Why do smbstatus show 47 active connections from nobody users from the same IP?

cesarsj · 05-12-2020, 01:15 PM

OS Slackware 14.1
Samba version 4.4.16

What can cause this strange behavior? Would each user of that nobody be a person or a station process? Or a samba failure? 47 users on the NAS coming from the same IP is very strange.

The client it is supposedly a Windows 10 station, so a service colleague reported me

business_kid · 05-14-2020, 06:18 AM

Things can open several connections, but that sounds strange indeed.

Is it a legit user? Is he entitled to be there?

Time for a visit or a phone call at the very least. His box may have malware, or be doing something strange - restarting a process that pukes, for instance.

shruggy · 05-14-2020, 06:48 AM

See this question. According to comments there and in the Launchpad bug linked from there, the issue seems to be fixed in recent Samba versions:

Quote:

Originally Posted by Scott Bell

This appears to be fixed (at least in Centos 7) with the latest Samba 4.7.19.el7_5.

Quote:

Originally Posted by luca (alunno)

This issue affect Samba 4.3.11 Ubuntu 14.04 and 16.04. Does not affect Samba 4.6.2 on Centos 7.