# Help enabling SMB protocol detection **URL:** \ **Category:** Zeek\ **Created:** [August 6, 2018, 6:29pm UTC](https://community.zeek.org/t/help-enabling-smb-protocol-detection/5402 "2018-08-06T18:29:36Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Will\_Hawkins](https://avatars.discourse-cdn.com/v4/letter/w/71c47a/32.png) [@Will\_Hawkins](https://community.zeek.org/u/Will_Hawkins)\ **Post date:** [August 6, 2018, 6:29pm UTC](https://community.zeek.org/t/help-enabling-smb-protocol-detection/5402/1 "2018-08-06T18:29:36Z")
Hello Bro Community! First, let me apologize for asking a very dumb question. I have sincerely tried to RTFM and I have done my research (Google, right/) but cannot seem to find the answer. I am attempting to analyize a pcap file that contains lots of SMB traffic using bro. I have a version of bro with built-in SMB protocol support: $ bro -n Bro::SMB Bro::SMB - SMB analyzer (built-in) That said, when I run bro -C -r ../XXX.pcapng I do not get a smb.log. That leads me to believe that SMB analysis is not enabled. I've tried looking for bro files in /usr/share/protocols/ (etc) and cannot seem to find any. Editing a bro config file and adding @load base/protocols/smb gives me an error on bro startup. Can you tell me what stupid thing I am doing wrong? Thank you very much for your help. Again, I am sorry that this is such a silly question. I wish that I could answer it on my own! Will ---
**Author:** ![Will\_Hawkins](https://avatars.discourse-cdn.com/v4/letter/w/71c47a/32.png) [@Will\_Hawkins](https://community.zeek.org/u/Will_Hawkins)\ **Post date:** [August 6, 2018, 8:20pm UTC](https://community.zeek.org/t/help-enabling-smb-protocol-detection/5402/2 "2018-08-06T20:20:13Z")
Well, I've figured out my own problem. Sorry to be so dense. It turns out that the packaged version of bro for Ubuntu has built-in support for SMB but it does not have any of the attendant protocol or policy files. I built bro from git to make sure that everything was up-to-date and had success. Once you get the right bro version, the only step of enabling SMB protocol analysis is to follow the comments in the local.bro file and uncomment and single line: # @load policy/protocols/smb Once that's uncommented, everything works great! Again, sorry about the previous question. Thanks for being such an inviting and helpful community for the bro users. It's a great tool and having a great community is icing on the cake! Will ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [August 13, 2018, 12:57am UTC](https://community.zeek.org/t/help-enabling-smb-protocol-detection/5402/3 "2018-08-13T00:57:43Z")
> Well, I've figured out my own problem. Sorry to be so dense. > > It turns out that the packaged version of bro for Ubuntu has built-in > support for SMB but it does not have any of the attendant protocol or > policy files. I built bro from git to make sure that everything was > up-to-date and had success. Out of curiosity - Is that the Bro version that ships with Ubuntu (as opposed to the packages that we provide)? If yes, we should probably contact the Ubuntu folks and tell them that that is not that great 🙂 Johanna ---
**Author:** ![Will\_Hawkins](https://avatars.discourse-cdn.com/v4/letter/w/71c47a/32.png) [@Will\_Hawkins](https://community.zeek.org/u/Will_Hawkins)\ **Post date:** [August 13, 2018, 3:53am UTC](https://community.zeek.org/t/help-enabling-smb-protocol-detection/5402/4 "2018-08-13T03:53:42Z")
> \> Well, I've figured out my own problem. Sorry to be so dense. > \> > \> It turns out that the packaged version of bro for Ubuntu has built-in > \> support for SMB but it does not have any of the attendant protocol or > \> policy files. I built bro from git to make sure that everything was > \> up-to-date and had