SMB and RPC Discovery Without Credentials
Identify computers without a completed login
Otter’s SMB and RPC probes run from Linux or Windows without credentials or a capture driver. They collect service and reported identity evidence through bounded negotiation exchanges, then stop at the server’s NTLM challenge.
| Probe | Request | Evidence retained |
|---|---|---|
| SMB, TCP 445 | SMB2/3 negotiation and one NTLM Type 1 session setup | Dialect, signing mode, server GUID, computer/domain names, and optional reported NT major/minor/build |
| SMB1 fallback, TCP 445 | One fresh NT LM 0.12 negotiation, with at most one extended-security Type 1 session setup | Negotiation/domain evidence, native OS/LAN-manager strings, and NTLM names/version when supplied |
| RPC, TCP 135 | One endpoint-mapper bind with NTLM Type 1 | Accepted service, computer/domain names, and optional reported NT major/minor/build |
The scanner never completes a login, sends NTLM Type 3 or RPC AUTH3, enumerates shares or endpoints, activates DCOM, or executes WMI/WinRM commands.
Bounded fallback for older SMB servers
SMB2/3 is always attempted first. Otter reconnects once for SMB1 only after a correlated STATUS_NOT_SUPPORTED response or a connection close/reset before negotiation response bytes arrive. Malformed, partial, mismatched, or timed-out responses do not trigger fallback. A successful SMB2 negotiation never falls back because authentication is refused.
Classic-security SMB1 servers supply negotiation and domain evidence only: Otter does not attempt anonymous, guest, or classic login. It does not install or enable a Windows SMB1 component. The probe uses TCP 445, not NetBIOS sessions on TCP 139.
Interpret OS evidence carefully
Exports use the os-fingerprint source, with raw.protocol identifying smb or rpc. Original NTLM evidence and candidate Windows releases remain available. For example, reported NT build 17763 can correspond to Windows 10 1809 or Windows Server 2019; Otter retains both candidates.
A negotiated SMB dialect is not an OS version. Compatible implementations can synthesize Windows version values, and these probes cannot establish an edition, installed hotfixes, cumulative-update revision, or patch compliance. Missing version data leaves OS identity unset.
Scope and controls
Both probes are enabled by default. Disable them independently with --no-smb and --no-rpc, noSmb and noRpc in otter.json, or their GUI toggles. With ARP enabled, they use discovered, unambiguous MAC/IP targets. With --no-arp, MAC-less replies stay unresolved; computer names and server GUIDs do not replace MAC correlation.