Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor...
Transcript of Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor...
![Page 1: Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor Can’t Deal with Mid Frame ... Network Monitor 3 NM3 is a protocol analyzer and network](https://reader031.fdocuments.net/reader031/viewer/2022011800/5ad41ce67f8b9a571e8bd083/html5/thumbnails/1.jpg)
Storage Developer Conference 2009 © 2009 Insert Copyright information here. All rights reserved.
Analyzing SMB/SMB2 with
Network Monitor 3
![Page 2: Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor Can’t Deal with Mid Frame ... Network Monitor 3 NM3 is a protocol analyzer and network](https://reader031.fdocuments.net/reader031/viewer/2022011800/5ad41ce67f8b9a571e8bd083/html5/thumbnails/2.jpg)
Storage Developer Conference 2009 © 2009 Insert Copyright information here. All rights reserved.
Who are you?
Paul Long - Technical Evangelist for Network MonitorNetworking Specialist in CPR Support group for Microsoft for 15 yearsBlog on http://blogs.technet.com/netmon
2
![Page 3: Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor Can’t Deal with Mid Frame ... Network Monitor 3 NM3 is a protocol analyzer and network](https://reader031.fdocuments.net/reader031/viewer/2022011800/5ad41ce67f8b9a571e8bd083/html5/thumbnails/3.jpg)
Storage Developer Conference 2009 © 2009 Insert Copyright information here. All rights reserved.
What you will learn
Where SMB/SMB2 Documentation IsHow to Organizing Traffic with ConversationsUnderstand Reassembly and FragmentationFiltering Tips for SMB/SMB2 TrafficHow to Locate SMB/SMB2 Errors with Color FiltersDemo: SMB/SMB2 Trace Examples
3
![Page 4: Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor Can’t Deal with Mid Frame ... Network Monitor 3 NM3 is a protocol analyzer and network](https://reader031.fdocuments.net/reader031/viewer/2022011800/5ad41ce67f8b9a571e8bd083/html5/thumbnails/4.jpg)
Storage Developer Conference 2009 © 2009 Insert Copyright information here. All rights reserved.
Documentation of SMB/SMB2
Microsoft Open SpecificationsBing “MS-SMB” or “MS-SMB2”How Protocols Work Together
MS-SYSMS-PROTOMS-SECO
Open Protocol Forums
4
![Page 5: Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor Can’t Deal with Mid Frame ... Network Monitor 3 NM3 is a protocol analyzer and network](https://reader031.fdocuments.net/reader031/viewer/2022011800/5ad41ce67f8b9a571e8bd083/html5/thumbnails/5.jpg)
Storage Developer Conference 2009 © 2009 Insert Copyright information here. All rights reserved.
Organizing Traffic with Conversations
5
![Page 6: Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor Can’t Deal with Mid Frame ... Network Monitor 3 NM3 is a protocol analyzer and network](https://reader031.fdocuments.net/reader031/viewer/2022011800/5ad41ce67f8b9a571e8bd083/html5/thumbnails/6.jpg)
Storage Developer Conference 2009 © 2009 Insert Copyright information here. All rights reserved.
The Conversation Tree
Organizes Network Traffic by Grouping Like TrafficFor SMB, this means
by File ID or File NameSMB Transaction
6
![Page 7: Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor Can’t Deal with Mid Frame ... Network Monitor 3 NM3 is a protocol analyzer and network](https://reader031.fdocuments.net/reader031/viewer/2022011800/5ad41ce67f8b9a571e8bd083/html5/thumbnails/7.jpg)
Storage Developer Conference 2009 © 2009 Insert Copyright information here. All rights reserved.
Conversation Tree Tricks
Click on Tree Node to Filter TrafficRight Click Frame to Locate Conversation
7
![Page 8: Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor Can’t Deal with Mid Frame ... Network Monitor 3 NM3 is a protocol analyzer and network](https://reader031.fdocuments.net/reader031/viewer/2022011800/5ad41ce67f8b9a571e8bd083/html5/thumbnails/8.jpg)
Storage Developer Conference 2009 © 2009 Insert Copyright information here. All rights reserved.
Understanding Reassembly and Fragmentation
8
![Page 9: Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor Can’t Deal with Mid Frame ... Network Monitor 3 NM3 is a protocol analyzer and network](https://reader031.fdocuments.net/reader031/viewer/2022011800/5ad41ce67f8b9a571e8bd083/html5/thumbnails/9.jpg)
Storage Developer Conference 2009 © 2009 Insert Copyright information here. All rights reserved.