success. > > Out of curiosity - Is that the Bro version that ships with Ubuntu (as > opposed to the packages that we provide)? > > If yes, we should probably contact the Ubuntu folks and tell them that > that is not that great 🙂 Thanks for taking the time to respond, Johanna! I am running Ubuntu 16.04 LTS. That was the most up-to-date LTS until a few months ago when they released 18.04 LTS. That means that it may not be as meaningful to follow up with them about a bad distribution of bro. However, I will still give you the details in case they have not fixed the issue in the latest version. On Ubuntu 16.04 LTS, I have $ bro --version bro version 2.4.1 and I have native support for SMB: $ bro -N | grep -i smb Bro::SMB - SMB analyzer (built-in) However, I do not have the necessary policy and protocol files necessary to actually use that support: pwd /usr/share/bro find . -iname '\*smb\*' -print ./base/bif/plugins/Bro\_SMB.events.bif.bro Compare that with the files that I have when I install from source: $ find . -iname '\*smb\*' -print ./policy/protocols/smb ./policy/protocols/smb/smb2-main.bro ./policy/protocols/smb/smb1-main.bro ./base/bif/plugins/Bro\_SMB.smb1\_com\_echo.bif.bro ./base/bif/plugins/Bro\_SMB.smb2\_com\_set\_info.bif.bro ./base/bif/plugins/Bro\_SMB.smb1\_com\_tree\_disconnect.bif.bro ./base/bif/plugins/Bro\_SMB.smb1\_com\_read\_andx.bif.bro ./base/bif/plugins/Bro\_SMB.smb1\_com\_logoff\_andx.bif.bro ./base/bif/plugins/Bro\_SMB.smb1\_com\_close.bif.bro ./base/bif/plugins/Bro\_SMB.smb1\_com\_negotiate.bif.bro ./base/bif/plugins/Bro\_SMB.smb1\_com\_transaction2\_secondary.bif.bro ./base/bif/plugins/Bro\_SMB.smb1\_com\_tree\_connect\_andx.bif.bro ./base/bif/plugins/Bro\_SMB.smb2\_com\_create.bif.bro ./base/bif/plugins/Bro\_SMB.smb1\_com\_query\_information.bif.bro ./base/bif/plugins/Bro\_SMB.smb2\_com\_close.bif.bro ./base/bif/plugins/Bro\_SMB.smb1\_com\_nt\_cancel.bif.bro ./base/bif/plugins/Bro\_SMB.smb2\_events.bif.bro ./base/bif/plugins/Bro\_SMB.smb1\_events.bif.bro ./base/bif/plugins/Bro\_SMB.consts.bif.bro ./base/bif/plugins/Bro\_SMB.smb1\_com\_write\_andx.bif.bro ./base/bif/plugins/Bro\_SMB.events.bif.bro ./base/bif/plugins/Bro\_SMB.smb2\_com\_tree\_connect.bif.bro ./base/bif/plugins/Bro\_SMB.smb2\_com\_tree\_disconnect.bif.bro ./base/bif/plugins/Bro\_SMB.smb1\_com\_transaction.bif.bro ./base/bif/plugins/Bro\_SMB.smb2\_com\_session\_setup.bif.bro ./base/bif/plugins/Bro\_SMB.smb1\_com\_check\_directory.bif.bro ./base/bif/plugins/Bro\_SMB.smb1\_com\_session\_setup\_andx.bif.bro ./base/bif/plugins/Bro\_SMB.smb2\_com\_write.bif.bro ./base/bif/plugins/Bro\_SMB.smb2\_com\_read.bif.bro ./base/bif/plugins/Bro\_SMB.types.bif.bro ./base/bif/plugins/Bro\_SMB.smb1\_com\_create\_directory.bif.bro ./base/bif/plugins/Bro\_SMB.smb1\_com\_transaction\_secondary.bif.bro ./base/bif/plugins/Bro\_SMB.smb2\_com\_negotiate.bif.bro ./base/bif/plugins/Bro\_SMB.smb1\_com\_transaction2.bif.bro ./base/bif/plugins/Bro\_SMB.smb1\_com\_nt\_create\_andx.bif.bro ./base/protocols/smb I am waiting for Ubuntu to finalize it's 16.04 to 18.04 upgrade pathway to install the latest LTS on my laptop. As soon as that happens, I am happy to try this test again if you think it would be worthwhile! I hope that this information helps! Thanks again for reaching out and responding -- the bro community is really great! Will ---
