Methods and Systems of Information Protection, Information Security

SECURITY RESEARCH AND NETWORK TRAFFIC ANALYSIS OF THE SMB OVER QUIC PROTOCOL IN WINDOWS SERVER 2025 INFRASTRUCTURE

N. S. Vasilev
UDC: 004.7.056 Published: 01.06.2026 Issue: Vol. 2 No. 010 (2026): Professionalitet, 2026 DOI: 10.24412/3033-9359-2026-010-39-50
Download PDF

Abstract

With growing data volumes and remote work, file resource security has become critical. Traditional SMB over TCP (port 445) is vulnerable to passive traffic interception and is often blocked by firewalls. This article examines SMB over QUIC, which encapsulates SMB traffic into a secure QUIC tunnel over UDP (port 443) with mandatory TLS 1.3 encryption. The study aims to practically verify the deployment methodology of this protocol and to comparatively analyze its network traffic with classic SMB. During the experiment, an isolated laboratory environment based on Windows Server 2025 (version 24H2, build 26100.32230) and Windows 11 Pro (version 25H2, build 26200.7840) was deployed. Using Wireshark 4.6.8 analyzer, traffic of both protocols was intercepted and investigated. The results showed that in an SMB over QUIC session, the analyzer displays the payload exclusively as Protected Payload, without decoding protocol commands or file names. In a control session of classic SMB over TCP (with default settings without forcibly enabled SMB Encryption), the same operations (Create Request, Read, Close) and the file name test.txt (size 1 KB) appear in plain text. It is concluded that SMB over QUIC is a potential alternative to classic VPN solutions exclusively for secure file access, provided that the Public Key Infrastructure (PKI), strict authentication, and auditing are correctly configured, but it does not replace a full-fledged VPN for routing all network traffic. The limitations of the study include the use of a self-signed certificate and a laboratory network without modeling real operating conditions.

Online viewer

References

  1. Adzhivapaev, M. M. (2025). Sovremennye transportnye protokoly: TCP, UDP i QUIC [Modern transport protocols: TCP, UDP and QUIC]. Informatsionnye tekhnologii i vychislitel'nye sistemy. https://cyberleninka.ru/article/n/sovremennye-transportnye-protokoly-tcp-udp-i-quic
  2. Microsoft Learn. (n.d.). SMB security. https://learn.microsoft.com/ru-ru/windows-server/storage/file-server/smb-security
  3. Andreyanov, N. S. (2024). Issledovanie klient-servernykh protokolov dlya povysheniya otkazoustoychivosti i bezopasnosti soedineniya [Study of client-server protocols to improve fault tolerance and connection security]. Vestnik nauki i obrazovaniya. https://cyberleninka.ru/article/n/issledovanie-klient-servernyh-protokolov-dlya-povysheniya-otkazoustoychivosti-i-bezopasnosti-soedineniya
  4. Microsoft Learn. (n.d.). SMB over QUIC. https://learn.microsoft.com/ru-ru/windows-server/storage/file-server/smb-over-quic
  5. Microsoft Learn. (n.d.). TLS 1.3 in Windows Server. https://learn.microsoft.com/ru-ru/windows-server/security/tls/tls-1.3
  6. IETF. (2021). RFC 9000: QUIC: A UDP-Based Multiplexed and Secure Transport. https://www.rfc-editor.org/rfc/rfc9000.html
  7. IETF. (2021). RFC 9001: Using TLS to Secure QUIC. https://www.rfc-editor.org/rfc/rfc9001.html
  8. IETF GitHub. (n.d.). QUIC Working Group Documentation. https://quicwg.github.io/
  9. Simachev, A. Y. (2022). Otsenka skrytykh kanalov po pamyati v protokole QUIC i metody ikh obnaruzheniya [Assessment of memory covert channels in the QUIC protocol and methods for their detection]. Informatsionnaya bezopasnost' regionov Rossii. https://cyberleninka.ru/article/n/otsenka-skrytyh-kanalov-po-pamyati-v-protokole-quic-i-metody-ih-obnaruzheniya
  10. Smirnov, I. A. (2025). HTTP/3 i protokol QUIC: budushchee vysokoproizvoditel'nykh veb-servisov [HTTP/3 and QUIC protocol: the future of high-performance web services]. Molodoy uchenyy. https://cyberleninka.ru/article/n/http-3-i-protokol-quic-buduschee-vysokoproizvoditelnyh-veb-servisov
  11. Galimullina, A. V. (2024). Poluchenie sobytiy s klienta i statuse sostoyaniya klientov sredstvami Samba AD [Obtaining events from the client and the status of clients using Samba AD]. Informatsionnye tekhnologii. https://cyberleninka.ru/article/n/poluchenie-sobytiy-s-klienta-i-statuse-sostoyaniya-klientov-sredstvami-samba-ad

License

Copyright (c) 2026 N. S. Vasilev (Author)

Creative Commons Attribution (CC BY) 4.0

Keywords

SMB over QUIC Windows Server 2025 network security Wireshark TLS 1.3 QUIC protocol file share