SMB

SMB, short for Server Message Block, is a client-server network file sharing protocol that lets computers open, read, write, lock and manage files and folders stored on a remote server as if they were local. In server storage, SMB is the standard way Windows clients, and many Linux and macOS clients, reach file-level shares on a file server or a NAS appliance.

The protocol is also known by the older name CIFS (Common Internet File System), which refers to an early dialect. Modern deployments use SMB 3.x, which adds encryption, multichannel transport and transparent failover, and which makes SMB suitable not only for office documents but also for virtual machine disks and database files in clustered environments.

How SMB works between client and server

SMB works as a request-response protocol over a session: the client connects, negotiates a dialect, authenticates, attaches to a share and then issues file operations. Modern SMB runs directly over TCP port 445; the legacy NetBIOS transport on ports 137-139 is obsolete and should be disabled.

Each connection passes through a fixed sequence of exchanges. The negotiate step selects the highest dialect both sides support, which is why a single outdated client can force a weaker protocol version if the server still allows it.

Beyond plain reads and writes, SMB carries rich file semantics: NTFS-style permissions (ACLs), byte-range locks, file change notifications and opportunistic locks, called leases in SMB 2.1 and later. A lease lets a client cache data locally while no one else touches the file, which sharply reduces round trips on high-latency links.

SMB dialects and their capabilities

SMB is not one fixed protocol but a family of dialects, and the negotiated dialect determines security and performance. The original SMB 1 (including CIFS) is chatty, insecure and disabled by default in current Windows releases; it was the vector for well-known worm outbreaks and should never be enabled on a production server.

Three SMB 3 features matter most in server storage. SMB Multichannel spreads one session across several network interfaces for throughput and resilience. SMB Direct uses RDMA network adapters to move data with very low CPU cost. Transparent failover with continuously available shares lets a clustered file server switch nodes without breaking open handles.

SMB compared with NFS, iSCSI and other storage access methods

SMB is a file-level protocol: the server owns the file system and clients see files and folders. This separates it from block-level protocols such as iSCSI and Fibre Channel SAN, where the client receives a raw volume and formats it itself, and from object storage accessed over HTTP APIs.

The practical difference from NFS lies in the identity and permission model. SMB is built around Active Directory accounts, Kerberos and Windows ACLs, while NFS traditionally maps numeric UNIX user and group IDs. Mixed environments that expose the same data over both protocols need careful identity mapping to avoid permission surprises.

Deploying and tuning SMB shares

A reliable SMB deployment starts with disabling SMB 1, joining the server to a directory for Kerberos authentication and setting share permissions and file system ACLs deliberately. On Linux, Samba implements the SMB server side and can act as a member server or even an Active Directory domain controller.

Performance depends heavily on latency and storage behind the share. SMB 3 with multichannel can saturate 10, 25 or 100 Gbit/s links when the underlying RAID or SSD pool keeps up. Signing and encryption add CPU cost, but modern processors with AES instructions usually absorb it with only a modest throughput penalty.

Security risks and common SMB mistakes

The most serious SMB risk is exposing port 445 to the internet. SMB is designed for trusted internal networks and remote access should go through a VPN or an SMB over QUIC gateway, never a direct firewall opening.

• Leaving SMB 1 enabled for one legacy device, which weakens every connection to that server.
• Allowing NTLM relay by not requiring signing, which lets attackers impersonate users.
• Granting Everyone Full Control on the share and relying only on folder ACLs, which complicates audits.
• Treating an SMB share as a backup, although ransomware on a client can encrypt every file it can write.
• Running databases on shares without continuous availability, which risks corruption during a node failover.

Because SMB grants write access to everything a user account can reach, ransomware spreads naturally through mapped drives. Least-privilege share design, snapshots on the storage system and separate backup copies limit the damage.

Put simply

SMB is the language computers use for shared folders on another machine. An office worker opens a drive letter such as S: and edits a spreadsheet on the company file server. SMB carries every click, save and lock across the network.

Think of it as a librarian for shared files. It checks who you are. It decides what you may open. It stops two people from overwriting the same page at once. The key point is that files stay on the server, while people work with them as if they were on their own computer.

In practice

A mid-sized engineering firm runs a two-node Windows Server failover cluster with a shared storage pool. Users reach their project folders through a standard SMB share, while a second share is configured as continuously available for the Hyper-V hosts that store virtual machine disks on it.

The administrators disable SMB 1, require signing on all shares, enable encryption for the share used by a branch office over the WAN and give each server two 25 Gbit/s ports so that SMB Multichannel balances traffic. During a planned patch, one cluster node is restarted: the file server role moves to the second node within seconds and the running virtual machines continue without losing their open disk handles.

The outcome is a single protocol serving both office documents and virtualization workloads, with no downtime during maintenance and no legacy protocol left open for attackers.