**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\ **Post date:** [August 13, 2018, 2:03pm UTC](https://community.zeek.org/t/help-enabling-smb-protocol-detection/5402/5 "2018-08-13T14:03:23Z")
ah.. SMB support was part of 2.5. 2.4.1 only had a few events and not the full analyzer. Ubuntu 18.0.4 (bionic) has 2.5.3 and has the expected files: $ curl -s [https://packages.ubuntu.com/xenial/all/bro-common/filelist|grep](https://packages.ubuntu.com/xenial/all/bro-common/filelist%7Cgrep) -i smb /usr/share/bro/base/bif/plugins/Bro\_SMB.events.bif.bro $ curl -s [https://packages.ubuntu.com/bionic/all/bro-common/filelist|grep](https://packages.ubuntu.com/bionic/all/bro-common/filelist%7Cgrep) -i smb /usr/share/bro/base/bif/plugins/Bro\_SMB.consts.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.events.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb1\_com\_check\_directory.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb1\_com\_close.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb1\_com\_create\_directory.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb1\_com\_echo.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb1\_com\_logoff\_andx.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb1\_com\_negotiate.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb1\_com\_nt\_cancel.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb1\_com\_nt\_create\_andx.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb1\_com\_query\_information.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb1\_com\_read\_andx.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb1\_com\_session\_setup\_andx.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb1\_com\_transaction.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb1\_com\_transaction2.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb1\_com\_tree\_connect\_andx.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb1\_com\_tree\_disconnect.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb1\_com\_write\_andx.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb1\_events.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb2\_com\_close.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb2\_com\_create.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb2\_com\_negotiate.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb2\_com\_read.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb2\_com\_session\_setup.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb2\_com\_set\_info.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb2\_com\_tree\_connect.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb2\_com\_tree\_disconnect.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb2\_com\_write.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.smb2\_events.bif.bro /usr/share/bro/base/bif/plugins/Bro\_SMB.types.bif.bro /usr/share/bro/base/protocols/smb/\_\_load\_\_.bro /usr/share/bro/base/protocols/smb/const-dos-error.bro /usr/share/bro/base/protocols/smb/const-nt-status.bro /usr/share/bro/base/protocols/smb/consts.bro /usr/share/bro/policy/protocols/smb/\_\_load\_\_.bro /usr/share/bro/policy/protocols/smb/dpd.sig /usr/share/bro/policy/protocols/smb/files.bro /usr/share/bro/policy/protocols/smb/main.bro /usr/share/bro/policy/protocols/smb/smb1-main.bro /usr/share/bro/policy/protocols/smb/smb2-main.bro ---
**Author:** ![Will\_Hawkins](https://avatars.discourse-cdn.com/v4/letter/w/71c47a/32.png) [@Will\_Hawkins](https://community.zeek.org/u/Will_Hawkins)\ **Post date:** [August 13, 2018, 7:29pm UTC](https://community.zeek.org/t/help-enabling-smb-protocol-detection/5402/6 "2018-08-13T19:29:35Z")
I figured that the problem was largely related to the fact that the LTS distribution I was using had an outdated version of bro. Thank you for confirming. Like I said, once I get 18.04 LTS installed, I will run this little experiment again and make sure that everything “just works” with the latest distribution. If there are still problems, we can tackle them then. Thanks again for following up! Will ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/help-enabling-smb-protocol-detection/5402/7 "2022-05-06T15:45:58Z")