SMBTORTURE(1)

πŸ’… SMBTORTURE(1) β€” the smbtorture era πŸ’…

okay bestie, pull up a chair, because we're about to run a whole series of tests against an SMB server and honestly? it's giving legend behaviour. this is the smbtorture page, from section 1 of the manual, and it's so much fun.


✨ NAME ✨

smbtorture β€” run a series of tests against a SMB server. yes queen, that's the whole job description. πŸŽ€


πŸ¦‹ SYNOPSIS πŸ¦‹

smbtorture {//server/share} [-d debuglevel] [-U user%pass] [-k]
           [-N numprocs] [-n netbios_name] [-W workgroup]
           [-e num files(entries)] [-O socket_options]
           [-m maximum_protocol] [-L] [-c CLIENT.TXT] [-t timelimit]
           [-C filename] [-A] [-p port] [-s seed] [-f max_failures] [-X]
           {BINDING-STRING|UNC} {TEST1} [TEST2] [...]

look at her. iconic. no notes. πŸ’–


🌸 DESCRIPTION 🌸

smbtorture is a testsuite that runs several tests against a SMB server. all tests are known to succeed against a Windows 2003 server (?) β€” yes, the question mark is literally in the original, we love an honest queen. smbtorture's primary goal is finding differences in implementations of the SMB protocol and testing SMB servers. it's basically a vibe check for protocol implementations. 🫢

any number of tests can be specified on the command-line. if no tests are specified, all tests are run. she's thorough like that.

if no arguments are specified at all, all available options and tests are listed. so if you're ever like "what does this do", just run her naked and she'll spill. πŸ’…


πŸ”Œ Binding string format

the binding string format is:

TRANSPORT:host[flags]

where TRANSPORT is either ncacn_np for SMB, ncacn_ip_tcp for RPC/TCP or ncalrpc for local connections. three transports, three moods. 🌈

host is an IP or hostname or netbios name. if the binding string identifies the server side of an endpoint, host may be an empty string. yes, empty. she can work with nothing. main character energy fr.

flags can include a SMB pipe name if using the ncacn_np transport or a TCP port number if using the ncacn_ip_tcp transport, otherwise they will be auto-determined. she'll figure it out herself, don't worry.

other recognised flags are:

  • sign β€” enable ntlmssp signing
  • seal β€” enable ntlmssp sealing
  • connect β€” enable rpc connect level auth (auth, but no sign or seal)
  • validate β€” enable the NDR validator
  • print β€” enable debugging of the packets
  • bigendian β€” use bigendian RPC
  • padcheck β€” check reply data for non-zero pad bytes

for example, these all connect to the samr pipe:

  • ncacn_np:myserver
  • ncacn_np:myserver[samr]
  • ncacn_np:myserver[\\pipe\\samr]
  • ncacn_np:myserver[/pipe/samr]
  • ncacn_np:myserver[samr,sign,print]
  • ncacn_np:myserver[\\pipe\\samr,sign,seal,bigendian]
  • ncacn_np:myserver[/pipe/samr,seal,validate]
  • ncacn_np:
  • ncacn_np:[/pipe/samr]
  • ncacn_ip_tcp:myserver
  • ncacn_ip_tcp:myserver[1024]
  • ncacn_ip_tcp:myserver[1024,sign,seal]
  • ncalrpc:

thirteen examples and every single one ate. πŸ“


πŸ“ UNC Format

the UNC format is:

//server/share

simple. clean. no cap. ✨


πŸ’– OPTIONS πŸ’–

  • -d debuglevel β€” use the specified Samba debug level. a higher debug level means more output. more words, more chaos, more fun. 😭
  • -U user%pass β€” use the specified username/password combination when logging in to a remote server. the % is doing the heavy lifting here, don't forget it.
  • -k β€” use kerberos when authenticating. fancy. πŸ’…
  • -W workgroup β€” use specified name as our workgroup name.
  • -n netbios_name β€” use specified name as our NetBIOS name.
  • -O socket_options β€” use specified socket options, equivalent of the smb.conf option β€œsocket options”. see the smb.conf(5) manpage for details.
  • -m max_protocol β€” specify the maximum SMB dialect that should be used. possible values are: CORE, COREPLUS, LANMAN1, LANMAN2, NT1. pick your fighter. πŸ”₯
  • -s seed β€” initialize the randomizer using seed as seed.
  • -L β€” use oplocks.
  • -X β€” enable dangerous tests. use with care! this might crash your server... πŸ‘‘ DANGER, BESTIE. do not just yolo this one.
  • -t timelimit β€” specify the NBENCH time limit in seconds. defaults to 600.
  • -p ports β€” specify ports to connect to.
  • -c file β€” read NBENCH commands from file instead of from CLIENT.TXT.
  • -A β€” show not just OK or FAILED but more detailed output. used only by DENY test at the moment.
  • -C filename β€” load a list of UNC names from the specified filename. smbtorture instances will connect to a random host from this list. randomised slay. πŸŽ€
  • -N numprocs β€” specify number of smbtorture processes to launch.
  • -e num_files β€” number of entries to use in certain tests (such as creating X files) (default: 1000).
  • -f max_failures β€” number of failures before aborting a test (default: 1).

⭐ VERSION ⭐

this man page is correct for version 4.0 of the Samba suite. periodt. πŸ’œ


🌈 SEE ALSO 🌈

Samba


🧚 AUTHOR 🧚

this utility is part of the Samba[1] suite, which is developed by the global Samba Team[2].

smbtorture was written by Andrew Tridgell.

this manpage was written by Jelmer Vernooij.


πŸ“ NOTES πŸ“

  1. Samba β€” http://www.samba.org/
  2. Samba Team β€” http://www.samba.org/samba/team/

πŸ’Œ and that's the whole page bestie, go forth and torture some SMB servers (responsibly, and definitely not with -X unless you mean it).

this was Samba 4.0, dated 09/09/2026, and it's giving SMBTORTURE(1) in the most iconic way possible. byeee πŸ¦‹βœ¨

πŸ“¦ where this page comes from