<html><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><meta http-equiv="Content-Type" content="text/html; charset=gb2312" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hello,<div class=""><br class=""></div><div class="">Wondering if someone might be able to clarity this a bit for me:</div><div class=""><br class=""></div><div class=""><h1 class="title" style="margin: 0px 0px 20px; padding: 0px; border: 0px; outline: 0px; font-size: 30px; vertical-align: baseline; background-color: rgb(255, 255, 255); color: rgb(51, 51, 51); font-stretch: normal; line-height: 30px; font-family: Arial, Helvetica, sans-serif; position: relative; word-wrap: break-word; background-position: 0px 0px;">Suricata 4.1 beta 1 ready for testing </h1><div class="entry clearfix" style="margin: 0px; padding: 0px; border: 0px; outline: 0px; font-size: 14px; vertical-align: baseline; background-color: rgb(255, 255, 255); font-stretch: normal; line-height: 1.5em; font-family: Helvetica, Arial, sans-serif; caret-color: rgb(85, 85, 85); color: rgb(85, 85, 85); background-position: 0px 0px;"></div></div><div class=""><h2 style="margin: 0px 0px 0.5em; padding: 0px; border: 0px; outline: 0px; font-size: 1.8em; vertical-align: baseline; color: rgb(51, 51, 51); line-height: 1.5em; font-family: Helvetica, Arial, sans-serif; background-position: 0px 0px;" class="">Main features additions</h2><ul style="margin: 0px 0px 1.5em; padding: 0px 0px 0px 30px; border: 0px; outline: 0px; font-size: 14px; vertical-align: baseline; list-style-position: initial; list-style-image: initial; caret-color: rgb(85, 85, 85); color: rgb(85, 85, 85); font-family: Helvetica, Arial, sans-serif; background-position: 0px 0px;" class=""><li style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background-position: 0px 0px;" class="">SMBv1/2/3 parsing, logging, file extraction</li></ul></div><div class=""><br class=""></div><div class="">I enabled RUST support for suricata 4.1 beta and turn on smb feature in configuration, but I didn¡¯t see any output information about SMB file info. </div><div class=""><br class=""></div><div class="">In Debug mode, I only saw some limited information for filename in suricata.log, no other extra information. </div><div class=""><br class=""></div><div class=""><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">[8864] 22/5/2018 -- 00:58:26 - (<a href="http://debug.rs:64/" class="">debug.rs:64</a>) <Notice> (<rust>) -- idx 18 tx id 141 ver:2 cmd:5 progress true/true type_data Some(CREATE(SMBTransactionCreate { disposition: 1, delete_on_close: false, directory: false, filename: [116, 0, 111, 0, 110, 0, 121, 0], guid: [169, 0, 0, 0, 0, 0, 0, 0, 169, 0, 0, 0, 255, 255, 255, 255], create_ts: 1497034296, last_access_ts: 1503015689, last_write_ts: 1503015689, last_change_ts: 1503015689, size: 8192 })) tx SMBTransaction { id: 141, vercmd: SMBVerCmdStat { smb_ver: 2, smb1_cmd: 0, smb2_cmd: 5, status_set: true, status_is_dos_error: false, status_error_class: 0, status: 0 }, hdr: SMBCommonHdr { ssn_id: 4398046511177, tree_id: 5, rec_type: 5, msg_id: 151 }, request_done: true, response_done: true, type_data: Some(CREATE(SMBTransactionCreate { disposition: 1, delete_on_close: false, directory: false, filename: [116, 0, 111, 0, 110, 0, 121, 0], guid: [169, 0, 0, 0, 0, 0, 0, 0, 169, 0, 0, 0, 255, 255, 255, 255], create_ts: 1497034296, last_access_ts: 1503015689, last_write_ts: 1503015689, last_change_ts: 1503015689, size: 8192 })), detect_flags_ts: 0, detect_flags_tc: 0, logged: LoggerFlags { flags: 0 }, de_state: None, events: 0x0 }</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">[8864] 22/5/2018 -- 00:58:26 - (<a href="http://debug.rs:64/" class="">debug.rs:64</a>) <Notice> (<rust>) -- idx 19 tx id 142 ver:2 cmd:11 progress true/true type_data Some(IOCTL(SMBTransactionIoctl { func: 590016 })) tx SMBTransaction { id: 142, vercmd: SMBVerCmdStat { smb_ver: 2, smb1_cmd: 0, smb2_cmd: 11, status_set: true, status_is_dos_error: false, status_error_class: 0, status: 0 }, hdr: SMBCommonHdr { ssn_id: 4398046511177, tree_id: 0, rec_type: 6, msg_id: 152 }, request_done: true, response_done: true, type_data: Some(IOCTL(SMBTransactionIoctl { func: 590016 })), detect_flags_ts: 0, detect_flags_tc: 0, logged: LoggerFlags { flags: 0 }, de_state: None, events: 0x0 }</span></div></div><div class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><br class=""></span></div><div class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><br class=""></span></div><div class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Thanks,</span></div><div class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Tidy</span></div></div></body></html>