# smb analyzer does not seem to be enabled

**URL:** <https://community.zeek.org/t/smb-analyzer-does-not-seem-to-be-enabled/4358>\
**Category:** Zeek\
**Created:** [September 22, 2016, 2:36pm UTC](https://community.zeek.org/t/smb-analyzer-does-not-seem-to-be-enabled/4358 "2016-09-22T14:36:42Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![erik\_clark](https://avatars.discourse-cdn.com/v4/letter/e/ba8739/32.png) [@erik\_clark](https://community.zeek.org/u/erik_clark)\
**Post date:** [September 22, 2016, 2:36pm UTC](https://community.zeek.org/t/smb-analyzer-does-not-seem-to-be-enabled/4358/1 "2016-09-22T14:36:42Z")

</div>

Fresh built 25master, feeding bro a pcap with 445 traffic, no smb logs produced. Do you need to explicitly enable it somewhere?

---

<div class="post-metadata">

**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\
**Post date:** [September 22, 2016, 2:54pm UTC](https://community.zeek.org/t/smb-analyzer-does-not-seem-to-be-enabled/4358/2 "2016-09-22T14:54:00Z")

</div>

local.bro:

# Uncomment the following line to enable the SMB analyzer. The analyzer  
# is currently considered a preview and therefore not loaded by default.  
# @load policy/protocols/smb

---

<div class="post-metadata">

**Author:** ![erik\_clark](https://avatars.discourse-cdn.com/v4/letter/e/ba8739/32.png) [@erik\_clark](https://community.zeek.org/u/erik_clark)\
**Post date:** [September 22, 2016, 3:49pm UTC](https://community.zeek.org/t/smb-analyzer-does-not-seem-to-be-enabled/4358/3 "2016-09-22T15:49:44Z")

</div>

Hm. I enabled it in

/opt/bro/share/bro/site/local.bro

→ @load policy/protocols/smb

and I ran a pcap with exclusively 445 port traffic, but got nothing back. The pcap is 70 megs big. (tcpdump -w pcap “port 445”)

I am trying to get output from smb2.pcap (included in Traces directory in the master branch), but that also does not produce any smb logs.

bro -N shows → Bro::SMB - SMB analyzer (built-in)

so I am not sure why the entry in local.bro is apparently not causing smb events to fire? Thanks for your time!

---

<div class="post-metadata">

**Author:** ![erik\_clark](https://avatars.discourse-cdn.com/v4/letter/e/ba8739/32.png) [@erik\_clark](https://community.zeek.org/u/erik_clark)\
**Post date:** [September 22, 2016, 3:53pm UTC](https://community.zeek.org/t/smb-analyzer-does-not-seem-to-be-enabled/4358/4 "2016-09-22T15:53:32Z")

</div>

AH ignore this! I am not getting any smb traffic I guess on this link, and I had to explicitly call the smb analyzer:

bro -C -r $pcap /opt/bro/share/bro/policy/protocols/smb/ **load**.bro

Thanks all, this works fantastic!

---

<div class="post-metadata">

**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\
**Post date:** [September 22, 2016, 3:55pm UTC](https://community.zeek.org/t/smb-analyzer-does-not-seem-to-be-enabled/4358/5 "2016-09-22T15:55:48Z")

</div>

How did you run the pcap file? If you just ran

&nbsp;&nbsp;&nbsp;&nbsp;bro -r foo.pcap

that does not load the local config, you need to use

&nbsp;&nbsp;&nbsp;&nbsp;bro local -r foo.pcap

or use `broctl process`.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/smb-analyzer-does-not-seem-to-be-enabled/4358/6 "2022-05-06T15:44:03Z")

</div>