Hack the Route Start free Open app Network services
SMB/CIFS
Windows-style file and printer sharing on TCP 445: a client logs in, connects to a named share, and reads or writes its files.
SMB (Server Message Block, once called CIFS) is how Windows and Samba share folders and printers. A client
opens a TCP connection to port 445 and first negotiates a dialect: modern clients speak SMB2 or SMB3 and
refuse the old, insecure SMB1. It then logs in (a session setup, usually with NTLM or Kerberos), does a tree
connect to a share such as \\server\finance, and creates/reads/writes files inside it. A capture shows those
step names in order, so SMB is easy to spot. SMB1 and exposed port 445 are a classic risk (WannaCry spread over it).