What is SMB (Server Message Block)?
SMB, or Server Message Block, is a network protocol for accessing shared files and other resources on a server. An SMB client establishes a connection and user session, connects to a share, then sends operations such as opening, reading and writing files. A Windows network drive is one familiar way of using it, but SMB also works with suitable NAS devices and non-Windows systems.
Mapping a drive does not copy the whole share to your computer. The files remain on the server, with client caching where appropriate. Access depends on the negotiated protocol, identity, permissions, network path and storage behind the share. A successful login therefore does not prove that a particular file is writable, and a fast internet speed test does not prove that a NAS transfer will be fast.
The Techie Broadband terminology guide connects SMB with the surrounding storage and networking concepts. This guide follows the session through to the file, then separates access failures from performance limits.
What is an SMB share?
A share is a named resource published by an SMB server. In Windows, a UNC path such as \\nas\projects identifies the server nas and share projects. A file beneath it might be reached as \\nas\projects\report.txt. A mapped drive letter is a convenient local reference to that remote location, not a new storage device.
The share name need not match the underlying folder name. A Windows server could publish D:\CompanyData as projects; a Samba server could publish a directory from a Linux filesystem under the same share name. The client needs the server-presented name, not a guess about its internal disk layout.
Item | What it identifies | What it does not establish |
|---|---|---|
Server name | The machine or service being contacted | A working user session |
Share name | A resource the server publishes | Permission for every file underneath |
UNC file path | A location inside that resource | A local offline copy |
Mapped drive | A client-side reference to a share | Guaranteed access in every application context |
SMB client and server describe roles. A desktop can share a folder while also accessing another machine's share. A NAS is a storage appliance that may offer SMB; SMB itself is the access protocol.
How an SMB connection reaches a file
Microsoft's SMB file-sharing overview describes the client/server roles and negotiated dialects. A simplified modern SMB2/SMB3 exchange follows this sequence:
Reach the server through a supported transport.
Negotiate a mutually supported dialect and capabilities.
Establish a user session through the selected authentication mechanism.
Connect the session to the requested share, called a tree connect.
Open or create the requested file with the required access and sharing mode.
Read, write or query it, then close the file when appropriate.
These are logical stages, not a fixed packet count for every application action. Authentication may involve several exchanges; existing sessions and cached state can be reused. The SMB CREATE operation can open an existing file, so seeing CREATE in a trace does not necessarily mean a new file was made.
Reads send a request from client to server and return file data towards the client. Writes send the main payload towards the server. Each operation can succeed or fail independently of earlier session setup. A directory listing that works while a write fails is therefore useful evidence about where to investigate.
The infographic separates dialect negotiation, the user session, file requests and the two permission checks. Signing and encryption are shown separately because they solve different problems.
SMB dialects, CIFS and Samba
An SMB dialect is a protocol version negotiated by the endpoints. A device's advertised SMB support does not tell you which dialect your current connection uses, or whether a particular optional feature is active.
Term | Meaning | Practical implication |
|---|---|---|
SMB1 | The older protocol family | Replace dependencies on it rather than enabling it as a routine fix |
SMB2 | Redesigned protocol family with reduced legacy overhead | Useful modern functionality, but not SMB3 encryption |
SMB3 | Adds capabilities including encryption and Multichannel | Both endpoint support and configuration matter |
SMB 3.1.1 | Includes preauthentication integrity | Negotiation protection does not mean all file data is encrypted |
CIFS | Common Internet File System, a historical SMB-related name still used in tools and filesystem terminology | A Linux mount labelled cifs is not proof that SMB1 was negotiated |
Samba | Software implementing SMB and related services on non-Windows systems | It is an implementation, not another SMB dialect |
SMB1 is not installed by default on many modern Windows releases. An old device that only works after SMB1 is enabled has a compatibility problem requiring attention. Investigate firmware, supported service settings or replacement options before weakening the client to suit it.
SMB 3.1.1 protects negotiation and session-setup messages with preauthentication integrity. That helps detect tampering with the negotiated relationship. It is distinct from deciding whether subsequent application data must be encrypted.
Authentication and permission are separate checks
Authentication establishes the session's identity. Authorisation determines whether that identity may perform the requested operation. Depending on the deployment, authentication may use domain Kerberos, NTLM or a local account on a NAS. Do not assume a successful session used your intended account.
