# SMB connections **URL:** \ **Category:** Zeek\ **Created:** [November 30, 2015, 10:48am UTC](https://community.zeek.org/t/smb-connections/3922 "2015-11-30T10:48:54Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Zied\_Turki](https://avatars.discourse-cdn.com/v4/letter/z/dfb087/32.png) [@Zied\_Turki](https://community.zeek.org/u/Zied_Turki)\ **Post date:** [November 30, 2015, 10:48am UTC](https://community.zeek.org/t/smb-connections/3922/1 "2015-11-30T10:48:54Z")
Hello Bro Community, I am working on the data exfiltration and I have just tested the Exfil Framework. I have noticed, that the script failed to detect file uploads from the file server using SMB protocol. Looking to the connections logs (conn.log), the SMB connections are unfortunately not logged. Would it be a known issue ? or should I tune some params ? Please note that the trafic arrives to Bro machine (I have checked using tcpdump). Many thanks, BR, Zied ---
**Author:** ![Vlad\_Grigorescu3](https://avatars.discourse-cdn.com/v4/letter/v/dec6dc/32.png) [@Vlad\_Grigorescu3](https://community.zeek.org/u/Vlad_Grigorescu3)\ **Post date:** [November 30, 2015, 5:08pm UTC](https://community.zeek.org/t/smb-connections/3922/2 "2015-11-30T17:08:17Z")
Hi, The Exfil Framework is developed by someone from Reservoir Labs. Please contact them with any questions. That being said, note that SMB support in Bro is a best-effort implementation of part of the specification (and very different from what's actually seen on the wire), so detecting exfil over SMB likely won't work at all.   --Vlad Zied Turki \<[zied.turki@outlook.com](mailto:zied.turki@outlook.com)\> writes: ---
**Author:** ![Robert\_Rotsted1](https://avatars.discourse-cdn.com/v4/letter/r/e19b73/32.png) [@Robert\_Rotsted1](https://community.zeek.org/u/Robert_Rotsted1)\ **Post date:** [November 30, 2015, 7:44pm UTC](https://community.zeek.org/t/smb-connections/3922/3 "2015-11-30T19:44:13Z")
Hi Zied, By default, the Exfil framework will only attach to flows originated by addresses in 10.0.0.0/8 that have a non-local responder. Try setting "ignore\_local\_dest\_conn" to F in app-exfil-conn.bro. --bob ---
**Author:** ![Zied\_Turki](https://avatars.discourse-cdn.com/v4/letter/z/dfb087/32.png) [@Zied\_Turki](https://community.zeek.org/u/Zied_Turki)\ **Post date:** [December 1, 2015, 12:43pm UTC](https://community.zeek.org/t/smb-connections/3922/4 "2015-12-01T12:43:43Z")
Hello, I have already set this variable to False. I have also tried some others scripts to log the SMB connections. I’ve got random log outputs : only few SMB connections were logged but not all of them… Many thanks, BR, Zied ---
**Author:** ![Robert\_Rotsted1](https://avatars.discourse-cdn.com/v4/letter/r/e19b73/32.png) [@Robert\_Rotsted1](https://community.zeek.org/u/Robert_Rotsted1)\ **Post date:** [December 1, 2015, 3:47pm UTC](https://community.zeek.org/t/smb-connections/3922/5 "2015-12-01T15:47:14Z")
How big are the files that you are transferring? What percentage loss are you seeing in you capture\_loss log? ---
**Author:** ![Zied\_Turki](https://avatars.discourse-cdn.com/v4/letter/z/dfb087/32.png) [@Zied\_Turki](https://community.zeek.org/u/Zied_Turki)\ **Post date:** [December 1, 2015, 4:33pm UTC](https://community.zeek.org/t/smb-connections/3922/6 "2015-12-01T16:33:12Z")
Hi, I have tried with ~10MB and ~100 MB files. Yes, I’m seeing some packet drop in the notice.log. I’ll activate the packet\_loss module to get the exact percentage. ps : I’m running 4 workers and everything seems to be ok so far : low cpu and memory usage.(the packet loss still exists…) Regards, Zied ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/smb-connections/3922/7 "2022-05-06T15:43:15Z")
Closed on May 6, 2022, 3:43pm UTC