El Capitan only tries SMBv1 on some servers

by

I am not able to connect to Windows SMB shares on some hosts since we’ve disabled SMBv1 on our domain. After doing some research with Wireshark, it seems my Mac is only offering SMBv1 as an option to some hosts:

Internet Protocol Version 4, Src: 10.10.10.75 (10.10.10.75), Dst: 10.10.11.201 (10.10.11.201)
Transmission Control Protocol, Src Port: 62280, Dst Port: 445, Seq: 1, Ack: 1, Len: 51
SMB (Server Message Block Protocol)
    SMB Header
    Negotiate Protocol Request (0x72)
        Word Count (WCT): 0
        Byte Count (BCC): 12
        Requested Dialects
            Dialect: NT LM 0.12
                Buffer Format: Dialect (2)
                Name: NT LM 0.12

This is NOT the same behavior I see when connecting SMB to another host (which is still working after negotiating SMBv2):

Internet Protocol Version 4, Src: 10.10.10.75 (10.10.10.75), Dst: 10.10.11.75 (10.10.11.75)
Transmission Control Protocol, Src Port: 62914, Dst Port: 445, Seq: 1, Ack: 1, Len: 73
SMB (Server Message Block Protocol)
    SMB Header
    Negotiate Protocol Request (0x72)
        Word Count (WCT): 0
        Byte Count (BCC): 34
        Requested Dialects
            Dialect: NT LM 0.12
            Dialect: SMB 2.002
            Dialect: SMB 2.???

These hosts are in the same domain, and I am using the same method to connect to them (Finder, cmd-K, cifs://./c$). Everything I can find indicates that El Capitan should use SMBv3 in all cases — does anyone know why it only tries SMBv1 here?

Answer

Okay, well after some more investigation it looks like changing cifs:// to smb:// results in the desired effect — SMBv2 is requested and the mount succeeds. I’ve always used cifs:// in the past though as this seemed the most reliable method, but after finding the article here I think this was misguided.

Attribution
Source : Link , Question Author : ebarrere , Answer Author : ebarrere

Leave a Comment