SMB/SMB2 and Fragmentation
SMB/SMB2 Big, Ethernet Frames SmallTCP/NBTSS can Fragment Data
Continuation frames are a keyNetwork Monitor does NOT reassemble by default
9
![Page 10: Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor Can’t Deal with Mid Frame ... Network Monitor 3 NM3 is a protocol analyzer and network](https://reader031.fdocuments.net/reader031/viewer/2022011800/5ad41ce67f8b9a571e8bd083/html5/thumbnails/10.jpg)
Storage Developer Conference 2009 © 2009 Insert Copyright information here. All rights reserved.
Reassembling with Network Monitor
Press Reassemble ButtonOnly Available on Saved Traces
New Window Appears, New Frames are InsertedNew Frames have PayloadHeader Prepended to Top
10
![Page 11: Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor Can’t Deal with Mid Frame ... Network Monitor 3 NM3 is a protocol analyzer and network](https://reader031.fdocuments.net/reader031/viewer/2022011800/5ad41ce67f8b9a571e8bd083/html5/thumbnails/11.jpg)
Storage Developer Conference 2009 © 2009 Insert Copyright information here. All rights reserved.
Working With Reassembled Trace
Newly Inserted Frame Follows Fragmented DataColor Filter Makes Finding Frames Easier
11
![Page 12: Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor Can’t Deal with Mid Frame ... Network Monitor 3 NM3 is a protocol analyzer and network](https://reader031.fdocuments.net/reader031/viewer/2022011800/5ad41ce67f8b9a571e8bd083/html5/thumbnails/12.jpg)
Storage Developer Conference 2009 © 2009 Insert Copyright information here. All rights reserved.
Mid Frame Fragmentation
Network Monitor Can’t Deal with Mid Frame FragmentationOccurs when NBTSS or TCP Streams Two SMB Commands TogetherCan use “Decode As”Filter to Find (or Color Filter)
12
(!smb AND !smb2)AND (ContainsBin(FrameData, HEX, "FF 53 4D 42")ORContainsBin(FrameData, HEX, "FE 53 4D 42"))
![Page 13: Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor Can’t Deal with Mid Frame ... Network Monitor 3 NM3 is a protocol analyzer and network](https://reader031.fdocuments.net/reader031/viewer/2022011800/5ad41ce67f8b9a571e8bd083/html5/thumbnails/13.jpg)
Storage Developer Conference 2009 © 2009 Insert Copyright information here. All rights reserved.
Mid Frame Fragmentation Example
13
![Page 14: Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor Can’t Deal with Mid Frame ... Network Monitor 3 NM3 is a protocol analyzer and network](https://reader031.fdocuments.net/reader031/viewer/2022011800/5ad41ce67f8b9a571e8bd083/html5/thumbnails/14.jpg)
Storage Developer Conference 2009 © 2009 Insert Copyright information here. All rights reserved.
Filtering Tips for SMB/SMB2 Traffic
14
![Page 15: Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor Can’t Deal with Mid Frame ... Network Monitor 3 NM3 is a protocol analyzer and network](https://reader031.fdocuments.net/reader031/viewer/2022011800/5ad41ce67f8b9a571e8bd083/html5/thumbnails/15.jpg)
Storage Developer Conference 2009 © 2009 Insert Copyright information here. All rights reserved.
Standard Filters SMB/SMB2
Standard Filters are Built Into Network MonitorCurrently 3 available Standard Filters for SMB
15
![Page 16: Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor Can’t Deal with Mid Frame ... Network Monitor 3 NM3 is a protocol analyzer and network](https://reader031.fdocuments.net/reader031/viewer/2022011800/5ad41ce67f8b9a571e8bd083/html5/thumbnails/16.jpg)
Storage Developer Conference 2009 © 2009 Insert Copyright information here. All rights reserved.
Right Click add to Filter
Click any field in Frame Details to create a filter that finds other frames with the same info.Great way to learn how to create filters!
16
SMB.SMBHeader.ProcessID == 0xfeff
![Page 17: Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor Can’t Deal with Mid Frame ... Network Monitor 3 NM3 is a protocol analyzer and network](https://reader031.fdocuments.net/reader031/viewer/2022011800/5ad41ce67f8b9a571e8bd083/html5/thumbnails/17.jpg)
Storage Developer Conference 2009 © 2009 Insert Copyright information here. All rights reserved.
