-03 –, Room 3
All times in Europe/Brussels SMB is the bread and butter protocol used to access file shares in virtually every company and home network. Since Windows Vista / Server 2008, the "classic" SMB has been replaced by SMB2 and later SMB3. As legacy systems running Windows XP / Server 2003 are increasingly rare, we focus on the newer version. Based on student feedback the class from 2025 is now offered as a 2 day class. The 2 day format allows more time for practical exercises.
This class will enable students to investigate functional issues and performance problems. Topics covered are
- SMB Handshake, selection of a dialect version and user authentication
- General process of mounting a share and accessing files
- Tracking SMB sessions over multiple interfaces or IP-addresses
- Investigating error codes
- Decryption of SMB traffic (not for the faint-hearted)
- The role of Kerberos in authentication, encryption and Wireshark-based decryption
- Understanding the service response time feature for SMB
- Baselining application behavior for SMB file access
- identification of performance bottlenecks in the network, application logic, client or server
- SMB functions beyond file sharing (IPC, Named Pipes)
- Identificaiton of malicious named pipes, that could be used for malware control
Here is, what previous students say about the class:
- Great class, good walk throu of SMB troubleshooting. I enjoyed it very much. Made a lot of things i struggled with earlier a lot clearer to me.
- It was fantastic! I now definitely have a better overview over what SMB is doing.
- Great and awesome deep dive!!!
For over 20 years, Eddi has been looking at network protocols to find (or rule out) network problems, vulnerabilities, ongoing hacking attacks or just for fun.
Working for the Swiss train company BLS as IT security analyst, he is reviewing the configuration of a multitude of systems to improve the overall security of the domain. Wireshark is one of the tools to verify the outcome of a configuration change.
Shameless promotion: Visit https://www.bls.ch/en/freizeit-und-ferien/ausflug to find some of the best destinations in Switzerland.