Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My local machine is running Windows 7, which supports the latest released version of the SMB protocol (SMB 2.1). I also have a remote host, and I don't know what operating system or SMB-support software is installed on that remote host; I only know that the remote host supports some version of the SMB protocol.

How can I find out, from the command prompt (or PowerShell) of my Windows 7 machine, what version of SMB is supported by that remote host?

Edit: although I mention Windows 7 above, I'm sure that this question is relevant to many system/network administrators or desktop support personnel, hence why I'm posting the question here instead of at superuser.com.

share|improve this question
1  
good question don't have a great answer you may need to sniff the packets, and yes this can be done from the command line. Hopefully there is a better way then this. –  tony roth Apr 12 '12 at 2:44

2 Answers 2

The easiest way is to install WireShark and capture the packets, it will decode them and should show you a protocol version. They have an SMBv2 entry on their wiki, so the latest version of WireShark should decode it int the packet capture.

share|improve this answer
1  
In this case I'd use netmon 3.4, if you don't want to install it you don't have to just run "netsh trace start capture=yes" then connect to the share then run "netsh trace stop" the resultant *.cab file is readable by netmon 3.4 which does not have to be on he workstation/server that you are capturing on. –  tony roth Apr 12 '12 at 2:55

There are only two conceivable ways to determine a remote host's SMB version.

The First is to banner grab using telnet. Even then, you're not guaranteed that anything of use will come back. I can successfully connect to one of my SMB servers, but do not get any useful banner information.

The Second is to fingerprint the system over the network using a network security scanner. You'll have to search for a good tool thought, because you're still not guaranteed any success with determining what version of SMB is running. For example, I just used a quick scan with nmap on my network (that I know is running microsoft SMB on several endpoints) and I get no pertinent information as to what version of SMB it is running.

share|improve this answer
    
does nmap detect cifs version? haven't used it in a while. –  tony roth Apr 12 '12 at 2:57
    
@tonyroth There might be Nmap Scripting Engine addons that do it. I know of one smb vulnerability check - but you don't want to use that willy nilly as it'll hose the server. =) –  Wesley Apr 12 '12 at 3:00
1  
You have to use nmap with the "-sV -p 139" flags to get daemon details. eg. Samba smbd 3.X (workgroup: XXXX) –  Soviero Apr 12 '12 at 4:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.