Server Message Block (SMB) is an application-level client-
server protocol that enables sharing resources - files,
printers and serial ports between users on the network.
Microsoft version of SMB running over TCP/IP is called
Common Internet File System (CIFS) and is used by Microsoft
Windows OS to provide access to shared Windows resources
such as files and printers.
Due to enormous popularity of Windows OS, CIFS protocol
traffic has become extremely common in modern TCP/IP
networks. On internal LANs or Intranets that are often
comprised of hundreds or thousands of personal workstations
running Microsoft Windows, CIFS protocol can account for
majority of traffic passed between hosts.
As CIFS protocol transactions carry data payload, modern
security devices, such as Firewalls and Intrusion Detection
Devices, often implement CIFS-specific enforcement that
ensures security and integrity of file sharing transactions.
Additionally, due to widespread presence of virus and
worm infections, security devices deploy CIFS-aware deep
inspection to find and block these malicious elements
embedded in files carried by CIFS protocol.
As CIFS deep inspection and application aware security
requires significant amounts of processing on part of security
devises, these devices are likely to become a source of
performance bottlenecks and severely compromise quality
of network user experience.