In a domain environment, use a correctly configured server name and service identity. Replacing a hostname with an IP address can change authentication behaviour and prevent normal Kerberos use. An IP-based test can help isolate name resolution, but it is not an equivalent production configuration.
On a Windows file server, access through a share must satisfy both share-level and filesystem permissions. The filesystem check includes the user's effective rights from the applicable security configuration. Samba and NAS products can introduce their own account mapping and permission rules.
Techie Broadband example: two permission checks
The following is an illustrative model with no explicit deny rules, special privileges or other policy restrictions. It asks whether the same user's effective share and filesystem rights both permit each operation.
Effective share rights | Effective file rights | Read | Write |
|---|---|---|---|
Read | Read and write | Allowed | Blocked by share rights |
Read and write | Read | Allowed | Blocked by file rights |
Read and write | Read and write | Allowed | Allowed |
No access | Read and write | Blocked | Blocked |
The model explains why changing only one permission layer can leave the error unchanged. Real ACL evaluation also involves group membership, inheritance, deny entries and the precise requested rights. Delete, rename and folder traversal must be evaluated as their own operations, not assumed from a simple read/write label.
Identify the account used by the actual application or service.
Inspect the share's access policy and the target folder's effective permissions.
Check inherited rights and relevant group membership.
Distinguish read-only access from inability to authenticate.
Check whether an existing session is reusing different credentials.
A mapped drive visible in an interactive desktop session may not be available to a scheduled task or service running in another security context. Give that task the correct path and authorised identity rather than relying on a drive letter that exists only for another logon.
SMB signing is not SMB encryption
Signing protects message integrity and helps defend against tampering and relay attacks. It does not conceal ordinary unencrypted file contents from someone able to observe the traffic. Encryption protects content in transit between the SMB endpoints and includes integrity protection for encrypted messages.
Neither mechanism decides whether a user can delete a file, encrypts the disks at rest or creates a backup. An authorised account can still make damaging changes through a protected connection. The broader encryption guide explains why transport and stored-data protection need separate consideration.
Check | Question it answers |
|---|---|
Authentication | Which identity established this session? |
Signing | Is the unencrypted SMB message protected against tampering? |
SMB encryption | Is the protected SMB content concealed in transit? |
File permissions | May this identity perform this operation? |
Backup and recovery | Can the required data and access be restored after damage? |
SMB3 supports encryption, but support alone does not establish that the current share connection uses it. Verify actual connection state and policy. An encrypted connection need not also carry a separate SMB signature on every encrypted message because its authenticated encryption already provides integrity.
Why a Windows update can expose a NAS compatibility problem
Microsoft's dedicated SMB signing guidance, checked in October 2026, lists different defaults by edition and connection direction. It states that Windows 11 24H2 Pro, Enterprise and Education require inbound and outbound signing, while Windows Server 2025 requires outbound signing. Its Home-edition guidance differs, so do not apply a blanket statement to every Windows installation.
Requiring signing can prevent access to a third-party server configured without signing and can conflict with guest access. The useful correction is to inspect the NAS's supported SMB settings and use an authenticated account with suitable protection. Disabling signing or enabling insecure guest access should not be the first troubleshooting step.
Ports and remote access
Conventional directly hosted SMB normally uses TCP port 445. Older NetBIOS-based sharing can involve other ports. Name discovery and browsing are also separate from opening a known share: a server missing from a network browser may still be accessible by its correctly configured name.
For remote access, avoid treating an ordinary home NAS as a public TCP 445 service. A suitably protected VPN can provide a controlled path into the network. Firewall policy and user permissions still apply, and the remote route adds latency and broadband limits.
SMB over QUIC is a distinct supported transport. Microsoft's current documentation describes a TLS 1.3-protected tunnel using UDP 443 by default, with an explicitly enabled server and certificate configuration. Availability depends on the actual client/server product and version; supporting SMB3 does not mean a NAS supports SMB over QUIC.
QUIC transport does not remove user authentication or file access checks. It also does not turn the server's broadband upload into its download rate. CGNAT, reachability, certificates and firewall rules should be assessed for the intended remote-access design rather than assumed from a static IP address.
What limits SMB transfer speed?