Properties of Interest for SMB/SMB2
Properties are Meta Data defined by the ParserProperty.SMBFileName.contains(“.txt”)Property.SMBCommand == 0x72Property.SMBMID == 0x40SMB File ID
Property.SMBFileID == 0x4000
SMB2 File IDProperty.SMBFileIDPersistentProperty.SMBFileIDVolatile
17
![Page 18: Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor Can’t Deal with Mid Frame ... Network Monitor 3 NM3 is a protocol analyzer and network](https://reader031.fdocuments.net/reader031/viewer/2022011800/5ad41ce67f8b9a571e8bd083/html5/thumbnails/18.jpg)
Storage Developer Conference 2009 © 2009 Insert Copyright information here. All rights reserved.
Properties of Interest for SMB/SMB2
Many others, to find type “Property.SMB” and use Intellisense.
18
![Page 19: Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor Can’t Deal with Mid Frame ... Network Monitor 3 NM3 is a protocol analyzer and network](https://reader031.fdocuments.net/reader031/viewer/2022011800/5ad41ce67f8b9a571e8bd083/html5/thumbnails/19.jpg)
Storage Developer Conference 2009 © 2009 Insert Copyright information here. All rights reserved.
Properties As Columns
Any Property can be added as a column in Column Chooser
19
![Page 20: Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor Can’t Deal with Mid Frame ... Network Monitor 3 NM3 is a protocol analyzer and network](https://reader031.fdocuments.net/reader031/viewer/2022011800/5ad41ce67f8b9a571e8bd083/html5/thumbnails/20.jpg)
Storage Developer Conference 2009 © 2009 Insert Copyright information here. All rights reserved.
Locating SMB/SMB2 Errors Trace with Color Filters
20
![Page 21: Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor Can’t Deal with Mid Frame ... Network Monitor 3 NM3 is a protocol analyzer and network](https://reader031.fdocuments.net/reader031/viewer/2022011800/5ad41ce67f8b9a571e8bd083/html5/thumbnails/21.jpg)
Storage Developer Conference 2009 © 2009 Insert Copyright information here. All rights reserved.
Color Filter for SMB Errors
Filter will find any frame with an SMB error.
21
(smb.DOSError.Error != 0 AND smb.DOSError.Error != 22)OR(smb.NTStatus.Code != 0 && smb.NTStatus.Code!= 22)
![Page 22: Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor Can’t Deal with Mid Frame ... Network Monitor 3 NM3 is a protocol analyzer and network](https://reader031.fdocuments.net/reader031/viewer/2022011800/5ad41ce67f8b9a571e8bd083/html5/thumbnails/22.jpg)
Storage Developer Conference 2009 © 2009 Insert Copyright information here. All rights reserved.
Color Filter for SMB2 Errors
Filter will find any frame with an SMB2 error.
22
SMB2Header.Status != 0 ANDsmb2.SMB2Header.Status != 259
![Page 23: Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor Can’t Deal with Mid Frame ... Network Monitor 3 NM3 is a protocol analyzer and network](https://reader031.fdocuments.net/reader031/viewer/2022011800/5ad41ce67f8b9a571e8bd083/html5/thumbnails/23.jpg)
Storage Developer Conference 2009 © 2009 Insert Copyright information here. All rights reserved.
Demos
23
![Page 24: Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor Can’t Deal with Mid Frame ... Network Monitor 3 NM3 is a protocol analyzer and network](https://reader031.fdocuments.net/reader031/viewer/2022011800/5ad41ce67f8b9a571e8bd083/html5/thumbnails/24.jpg)
Storage Developer Conference 2009 © 2009 Insert Copyright information here. All rights reserved.
Demo: Trace Examples
Trouble Shooting a Delayed Write FailureLooking at SMB Oplocks
24
![Page 25: Analyzing SMB/SMB2 with Network Monitor 3 - SNIA Tips for SMB/SMB2 Traffic ... Network Monitor Can’t Deal with Mid Frame ... Network Monitor 3 NM3 is a protocol analyzer and network](https://reader031.fdocuments.net/reader031/viewer/2022011800/5ad41ce67f8b9a571e8bd083/html5/thumbnails/25.jpg)
Storage Developer Conference 2009 © 2009 Insert Copyright information here. All rights reserved.
Network Monitor 3
NM3 is a protocol analyzer and network capture tool. Features such as Process Tracking and the Conversation Tree allow you to quickly locate traffic.
http://www.microsoft.com/downloads Latest released version.http://blogs.technet.com/netmon - Includes general help topics and training videos.http://social.technet.microsoft.com/Forums/en/netmon -Public Support Forumshttp://www.CodePlex.com/NMParsers - Open Source Parsers and latest parser version.http://www.CodePlex.com/NMExperts - Experts Landing Pagehttp://connect.microsoft.com – Latest Betas, Beta support Forums and Bug Reporting