Skip navigation
This discussion is archived

What is smbclient?

15156 Views 12 Replies Latest reply: Dec 27, 2008 6:16 PM by Network 23 RSS
HandyMac Level 2 Level 2 (415 points)
Currently Being Moderated
Oct 25, 2008 5:23 PM
Suddenly, a process called "smbclient" is trying to establish a network connection, according to Little Snitch. About every five minutes a series of LS windows pops up, informing me that, e.g.

"Finder via smbclient
wants to connect to
c-67-164-151-171.hsd1.nm.comcast.net on TCP port 139 (netbios-ssn).
...
Established by: /usr/bin/smbclient"

LS shows alerts like this regarding four currently running apps (Finder, QuickTime, TextEdit, CheckOff). When I look in Activity Monitor, it shows 1 to 4 "smbclient" processes running when these messages show up. Anyone know what "smbclient" is, and why it would be doing this?
MacBook Pro 17" 2.16GHz, Mac OS X (10.5.5), 2GB RAM, 160GB HD, SuperDrive
  • nerowolfe Level 6 Level 6 (13,070 points)
    Currently Being Moderated
    Oct 25, 2008 5:28 PM (in response to HandyMac)
    smbclient (samba) is a computer (usually windows) network protocol, associated with netbios.
    Any Window Boxes on your network?
    Are you running filesharing?

    Message was edited by: nerowolfe
    MacBookPro3,1-17"Core2Duo/VistaUlt64SP1; MacBookPro1,1-15"/XPProSP3; Dual G5/XPP, Mac OS X (10.5.5), Homebrew 3GHz ASUS PC, Dell Inspiron8k
  • Kappy Level 10 Level 10 (221,035 points)
    Currently Being Moderated
    Oct 25, 2008 5:59 PM (in response to HandyMac)
    See this page for the manual pages for smbclient.
    Mac Pro 2.66 Ghz; MacBook Pro C2D 2.33 Ghz; MacBook Pro 2.16 Ghz, Mac OS X (10.5.4), Intel iMac C2D 17 "; MacBook 2.0 Ghz; 30 GB iPod Video (Black); iPod Nano 2 GB
  • Kappy Level 10 Level 10 (221,035 points)
    Currently Being Moderated
    Oct 25, 2008 6:27 PM (in response to HandyMac)
    smbclient is a Unix process that communicates with the Samba server. You don't need to be running Windows as most Linux distros also use a Samba server/client to communicate on Windows networks. What you are seeing may be caused by your VirtualBox VM.
    Mac Pro 2.66 Ghz; MacBook Pro C2D 2.33 Ghz; MacBook Pro 2.16 Ghz, Mac OS X (10.5.4), Intel iMac C2D 17 "; MacBook 2.0 Ghz; 30 GB iPod Video (Black); iPod Nano 2 GB
  • nerowolfe Level 6 Level 6 (13,070 points)
    Currently Being Moderated
    Oct 26, 2008 8:42 AM (in response to HandyMac)
    HandyMac wrote:
    Thanks for the info, though I'm afraid it's rather beyond my level of expertise.


    It's possible that it was a probe from the internet. If you are connected directly to the internet or do not have a router with NAT or a good firewall, these probes, usually for the infamous winders port 139 (netbios) may get through to your computer but they are harmless. If they are getting through, however, it does show that you may have open port(s).
    All my ports are set to stealth.
    Check your computer firewall settings and also log into your router and check the settings there as well.

    Message was edited by: nerowolfe
    MacBookPro3,1-17"Core2Duo/VistaUlt64SP1; MacBookPro1,1-15"/XPProSP3; Dual G5/XPP, Mac OS X (10.5.5), Homebrew 3GHz ASUS PC, Dell Inspiron8k
  • Kappy Level 10 Level 10 (221,035 points)
    Currently Being Moderated
    Oct 26, 2008 10:19 AM (in response to HandyMac)
    Although it may not be running now it may have initiated the process during installation or when you first installed your Windows client. Like with Parallels and VM Fusion the networking extensions are run at boot up whether the VM is active or not.