Follow the data direction. A local NAS read crosses the NAS storage, its processor and network interface, the switch or WiFi path, and the client. Broadband is outside a direct local path. A remote read also crosses the server site's upstream connection and the reader site's downstream connection.
The server's upload capacity can therefore limit a remote read even when the reader has a fast download service. A remote write reverses the main payload direction. UK FTTC, FTTP, cable and mobile products differ; verify the actual rates on both ends rather than assuming symmetry.
For bulk transfer, check the narrowest relevant component. For small files, repeated opening, metadata, security scanning and storage operations can dominate. Microsoft documents this distinction in its SMB performance guidance. A low copy rate is not automatically proof of an ISP problem.
Techie Broadband calculation: bandwidth and data in flight
To keep a 1 Gbps path busy across a 30 ms round trip, the bandwidth-delay product is 1,000,000,000 bits per second multiplied by 0.03 seconds. That is 30,000,000 bits, or 3.75 decimal MB of data in flight.
If an illustrative transfer is constrained to only 1 MiB of outstanding payload, the modelled ceiling at that RTT is 1,048,576 bytes divided by 0.03 seconds: about 34.95 MB/s, or 279.6 Mbps. It cannot fill the 1 Gbps path under those assumptions.
Assumed effective payload in flight | Modelled ceiling at 30 ms RTT |
|---|---|
256 KiB | 69.9 Mbps |
1 MiB | 279.6 Mbps |
4 MiB | 1,118.5 Mbps before the 1 Gbps path limit |
This is a theoretical pipeline model, not a Windows TCP-window setting, SMB-credit count or measured result. TCP behaviour, SMB request limits, application concurrency, server resources and loss can all affect the useful amount of outstanding work. The model shows why latency and concurrency need investigation alongside headline capacity.
Techie Broadband calculation: reading 5 GB remotely
For a decimal 5 GB file, there are 40,000 megabits to deliver. At sustained payload rates of 50, 100 and 1,000 Mbps, ideal times are 800, 400 and 40 seconds respectively: 13 minutes 20 seconds, 6 minutes 40 seconds and 40 seconds.
If a NAS site has 50 Mbps upstream, a remote gigabit reader cannot obtain that file in 40 seconds through that connection. If the figures are advertised line rates, the calculated times are lower bounds before protocol overhead, competing traffic and other limits. Encryption processing or slow disks can reduce performance further.
Multichannel, RDMA and compression
SMB Multichannel can establish multiple connections for one session with suitable endpoint support. It can use compatible network capabilities to improve throughput or resilience, but does not guarantee that two ports double performance. Confirm the channels actually selected and the shared bottlenecks.
SMB Direct uses RDMA-capable infrastructure. It is a different capability from a fast Ethernet link and is mainly relevant to suitable server environments. Neither feature is a general way to bypass a limited home broadband upstream.
Compression can reduce transmitted data for compressible content. Already compressed archives or media may benefit little, while processing costs still matter. Similarly, increasing parallel file-copy work can hide some waiting but also increase contention. Test the real workload and preserve its required integrity settings.
Caching, locks and interrupted connections
SMB leases and oplocks let clients cache permitted state while coordinating with the server. A lease can cover read, write or handle caching; the server can request a change when another operation needs conflicting access. A warm-cache test can therefore measure something different from reading the same file from server storage for the first time.
A file's sharing mode is separate from its security permissions. An application can open a file while restricting other opens for reading, writing or deletion. A sharing violation may therefore mean another application holds an incompatible open, even though your account has sufficient permission. Byte-range locks add another form of coordination. Neither mechanism makes every application safe for concurrent editing automatically.
Durable handles can support reconnecting an eligible open after a connection interruption. Support, timeout and recovery conditions matter; this is not a promise that any application can keep writing during an outage. Continuously available shares and clustered recovery add further requirements. Test how the actual application reports interrupted or failed writes before relying on the deployment for critical data.
Read-only diagnostic examples
These examples are checked against official command documentation. Techie Broadband has not run them against an SMB server for this article. Replace nas.example with your actual server name and projects with your actual share. A name used in a domain environment must match its intended authentication configuration.
