0

I am not able to connect to Windows SMB shares on some hosts since we've disabled SMBv1 on our domain. After doing some research with Wireshark, it seems my Mac is only offering SMBv1 as an option to some hosts:

Internet Protocol Version 4, Src: 10.10.10.75 (10.10.10.75), Dst: 10.10.11.201 (10.10.11.201)
Transmission Control Protocol, Src Port: 62280, Dst Port: 445, Seq: 1, Ack: 1, Len: 51
SMB (Server Message Block Protocol)
    SMB Header
    Negotiate Protocol Request (0x72)
        Word Count (WCT): 0
        Byte Count (BCC): 12
        Requested Dialects
            Dialect: NT LM 0.12
                Buffer Format: Dialect (2)
                Name: NT LM 0.12

This is NOT the same behavior I see when connecting SMB to another host (which is still working after negotiating SMBv2):

Internet Protocol Version 4, Src: 10.10.10.75 (10.10.10.75), Dst: 10.10.11.75 (10.10.11.75)
Transmission Control Protocol, Src Port: 62914, Dst Port: 445, Seq: 1, Ack: 1, Len: 73
SMB (Server Message Block Protocol)
    SMB Header
    Negotiate Protocol Request (0x72)
        Word Count (WCT): 0
        Byte Count (BCC): 34
        Requested Dialects
            Dialect: NT LM 0.12
            Dialect: SMB 2.002
            Dialect: SMB 2.???

These hosts are in the same domain, and I am using the same method to connect to them (Finder, cmd-K, cifs://./c$). Everything I can find indicates that El Capitan should use SMBv3 in all cases — does anyone know why it only tries SMBv1 here?

1

Okay, well after some more investigation it looks like changing cifs:// to smb:// results in the desired effect — SMBv2 is requested and the mount succeeds. I've always used cifs:// in the past though as this seemed the most reliable method, but after finding the article here I think this was misguided.

  • Still don't understand why cifs:// works for some servers and not others — bonus points if anyone can explain this :) – ebarrere May 30 '17 at 21:21
  • CIFS is an enhanced version of SMBv1. It appears like the Linux kernel has expanded CIFS to support SMBv2. This means its likely Apple has extended CIFS support for SMBv2 and SMBv3 also. If thats the case then its possible the other clients have SMBv1 specifically disabled. – Ramhound May 30 '17 at 22:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.