    It's easy enough to verify by asking VirtualBox tech support. It may even be in the documentation if you're willing to read through most of it.
    Mac Pro 2.66 Ghz; MacBook Pro C2D 2.33 Ghz; MacBook Pro 2.16 Ghz, Mac OS X (10.5.4), Intel iMac C2D 17 "; MacBook 2.0 Ghz; 30 GB iPod Video (Black); iPod Nano 2 GB
  • gmg7 Calculating status...
    Currently Being Moderated
    Oct 26, 2008 10:24 AM (in response to Kappy)
    If I got a Leopard Why would I need a Family Pack?? What is the difference to a Single Pack? I do though want accounts on the computer not just one account username!
    imac, Mac OS X (10.4.11)
  • Kappy Level 10 Level 10 (221,035 points)
    Currently Being Moderated
    Oct 26, 2008 10:34 AM (in response to gmg7)
    You are threadjacking. Please post your question as a separate topic in the appropriate forum.
    Mac Pro 2.66 Ghz; MacBook Pro C2D 2.33 Ghz; MacBook Pro 2.16 Ghz, Mac OS X (10.5.4), Intel iMac C2D 17 "; MacBook 2.0 Ghz; 30 GB iPod Video (Black); iPod Nano 2 GB
  • Andrew No Thanks Level 1 Level 1 (5 points)
    Currently Being Moderated
    Nov 12, 2008 10:23 AM (in response to HandyMac)
    I'm having a similar issue. Little Snitch pops up to tell me that:
    "Finder via smbclient wants to connect to 5.68.250.83 on TCP port 139 (netbios-ssn)"
    The connection is established by: "/usr/bin/smbclient" with the Process ID of 426
    The PArent Application is: "/System/Library/CoreServices/Finder.app/Contents/MacOS/Finder" with a Process ID of 218

    Can anyone provide any enlightenment as to what is going on. Why does Mac OS Finder need to make this connection? I have no applications running.
    Should I tell Little Snitch to deny these 'smbclient' connections forever? Or will that break some part of my Mac OS. I am running Time Machine over my wireless network using a Time Capsule. But I don't remember these messages popping up while I was setting up Time Machine, so I can't beleive this is the cause.

    Any help would be wildly appreciated!

    A.
    17" MacBook Pro 2.6 GHz Intel Core 2 Duo, Mac OS X (10.5.5), Little Snitch v 2.0.4
  • techiejohn Level 1 Level 1 (5 points)
    Currently Being Moderated
    Dec 27, 2008 6:08 PM (in response to Andrew No Thanks)
    I ran into this same problem. I was on a hotel network and I would get a Little Snitch alert asking me to allow smbclient to connect to some IP. Looking at the process it was being launched by Finder. When I killed and had Finder relaunch, it would do it again.

    So, I ran trusty dtrace and found that Finder basically runs what is equivalent to nmblookup -M -- -. This queries the local network for master browsers. One of the IPs listed was the IP that smbclient was trying to connect to. So if you run that nmblookup from the Terminal you should see the IP that Little Snitch is warning you about.

    There's nothing to worry about. It appears to be normal SMB service discovery stuff.

    Hope this helps!

    John
    MacBook Pro, Mac OS X (10.5.5)
  • Network 23 Level 6 Level 6 (11,510 points)
    Currently Being Moderated
    Dec 27, 2008 6:16 PM (in response to HandyMac)
    Do you have File Sharing turned on, and when you go into the Sharing preference and click the Options for File Sharing, is "Share files and folders using SMB" on? That would activate a lot of SMB code.

    Because I can't find any SMB processes running in my Activity monitor, but I switched off SMB sharing a long time ago and never turn it on.
    Mac Pro, MacBook Pro, Mac OS X (10.5.6), PowerBook G4 15" Al, PowerBook G3 FireWire, PowerCenter Pro, PowerBook 160

Actions

More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • This solved my question - 10 points
  • This helped me - 5 points
This site contains user submitted content, comments and opinions and is for informational purposes only. Apple disclaims any and all liability for the acts, omissions and conduct of any third parties in connection with or related to your use of the site. All postings and use of the content on this site are subject to the Apple Support Communities Terms of Use.