On Windows, test conventional TCP reachability:
Test-NetConnection -ComputerName nas.example -Port 445
This tests a TCP connection, not authentication, share access or SMB over QUIC. After opening the intended share, inspect established SMB connections:
Get-SmbConnection | Format-List *
Look for the intended server, share, user and dialect, plus the security fields available in that Windows version. Configuration policy and actual session state are different evidence. To inspect the client's signing requirement:
Get-SmbClientConfiguration | Format-List RequireSecuritySignature
On a machine with current Samba client tools, the following requests encrypted access and lists a share without modifying its files:
smbclient //nas.example/projects -U alex --client-protection=encrypt -c 'ls'
The current Samba smbclient manual documents the protection option and interactive password prompt. Do not put the password in the command. If the encryption requirement cannot be met, investigate endpoint support and policy rather than assuming the share itself is missing.
Linux kernel mounts use the cifs filesystem interface for SMB access. A kernel mount and smbclient are different clients; one working does not prove the other's options, credentials or negotiated dialect are identical. Inspect each connection rather than transferring conclusions between them.
Troubleshoot in the order the connection is built
Identify the exact application, server name, share and user context. Distinguish a mapped drive from the underlying UNC path.
Confirm the intended route and transport. Check DNS and firewall reachability before changing credentials. Keep local and remote tests separate.
Inspect authentication. Check the account actually used, retained sessions and relevant domain or NAS configuration. A repeated password prompt is not the same as a file-permission failure.
Inspect negotiation and protection. Check dialect, signing and encryption requirements on both ends. Update the incompatible endpoint rather than immediately enabling legacy or guest access.
Check share and filesystem authorisation. Test the precise operation that fails, including rename or delete where relevant, using a disposable authorised test file.
Establish a wired local performance baseline. Confirm interface speeds and server storage behaviour before adding WiFi, a VPN or broadband to the path.
Compare representative workloads. Separate a large sequential file from many small files, and record cache state, security settings and competing work.
Check server and client logs, CPU, storage and network loss. Change one justified variable at a time and repeat the same workload.
Symptom | Useful distinction |
|---|---|
Server absent from browsing | Discovery may fail while a known path still works |
TCP 445 test succeeds | Transport works; authentication and authorisation remain unproven |
Login works but writes fail | Share, filesystem or application rights may differ |
Older NAS fails after client update | Negotiation, signing or guest policy may have changed |
Large file fast, small files slow | Per-file work and round trips may dominate |
Remote read slow, local read fast | Investigate the added remote path and server upload |
Initial speed drops later | Cache-assisted speed may exceed sustained storage performance |
SMB compared with NFS, synchronisation and backups
NFS also exposes server-held files through a client filesystem. The right choice depends on the client estate, application support, identity model and deployment. Neither protocol is universally faster, and a cross-protocol test should compare equivalent workloads and security conditions.
File synchronisation manages separate copies and can support offline work. An SMB mapping alone does not. Offline-file products, replication and cloud gateways introduce additional behaviour that must be configured and assessed separately.
SMB is also not a backup system. An authorised client can overwrite or delete the server's files, including through an encrypted session. Recovery needs retained copies, appropriate access separation and a tested restore. Preserve ownership, ACLs and the application context needed to use the restored data.
SMB questions answered
Is SMB only for Windows?
No. Windows commonly uses it, but suitable NAS systems, Samba servers and other clients also support SMB. Verify dialects, authentication and optional features on the actual endpoints.
Is CIFS different from SMB?
CIFS means Common Internet File System, a historical SMB-related term. It also remains in Linux tooling names. A cifs mount label alone does not identify the negotiated SMB dialect or prove that SMB1 is being used.
Is SMB signing the same as encryption?
No. Signing protects integrity without concealing ordinary unencrypted file content. SMB encryption protects content in transit and provides integrity protection for the encrypted messages.
Does SMB use my broadband connection?
Only when the actual path crosses it. A direct local NAS connection uses the LAN; remote access also depends on the broadband rates and direction of the data transfer.
Why can I open a share but not save a file?
Session establishment and directory access do not guarantee write permission. Check the actual user, share-level rights, filesystem rights and precise operation the application requests.
Is SMB over QUIC available on every NAS?
No. It requires specific transport support and configuration. SMB3 compatibility by itself does not establish QUIC support, certificates or remote-access policy.
Key takeaway
SMB connects an authenticated session to server-held resources. Diagnose the relationship in order: destination, transport, dialect, identity, protection, permissions and workload. Buying more broadband capacity will only help when the transfer crosses that connection and its capacity is the relevant constraint.
